Edit tour

Windows Analysis Report
BCb8yQ0fg8.exe

Overview

General Information

Sample name:	BCb8yQ0fg8.exe renamed because original name is a hash value
Original sample name:	807675A50EE7545E02DAEAC9822842B7.exe
Analysis ID:	1434650
MD5:	807675a50ee7545e02daeac9822842b7
SHA1:	967094e1ef9155a031687396ba99855e54870612
SHA256:	2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88
Tags:	exeStealc
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

BCb8yQ0fg8.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\BCb8yQ0fg8.exe" MD5: 807675A50EE7545E02DAEAC9822842B7)

cmd.exe (PID: 7272 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 8120 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

chrome.exe (PID: 7372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://473750571567004317064230583514468350804565684324378075159610742091604698238217701484029465762430135913242023857750034401559054060945654540273638867228794983640833862748912121851334807031249099092790952130035074227943842970399582505875/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1800,i,5224496107934403145,5816890975472559302,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "http://193.163.7.88/a69d09b357e06b52.php"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\cgfmw	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
C:\Users\user\AppData\Local\Temp\cgfmw	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.cmd.exe.38e00c8.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.cmd.exe.38e00c8.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.cmd.exe.38e00c8.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.cmd.exe.38e00c8.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7272, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 8120, ProcessName: explorer.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://193.163.7.88/a69d09b357e06b52.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cgfmw

Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Found malware configuration

Source: 1.2.cmd.exe.38e00c8.0.raw.unpack

Malware Configuration Extractor: Vidar {"C2 url": "http://193.163.7.88/a69d09b357e06b52.php"}

Multi AV Scanner detection for submitted file

Source: BCb8yQ0fg8.exe	Virustotal: Detection: 19%			Perma Link
Source: BCb8yQ0fg8.exe	ReversingLabs: Detection: 15%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cgfmw

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetProcAddress
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: LoadLibraryA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: lstrcatA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: OpenEventA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateEventA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CloseHandle
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Sleep
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: VirtualFree
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetSystemInfo
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: VirtualAlloc
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HeapAlloc
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetComputerNameA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: lstrcpyA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetProcessHeap
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetCurrentProcess
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: lstrlenA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ExitProcess
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetSystemTime
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: advapi32.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: gdi32.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: user32.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: crypt32.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ntdll.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetUserNameA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateDCA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetDeviceCaps
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ReleaseDC
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sscanf
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: VMwareVMware
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HAL9TH
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: JohnDoe
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DISPLAY
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: http://193.163.7.88
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: /a69d09b357e06b52.php
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: /f77a9ad318e8e915/
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: cozy15
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetFileAttributesA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GlobalLock
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HeapFree
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetFileSize
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GlobalSize
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: IsWow64Process
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Process32Next
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetLocalTime
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: FreeLibrary
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetVolumeInformationA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Process32First
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetModuleFileNameA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DeleteFileA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: FindNextFileA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: LocalFree
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: FindClose
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: LocalAlloc
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetFileSizeEx
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ReadFile
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SetFilePointer
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: WriteFile
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateFileA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: FindFirstFileA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CopyFileA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: VirtualProtect
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetLastError
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: lstrcpynA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: MultiByteToWideChar
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GlobalFree
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: WideCharToMultiByte
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GlobalAlloc
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: OpenProcess
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: TerminateProcess
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetCurrentProcessId
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: gdiplus.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ole32.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: bcrypt.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: wininet.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: shlwapi.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: shell32.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: psapi.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: rstrtmgr.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SelectObject
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BitBlt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DeleteObject
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateCompatibleDC
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdiplusStartup
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdiplusShutdown
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdipDisposeImage
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GdipFree
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CoUninitialize
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CoInitialize
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CoCreateInstance
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BCryptDecrypt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BCryptSetProperty
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BCryptDestroyKey
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetWindowRect
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetDesktopWindow
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetDC
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CloseWindow
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: wsprintfA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CharToOemW
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: wsprintfW
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RegQueryValueExA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RegEnumKeyExA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RegOpenKeyExA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RegCloseKey
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RegEnumValueA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CryptUnprotectData
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SHGetFolderPathA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ShellExecuteExA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: InternetOpenUrlA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: InternetConnectA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: InternetCloseHandle
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: InternetOpenA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HttpSendRequestA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HttpOpenRequestA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: InternetReadFile
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: InternetCrackUrlA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: StrCmpCA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: StrStrA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: StrCmpCW
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: PathMatchSpecA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RmStartSession
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RmRegisterResources
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RmGetList
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: RmEndSession
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_open
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_step
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_column_text
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_finalize
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_close
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3_column_blob
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: encrypted_key
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: PATH
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: NSS_Init
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: NSS_Shutdown
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: PK11_FreeSlot
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: PK11_Authenticate
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: C:\ProgramData\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: browser:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: profile:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: url:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: login:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: password:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Opera
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: OperaGX
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Network
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: cookies
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: .txt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: TRUE
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: FALSE
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: autofill
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: history
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: name:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: month:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: year:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: card:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Cookies
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Login Data
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Web Data
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: History
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: logins.json
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: formSubmitURL
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: usernameField
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: encryptedUsername
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: encryptedPassword
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: guid
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: cookies.sqlite
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: formhistory.sqlite
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: places.sqlite
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: plugins
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Local Extension Settings
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Sync Extension Settings
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: IndexedDB
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Opera Stable
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Opera GX Stable
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: CURRENT
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: chrome-extension_
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Local State
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: profiles.ini
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: chrome
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: opera
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: firefox
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: wallets
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ProductName
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ProcessorNameString
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DisplayName
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DisplayVersion
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Network Info:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - IP: IP?
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Country: ISO?
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: System Summary:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - HWID:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - OS:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Architecture:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - UserName:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Computer Name:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Local Time:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - UTC:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Language:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Keyboards:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Laptop:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Running Path:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - CPU:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Threads:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Cores:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - RAM:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - Display Resolution:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: - GPU:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: User Agents:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Installed Apps:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: All Users:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Current User:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Process List:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: system_info.txt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: freebl3.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: mozglue.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: msvcp140.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: nss3.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: softokn3.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: vcruntime140.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Temp\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: .exe
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: runas
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: open
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: /c start
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %DESKTOP%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %APPDATA%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %USERPROFILE%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %DOCUMENTS%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: %RECENT%
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: *.lnk
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: files
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \discord\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Telegram Desktop\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: key_datas
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: map*
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Telegram
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: *.tox
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: *.ini
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Password
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: 00000001
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: 00000002
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: 00000003
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: 00000004
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Pidgin
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \.purple\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: accounts.xml
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: token:
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Software\Valve\Steam
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: SteamPath
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \config\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ssfn*
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: config.vdf
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DialogConfig.vdf
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: libraryfolders.vdf
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: loginusers.vdf
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Steam\
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: sqlite3.dll
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: browsers
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: done
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: soft
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: https
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: POST
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: HTTP/1.1
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: hwid
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: build
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: token
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: file_name
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: file
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: message
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 1.2.cmd.exe.38e00c8.0.raw.unpack	String decryptor: screenshot.jpg

Source: BCb8yQ0fg8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49758 version: TLS 1.2

Source: BCb8yQ0fg8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: BCb8yQ0fg8.exe, 00000000.00000002.1696875335.00000000051D2000.00000004.00000001.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696166985.0000000004AC1000.00000004.00000020.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696358566.0000000004E20000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896691691.0000000005513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896922559.0000000005950000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896820594.0000000004B44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896957182.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BCb8yQ0fg8.exe, 00000000.00000002.1696875335.00000000051D2000.00000004.00000001.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696166985.0000000004AC1000.00000004.00000020.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696358566.0000000004E20000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896691691.0000000005513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896922559.0000000005950000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896820594.0000000004B44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896957182.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdbgggGCTL source: BCb8yQ0fg8.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb source: BCb8yQ0fg8.exe

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Code function: 0_2_006DD060 FindFirstFileExW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,

0_2_006DD060

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://193.163.7.88/a69d09b357e06b52.php

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.105
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.111
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.104
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.111
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.104
Source: unknown	TCP traffic detected without corresponding DNS query: 23.53.35.105
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zC4Eb3mDpgwO3dy&MD=LPFEY77X HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zC4Eb3mDpgwO3dy&MD=LPFEY77X HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: BCb8yQ0fg8.exe, 00000000.00000002.1695863530.0000000004763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695863530.0000000004763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: chromecache_49.5.dr	String found in binary or memory: http://www.broofa.com
Source: BCb8yQ0fg8.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.000000000480A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.0000000005875000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: chromecache_55.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_55.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?Architecture:
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failedWould
Source: chromecache_49.5.dr, chromecache_55.5.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_55.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_55.5.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_55.5.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: chromecache_55.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_49.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_49.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_49.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_49.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_49.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_55.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_55.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_55.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: chromecache_55.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_55.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_49.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_49.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_49.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49758 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: cgfmw.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D4A13 NtQuerySystemInformation,		0_2_006D4A13
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D4A13 NtQuerySystemInformation,		0_2_006D4A13

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006DE8C0	0_2_006DE8C0
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D28B0	0_2_006D28B0
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D8AC0	0_2_006D8AC0
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006DD4F0	0_2_006DD4F0
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006DBDF0	0_2_006DBDF0
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D85D0	0_2_006D85D0

Source: BCb8yQ0fg8.exe

Static PE information: invalid certificate

Source: BCb8yQ0fg8.exe, 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCheckIP.dll0 vs BCb8yQ0fg8.exe
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs BCb8yQ0fg8.exe
Source: BCb8yQ0fg8.exe, 00000000.00000002.1695766067.0000000004669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCheckIP.dll0 vs BCb8yQ0fg8.exe
Source: BCb8yQ0fg8.exe, 00000000.00000002.1696358566.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BCb8yQ0fg8.exe
Source: BCb8yQ0fg8.exe, 00000000.00000002.1696166985.0000000004BE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BCb8yQ0fg8.exe
Source: BCb8yQ0fg8.exe	Binary or memory string: OriginalFilenameCheckIP.dll0 vs BCb8yQ0fg8.exe

Source: BCb8yQ0fg8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/16@4/4

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

File created: C:\Users\user\AppData\Local\Temp\8028f380

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: BCb8yQ0fg8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BCb8yQ0fg8.exe	Virustotal: Detection: 19%
Source: BCb8yQ0fg8.exe	ReversingLabs: Detection: 15%

Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed Would you like to download it now?
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failedWould you like to download it now?
Source: BCb8yQ0fg8.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

File read: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BCb8yQ0fg8.exe "C:\Users\user\Desktop\BCb8yQ0fg8.exe"
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://473750571567004317064230583514468350804565684324378075159610742091604698238217701484029465762430135913242023857750034401559054060945654540273638867228794983640833862748912121851334807031249099092790952130035074227943842970399582505875/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1800,i,5224496107934403145,5816890975472559302,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1800,i,5224496107934403145,5816890975472559302,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: BCb8yQ0fg8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: BCb8yQ0fg8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: BCb8yQ0fg8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: BCb8yQ0fg8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: BCb8yQ0fg8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: BCb8yQ0fg8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: BCb8yQ0fg8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: BCb8yQ0fg8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: BCb8yQ0fg8.exe, 00000000.00000002.1696875335.00000000051D2000.00000004.00000001.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696166985.0000000004AC1000.00000004.00000020.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696358566.0000000004E20000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896691691.0000000005513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896922559.0000000005950000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896820594.0000000004B44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896957182.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BCb8yQ0fg8.exe, 00000000.00000002.1696875335.00000000051D2000.00000004.00000001.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696166985.0000000004AC1000.00000004.00000020.00020000.00000000.sdmp, BCb8yQ0fg8.exe, 00000000.00000002.1696358566.0000000004E20000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896691691.0000000005513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896922559.0000000005950000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896820594.0000000004B44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896957182.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdbgggGCTL source: BCb8yQ0fg8.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb source: BCb8yQ0fg8.exe

Source: BCb8yQ0fg8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: BCb8yQ0fg8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: BCb8yQ0fg8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: BCb8yQ0fg8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: BCb8yQ0fg8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: cgfmw.1.dr

Static PE information: section name: hypon

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D80EF push dword ptr [edi+18h]; ret	0_2_006D80F3
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D7164 push ecx; ret	0_2_006D7165
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D81BB push ebx; iretd	0_2_006D823C
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D8276 push ss; ret	0_2_006D8275
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D8276 push cs; ret	0_2_006D827D
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D8240 push ebx; iretd	0_2_006D823C
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D8240 push ss; ret	0_2_006D8275
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D742B push eax; ret	0_2_006D742D
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D6D59 push es; retf	0_2_006D6D5B
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006E059A push ecx; ret	0_2_006E05AD
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D6E61 push eax; iretd	0_2_006D6E62
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D8E92 push ds; ret	0_2_006D8EA1

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\cgfmw

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\cgfmw

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\cmd.exe

File deleted: c:\users\user\desktop\bcb8yq0fg8.exe

Jump to behavior

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\CGFMW

Source: C:\Windows\SysWOW64\cmd.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cgfmw

Jump to dropped file

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

API coverage: 9.7 %

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Code function: 0_2_006DD060 FindFirstFileExW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,

0_2_006DD060

Source: BCb8yQ0fg8.exe, 00000000.00000002.1695863530.0000000004763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Code function: 0_2_006E0937 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006E0937

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006DAB99 mov eax, dword ptr fs:[00000030h]	0_2_006DAB99
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006D50E3 mov eax, dword ptr fs:[00000030h]	0_2_006D50E3
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006DAB19 mov eax, dword ptr fs:[00000030h]	0_2_006DAB19

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006E0800 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006E0800
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006E0937 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006E0937
Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Code function: 0_2_006E0A99 SetUnhandledExceptionFilter,	0_2_006E0A99

HIPS / PFW / Operating System Protection Evasion

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 8120 base: 2EE0000 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 8120 base: 2D9F2D8 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 8120 base: 2DA01E8 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 8120 base: 2679C0 value: 55	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 8120 base: 790000 value: 00	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2679C0			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 790000			Jump to behavior

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Code function: 0_2_006E0620 cpuid

0_2_006E0620

Source: C:\Users\user\Desktop\BCb8yQ0fg8.exe

Code function: 0_2_006E0B55 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006E0B55

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cgfmw, type: DROPPED

Yara detected Stealc

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cgfmw, type: DROPPED

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cgfmw, type: DROPPED

Yara detected Stealc

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cmd.exe.38e00c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cgfmw, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	11 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 DLL Side-Loading	311 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BCb8yQ0fg8.exe	20%	Virustotal		Browse
BCb8yQ0fg8.exe	16%	ReversingLabs	Win32.Trojan.Nekark

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\cgfmw	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\cgfmw	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.broofa.com	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/lcreport/	0%	URL Reputation	safe
http://subca.ocsp-certum.com05	0%	URL Reputation	safe
http://subca.ocsp-certum.com02	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://ccsca2021.ocsp-certum.com05	0%	URL Reputation	safe
http://c0rl.m%L	0%	Avira URL Cloud	safe
http://193.163.7.88/a69d09b357e06b52.php	100%	Avira URL Cloud	malware
http://crl3.digicert.	0%	Avira URL Cloud	safe
http://193.163.7.88/a69d09b357e06b52.php	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.251.16.100	true	false	high
www.google.com	64.233.180.99	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.163.7.88/a69d09b357e06b52.php	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_promos	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.certum.pl/ctsca2021.crl0o	BCb8yQ0fg8.exe	false		high
http://repository.certum.pl/ctnca.cer09	BCb8yQ0fg8.exe	false		high
http://www.vmware.com/0	BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.broofa.com	chromecache_49.5.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.certum.pl/ctnca.crl0k	BCb8yQ0fg8.exe	false		high
https://aka.ms/dotnet/app-launch-failedWould	BCb8yQ0fg8.exe	false		high
https://aka.ms/dotnet-core-applaunch?Architecture:	BCb8yQ0fg8.exe	false		high
http://www.vmware.com/0/	BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s	BCb8yQ0fg8.exe	false		high
https://aka.ms/dotnet/app-launch-failed	BCb8yQ0fg8.exe	false		high
https://www.certum.pl/CPS0	BCb8yQ0fg8.exe	false		high
http://c0rl.m%L	BCb8yQ0fg8.exe, 00000000.00000002.1695863530.0000000004763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.symauth.com/cps0(	BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_55.5.dr	false		high
http://repository.certum.pl/ccsca2021.cer0	BCb8yQ0fg8.exe	false		high
https://aka.ms/dotnet-core-applaunch?	BCb8yQ0fg8.exe	false		high
https://plus.google.com	chromecache_55.5.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_49.5.dr	false		high
http://repository.certum.pl/ctsca2021.cer0	BCb8yQ0fg8.exe	false		high
https://csp.withgoogle.com/csp/lcreport/	chromecache_55.5.dr	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com05	BCb8yQ0fg8.exe	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	BCb8yQ0fg8.exe, 00000000.00000002.1695941866.0000000004860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003288000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com02	BCb8yQ0fg8.exe	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com01	BCb8yQ0fg8.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.info-zip.org/	BCb8yQ0fg8.exe, 00000000.00000002.1695941866.000000000480A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.1896840352.0000000005875000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.1896700511.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca2.crl0l	BCb8yQ0fg8.exe	false		high
http://repository.certum.pl/ctnca2.cer09	BCb8yQ0fg8.exe	false		high
http://ccsca2021.ocsp-certum.com05	BCb8yQ0fg8.exe	false	URL Reputation: safe	unknown
https://apis.google.com	chromecache_49.5.dr, chromecache_55.5.dr	false		high
http://crl3.digicert.	BCb8yQ0fg8.exe, 00000000.00000002.1695863530.0000000004763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	BCb8yQ0fg8.exe	false		high
https://domains.google.com/suggest/flow	chromecache_55.5.dr	false		high
https://clients6.google.com	chromecache_55.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
64.233.180.99	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434650
Start date and time:	2024-05-01 15:46:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BCb8yQ0fg8.exe renamed because original name is a hash value
Original Sample Name:	807675A50EE7545E02DAEAC9822842B7.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/16@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.253.62.94, 172.253.122.84, 172.253.122.101, 172.253.122.102, 172.253.122.138, 172.253.122.139, 172.253.122.113, 172.253.122.100, 34.104.35.123, 142.251.167.94, 199.232.210.172, 192.229.211.108, 172.253.115.94, 142.251.16.113, 142.251.16.139, 142.251.16.101, 142.251.16.100, 142.251.16.138, 142.251.16.102
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
15:47:21	API Interceptor	2x Sleep call for process: cmd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://streamviewspan.com/~am~/index.php	Get hash	malicious	HTMLPhisher	Browse
	https://981243.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse
	SecuriteInfo.com.Trojan.PackedNET.2603.717.7438.exe	Get hash	malicious	Unknown	Browse
	https://ubhealth-my.sharepoint.com/:w:/g/personal/jenny_mason_ubhealthcare_co_uk/ESn5QzrvawJPuXYR4RRACvIBMPWOZSDndKyB6LYDahXWFw?e=4%3aXHPcee&at=9	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	http://www.corpsierramadre.com/	Get hash	malicious	Unknown	Browse
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse
	https://app.box.com/s/zv46ei45hi6oa2wwz7joeovipn4mmwjc	Get hash	malicious	Unknown	Browse
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	SecuriteInfo.com.Trojan.PackedNET.2603.717.7438.exe	Get hash	malicious	Unknown	Browse	142.251.163.101
	https://ubhealth-my.sharepoint.com/:w:/g/personal/jenny_mason_ubhealthcare_co_uk/ESn5QzrvawJPuXYR4RRACvIBMPWOZSDndKyB6LYDahXWFw?e=4%3aXHPcee&at=9	Get hash	malicious	HTMLPhisher	Browse	142.251.111.100
	file.exe	Get hash	malicious	RisePro Stealer	Browse	142.251.111.100
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	142.251.16.139
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.253.115.100
	http://t.co/hcEcRRZbgB	Get hash	malicious	HTMLPhisher	Browse	172.253.122.139
	https://doc-46.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	172.253.122.139
	fBirvIlaOJ.exe	Get hash	malicious	RedLine	Browse	172.253.122.101
	SecuriteInfo.com.Win64.CoinminerX-gen.1250.29250.exe	Get hash	malicious	Unknown	Browse	172.253.122.139
	SecuriteInfo.com.Win64.CoinminerX-gen.1250.29250.exe	Get hash	malicious	Unknown	Browse	172.253.122.100

ASNs

⊘No context

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	SecuriteInfo.com.Trojan.PackedNET.2603.717.7438.exe	Get hash	malicious	Unknown	Browse	23.209.58.93 20.12.23.50
	https://ubhealth-my.sharepoint.com/:w:/g/personal/jenny_mason_ubhealthcare_co_uk/ESn5QzrvawJPuXYR4RRACvIBMPWOZSDndKyB6LYDahXWFw?e=4%3aXHPcee&at=9	Get hash	malicious	HTMLPhisher	Browse	23.209.58.93 20.12.23.50
	file.exe	Get hash	malicious	RisePro Stealer	Browse	23.209.58.93 20.12.23.50
	http://www.corpsierramadre.com/	Get hash	malicious	Unknown	Browse	23.209.58.93 20.12.23.50
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	23.209.58.93 20.12.23.50
	https://app.box.com/s/zv46ei45hi6oa2wwz7joeovipn4mmwjc	Get hash	malicious	Unknown	Browse	23.209.58.93 20.12.23.50
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	23.209.58.93 20.12.23.50
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	23.209.58.93 20.12.23.50
	https://autode.sk/44qi2l0	Get hash	malicious	Unknown	Browse	23.209.58.93 20.12.23.50
	https://autode.sk/44qi2l0	Get hash	malicious	Unknown	Browse	23.209.58.93 20.12.23.50

Process:	C:\Users\user\Desktop\BCb8yQ0fg8.exe
File Type:	data
Category:	dropped
Size (bytes):	882182
Entropy (8bit):	7.392188234423486
Encrypted:	false
SSDEEP:	24576:wvX8Uhe8KVoa5IzW4XzwSs/SLuOzwEmSj:wvX8UhfKVP5Y1zwv/K/zwzSj
MD5:	A2372FC8FA9DEBDBCEC130A674F422FC
SHA1:	2EFBDFEF6C96752AF76DC82611603D88DD436B00
SHA-256:	CA22A18DF93B2AF7139D4797930D96EBB9E63ABB637DC9179773A6566C010291
SHA-512:	2B4C85C2A681070B5B712CD184AC0C5C9A3A5BD105668C418A2F9D2A31684845F11BF0DFEB91A035098F3D795521D5AF30F5E958311D4340CCE531DDFBCE14B6
Malicious:	false
Reputation:	low
Preview:	f..e..e..e..d..!..E..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..@..!..@.........2.....6...............6......e..e..e..e..e..e..e..e..e..e..e..&......... ...e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..&......,.....e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..@..!...9......... ........e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e..e......K...W...e..e..e..e..e..e..e..e..e..e..

C:\Users\user\AppData\Local\Temp\cgfmw

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	6.191741252019896
Encrypted:	false
SSDEEP:	3072:YvtlGc6fgpJSG61doHN4N4QSUukO/yIwoeL1DGBJuOb:YvLJryZoI4RvkOKEnuG
MD5:	6B75CEC8F96DAF072098B3D3859D3080
SHA1:	A6838615614C855E21D63E78E2C50972F400D4C8
SHA-256:	0F4A87E94883051FD2E41F48168F0A587B1A509CE03530BB8D62C26FF669F99A
SHA-512:	5053A4B2F03055A959965ACC92678959DBC3D3939CAC7C679C9E40616CB29DBECA51D5848CC002E477D1CF691677828DA4452AC0C97404B4B0AA356AD2AD3C8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: C:\Users\user\AppData\Local\Temp\cgfmw, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: C:\Users\user\AppData\Local\Temp\cgfmw, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.dZ............a.......a.......a...5...............................Z...a.......a.......Rich............................PE..L.....fR......................!......6............@...........................#...........@.....................................<............................`#.. ...................................................................................text............................... ....rdata...q.......r..................@..@.data...,+!..0......................@....reloc...@...`#..B..................@..Bhypon.........#......V..............@...................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1746)
Category:	downloaded
Size (bytes):	163891
Entropy (8bit):	5.55061820245277
Encrypted:	false
SSDEEP:	3072:S0eiNiuzs8v4HHKWY8s1BgP4IDQ9GURWu8zylA/u8PemUPhDlaY/ADiZ65LpK629:S0eMhzvwHHKWY8s1BgP4IDQ9GURWu8UD
MD5:	0282D5C4C6038FCEB2FF8607EDAC81A4
SHA1:	62EBF05C33F8A3115C208BB4D5CE9B38F6D06447
SHA-256:	AAAF17E8ED9C8DD5D1B69C8BBB617600A768256654C076F760E09C6047973371
SHA-512:	E21D25042E41527B62E80F9D9B82B85B915BA6D0698B2FFA5D8D59115F764770D1DE2108B72D82D57BFB7A8D4406FB53D091C1DC6D8BD03BED3BCA29CEFD0EAD
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.oT1FwJRCVC4.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvBynad-nWEy1xIb9j1w6LpLOF6IQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.nj=function(a,b,c){return c?a\|b:a&~b};_.oj=function(a,b,c,d){a=_.hb(a,b,c,d);return Array.isArray(a)?a:_.lc};_.pj=function(a,b){a=_.nj(a,2,!!(2&b));a=_.nj(a,32,!0);return a=_.nj(a,2048,!1)};_.qj=function(a,b){0===a&&(a=_.pj(a,b));return a=_.nj(a,1,!0)};_.rj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.sj=function(a,b,c){32&b&&c\|\|(a=_.nj(a,32,!1));return a};._.tj=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.oj(a,b,d);var l=g[_.v]\|0;const n=!!(4&l);if(!n){l=_.qj(l,b);var p=g,r=b,t;(t=!!(2&l))&&(r=_.nj(r,2,!0));let C=!t,X=!0,P=0,H=0;for(;P<p.length;P++){const O=_.Sa(p[P],c,r);if(O instanceof c){if(!t){const Fa=!!((O.ma[_.v]\|0)&2);C&&(C=!Fa);X&&(X=Fa)}p[H++]=O}}H<P&&(p.length=H);l=_.nj(l,4,!0);l=_.nj(l,16,X);l=_.nj(l,8,C);_.wa(p,l);t&&Object.freeze(p)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.rj(l)&&(g=_.va(g),l=_.pj(l,.b),b=_.gb(a,b,d,g));f=g;c=l;for(p=0;p<f.length;p++)l=f[p],r=_.eb(l),l

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (786)
Category:	downloaded
Size (bytes):	791
Entropy (8bit):	5.147901415075528
Encrypted:	false
SSDEEP:	24:1wAvXxj6nBHslgT9lCuABuoB7HHHHHHHYqmffffffo:1wiXxjEKlgZ01BuSEqmffffffo
MD5:	EC2CDBDD01F0DADC0FC3B9CB6B1D7B80
SHA1:	5D7D6DC6B5F7D3092D6A4023948A71CE18DB0DFD
SHA-256:	2946499E234EDB18203D0B2CDDF64591EBDD1575C50497218DB405E2E648D912
SHA-512:	952F3B49D0C063CCA3A939D1872546341D60D31B006AE762206DAC33DD1C8B9E0AC9E150B7CD15948289921878CEF71D6929F74F171D0A19EC1BD2FF5DCF979D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["colorado avalanche winnipeg jets","affordable internet","today wordle answer","dave and busters betting arcade games","gray zone warfare tarkov","nyt strands answers","bolingbrook golf club liv golf","youthforia foundation shades"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	139802
Entropy (8bit):	5.440602720809514
Encrypted:	false
SSDEEP:	1536:yMRA4aKKJXjPInWWt/usD98kiHLnRA0zqevcZ8hhaV+trbbbhYxvdU:e8KJou8TMyez0shCO
MD5:	74F909C06A27C00BE395C0934D522FEA
SHA1:	83E72373A172088FFE239B05304176F466B44521
SHA-256:	BE2CE37C95D54DD5710770A623935305B047A0529D9BF811B31E0FA00EB2B1CA
SHA-512:	A35650094DD91551214F6B5A8E47143AB8B8837F19110C2190BF39E03244BE6A176ABB2DE3C5EE02AFB3A364BCE393027E6C42DE4509D84959FEFF61411A7B05
Malicious:	false
Reputation:	low
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ra gb_ib gb_Ud gb_od\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Id\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_sd gb_ld gb_yd gb_xd\"\u003e\u003cdiv class\u003d\"gb_rd gb_hd\"\u003e\u003cdiv class\u003d\"gb_Pc gb_r\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Pc gb_Sc gb_r\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.150542995862274
Encrypted:	false
SSDEEP:	96:RJYrcoiktfqqMghOKTEzNx8BSIMw591g8IOl8u8i8DF+Ks:wkktfqqMghxlg8Ig8u78D2
MD5:	88BC8C86A83B9BD8EDA6FDF225CDC8DD
SHA1:	473D84930F027A365278C15282725A69721F4B18
SHA-256:	47D960E93D9E7AB4C760A09DA0AA5E6549A8355AD5C0BA8476D4269F4FBDB354
SHA-512:	3BC486D908160D297AD3028C27177A9C41A1D87EF29A456058265FAF74A1DA069D3B0578F05A79F866C2DB752D5E0E42D179158BD62251D4FDA601A7CBA7CC4D
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.T5bVtXo12IQ.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTssrVR1lBtzoy_MObv1DSp-vWG36A"
Preview:	.gb_3e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Hc{text-align:left}.gb_Hc>*{color:#bdc1c6;line-height:16px}.gb_Hc div:first-child{color:white}.gb_qa{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_qa:hover{background-color:rgba(68,71,70,.08)}.gb_qa:focus,.gb_qa:active{background-color:rgba(68,71,70,.12)}.gb_qa:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_qa:hover,.gb_i .gb_qa:focus,.gb_i .gb_qa:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_qa:focus-visible{border-color:#a8c7fa}.gb_ra{-webkit-box

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	121628
Entropy (8bit):	5.506662476672723
Encrypted:	false
SSDEEP:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
MD5:	F46ACD807A10216E6EEE8EA51E0F14D6
SHA1:	4702F47070F7046689432DCF605F11364BC0FBED
SHA-256:	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
SHA-512:	811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.708245175318212
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BCb8yQ0fg8.exe
File size:	944'280 bytes
MD5:	807675a50ee7545e02daeac9822842b7
SHA1:	967094e1ef9155a031687396ba99855e54870612
SHA256:	2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88
SHA512:	12a928dc23e7fd03996e5d41d8fce1d091b0fa979d379e63e6e89d58440f8a21a809a646e1c6431eda68d71515e1aed06219c4f3d8c0c86e25724b1d6e5af5b4
SSDEEP:	24576:e8inPEBCZN5hoVlnJXzJ/SEVSoMAALia4:Dg5BuxF/SRF4
TLSH:	4A15012175E54420E0A3023F48BDABA1857AAF718FB1F0CFA3447DAE5A3D9C1E930756
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8Ae.Y/6.Y/6.Y/6.%+7.Y/6.%,7.Y/6.%*7.Y/6.!.6.Y/6.!.7.Y/6.Y.69Y/6%%&7.Y/6%%-7.Y/6Rich.Y/6........PE..L......c...............".6.

File Icon


Icon Hash:	2771a96949e8512b

Static PE Info

General

Entrypoint:	0x410590
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x638F960F [Tue Dec 6 19:20:47 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5f7bf97ec922bad10bc4de737ab257ee

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/08/2022 07:38:06 24/08/2023 07:38:05
Subject Chain	E=info@exploitox.de, CN="Open Source Developer, Jonas G\xfcnner", O=Open Source Developer, L=Uelzen, S=Niedersachsen, C=DE
Version:	3
Thumbprint MD5:	9107F754D755BA933AC47DFCE107DFB6
Thumbprint SHA-1:	35F4E53A88751BBE67EAA097513E3DB1AD2F49E3
Thumbprint SHA-256:	719B615DB1499BC948B5E7487C43B8BEB824AE62C576F7ADACC81A37CD8B3B14
Serial:	6606F76CF00BC54EB3260E6E1BC70074

Entrypoint Preview

Instruction
call 00007FED0131F5F2h
jmp 00007FED0131EE4Dh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0041D010h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0041D010h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
and dword ptr [0041DA48h], 00000000h
sub esp, 24h
or dword ptr [0041D020h], 01h
push 0000000Ah
call dword ptr [004150BCh]
test eax, eax
je 00007FED0131F192h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b440	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e000	0xc75be	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xe4000	0x2898
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe6000	0x115c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x19490	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x19500	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x193d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15000	0x1fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1353a	0x13600	bf2ff065a6f650143eeda7db528b6c35	False	0.5329637096774194	data	6.792453781810886	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x709a	0x7200	52bee74c9772c70a6f8907b529f30523	False	0.3418311403508772	OpenPGP Public Key	4.430638903645443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0xed8	0xa00	6ce128b02d8927ee9b06ec7d2d722258	False	0.1875	DOS executable (block device driver \377\377\377\377N)	2.4040749330890847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1e000	0xc75be	0xc7600	6ca874172c252530e617f978b3eee543	False	0.8703541340125391	data	7.767515223848266	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0x1240	0x1400	e6dfe2ef8827a2d65c8819991629ace5	False	0.7158203125	data	6.1715723164120195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
LMM	0x1e180	0xb668e	PNG image data, 1112 x 688, 8-bit/color RGBA, non-interlaced	0.9406718865020411
RT_ICON	0xd4810	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 12368 x 12368 px/m	0.09915118892700817
RT_GROUP_ICON	0xe5038	0x14	data	1.15
RT_VERSION	0xe504c	0x388	data	0.43694690265486724
RT_MANIFEST	0xe53d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
KERNEL32.dll	FindNextFileW, GetCurrentProcess, GetModuleHandleExW, GetModuleFileNameW, LeaveCriticalSection, InitializeCriticalSection, GetEnvironmentVariableW, FindClose, MultiByteToWideChar, GetLastError, GetFileAttributesExW, GetFullPathNameW, GetProcAddress, DeleteCriticalSection, WideCharToMultiByte, IsWow64Process, LoadLibraryExW, FreeLibrary, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, EnterCriticalSection, FindFirstFileExW, OutputDebugStringW, LoadLibraryA, GetModuleHandleW, InitializeCriticalSectionAndSpinCount, SetLastError, RaiseException, RtlUnwind, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, IsDebuggerPresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsProcessorFeaturePresent, LCMapStringEx, DecodePointer, EncodePointer, InitializeCriticalSectionEx, GetStringTypeW
USER32.dll	MessageBoxW
SHELL32.dll	ShellExecuteW
ADVAPI32.dll	RegOpenKeyExW, RegGetValueW, DeregisterEventSource, RegisterEventSourceW, ReportEventW, RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll	_crt_atexit, _invalid_parameter_noinfo_noreturn, __p___argc, __p___wargv, _exit, exit, _initterm_e, _errno, _initterm, _get_initial_wide_environment, _c_exit, _configure_wide_argv, _controlfp_s, _set_app_type, _register_onexit_function, _register_thread_local_exe_atexit_callback, _initialize_onexit_table, abort, _cexit, _initialize_wide_environment, terminate, _seh_filter_exe
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __stdio_common_vsprintf_s, setvbuf, __stdio_common_vswprintf, __acrt_iob_func, fputwc, __p__commode, fputws, __stdio_common_vsnwprintf_s, _wfsopen, fflush, __stdio_common_vfwprintf
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, _set_new_mode, free, malloc, calloc
api-ms-win-crt-string-l1-1-0.dll	wcsnlen, strcpy_s, _wcsdup, strcspn, wcsncmp, toupper
api-ms-win-crt-convert-l1-1-0.dll	wcstoul, _wtoi
api-ms-win-crt-locale-l1-1-0.dll	__pctype_func, _unlock_locales, _lock_locales, ___lc_locale_name_func, ___lc_codepage_func, ___mb_cur_max_func, _configthreadlocale, setlocale, localeconv
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, frexp
api-ms-win-crt-time-l1-1-0.dll	_gmtime64_s, wcsftime, _time64

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 15:46:50.850363970 CEST	49678	443	192.168.2.4	104.46.162.224
May 1, 2024 15:46:52.884983063 CEST	49675	443	192.168.2.4	173.222.162.32
May 1, 2024 15:47:02.040949106 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.041002035 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.041058064 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.042857885 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.042867899 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.045861959 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.045901060 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.045958042 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.046118975 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.046134949 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.047179937 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.047219992 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.047271013 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.048001051 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.048018932 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.116233110 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.116277933 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.116343021 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.116691113 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.116703033 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.242271900 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.245043993 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.246571064 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.250330925 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.250339985 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.250624895 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.250644922 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.251226902 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.251245022 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.251693010 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.251712084 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.251768112 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.251847029 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.252278090 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.252346992 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.253391981 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.253458023 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.259613991 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.259686947 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.261537075 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.261544943 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.261750937 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.261765003 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.262063026 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.262137890 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.263127089 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.263134956 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.311614037 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.312283993 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.312352896 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.312391043 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.312509060 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.312510014 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.313358068 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.313443899 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.314203024 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.314280033 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.314331055 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.314336061 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.365053892 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.455714941 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.455751896 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.455791950 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.455801964 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.460051060 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.460097075 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.468164921 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.468281984 CEST	443	49738	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.468331099 CEST	49738	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.474024057 CEST	49735	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.474030972 CEST	443	49735	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.484549046 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.484589100 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.484626055 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.484631062 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.484653950 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.484688044 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.490719080 CEST	49675	443	192.168.2.4	173.222.162.32
May 1, 2024 15:47:02.490967035 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.490998030 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.491005898 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.491013050 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.491048098 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.497541904 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.499299049 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.499331951 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.499345064 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.499351978 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.499391079 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.505973101 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.512568951 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.512613058 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.512620926 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.540143967 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.540338993 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.540384054 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.540932894 CEST	49740	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.540950060 CEST	443	49740	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.567986965 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.579252958 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.582474947 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.582509041 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.582526922 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.582535982 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.582577944 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.589077950 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.595729113 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.595778942 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.595786095 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.602452993 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.602477074 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.602502108 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.602509975 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.602546930 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.609042883 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.615600109 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.615628004 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.615653992 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.615662098 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.615704060 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.621867895 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.628217936 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.628238916 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.628262997 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.628272057 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.628309965 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.634423018 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.640680075 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.640726089 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.640733957 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.647020102 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.647062063 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.647069931 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.653318882 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.653362989 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.653371096 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.659467936 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.659517050 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.659524918 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.674096107 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.674148083 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.674156904 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.677174091 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.677217007 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.677225113 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.683237076 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.683279037 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.683286905 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.688945055 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.689006090 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.689014912 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.698942900 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.699011087 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.699018002 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.700179100 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.700242043 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.700247049 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.708189011 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.708220959 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.708262920 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.708271027 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.708313942 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.712152958 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.716155052 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.716206074 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.716244936 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.716253996 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.716298103 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.720155001 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.724147081 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.724211931 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.724219084 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.728173018 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.728229046 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.728235960 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.731970072 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.732034922 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.732043028 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.734266043 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.734318018 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.734328985 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.738711119 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.738754988 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.738765001 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.742940903 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.742995977 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.743005991 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.747236013 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.747298956 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.747311115 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.751353025 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.751408100 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.751420021 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.755299091 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.755351067 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.755363941 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.759222984 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.759284019 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.759293079 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.763071060 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.763137102 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.763147116 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.766716957 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.766769886 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.766781092 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.770382881 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.770436049 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.770447969 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.775834084 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.775876999 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.775877953 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.775890112 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.775929928 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.779508114 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.781805038 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.781843901 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.781876087 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.781887054 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.781929016 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.784092903 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.786375046 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.786411047 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.786418915 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.786432981 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.786473036 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.788696051 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.790909052 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.790940046 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.790955067 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.790966988 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.791004896 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.793167114 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.795494080 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.795526981 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.795537949 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.795548916 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.795587063 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.797687054 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.799882889 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.799910069 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.799927950 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.799936056 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.799969912 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.802135944 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.804513931 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.804558992 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.804569006 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.805529118 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.805560112 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.805573940 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.805582047 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.805620909 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.805629015 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.805712938 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:02.805757046 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.939783096 CEST	49739	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:02.939848900 CEST	443	49739	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.234628916 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:06.234663010 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.234720945 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:06.235040903 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:06.235064030 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.429635048 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.429877996 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:06.429894924 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.430221081 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.430497885 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:06.430561066 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:06.547780991 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:08.343822002 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.343868971 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.343954086 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.352900028 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.352912903 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.549704075 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.549798012 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.553047895 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.553055048 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.553265095 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.587033033 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.632114887 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.770838022 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.770890951 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.770939112 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.771018982 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.771033049 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.771053076 CEST	49750	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.771058083 CEST	443	49750	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.812597990 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.812630892 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:08.812690973 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.812920094 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:08.812931061 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.028734922 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.028810978 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:09.030199051 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:09.030210018 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.030463934 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.031804085 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:09.076119900 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.238280058 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.238356113 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.238399982 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:09.239190102 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:09.239209890 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:09.239223003 CEST	49751	443	192.168.2.4	23.209.58.93
May 1, 2024 15:47:09.239228010 CEST	443	49751	23.209.58.93	192.168.2.4
May 1, 2024 15:47:14.882184029 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:14.882203102 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:14.882261992 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:14.883127928 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:14.883140087 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.192086935 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.192178965 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.195040941 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.195053101 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.195393085 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.239653111 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.561985970 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.608113050 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763243914 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763262033 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763267994 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763278008 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763309956 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763345003 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.763380051 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763396025 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.763607979 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.763662100 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763715982 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.763721943 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763735056 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.763784885 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.991794109 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.991821051 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:15.991832018 CEST	49752	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:15.991837978 CEST	443	49752	20.12.23.50	192.168.2.4
May 1, 2024 15:47:16.443156004 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:16.443217993 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:16.443300009 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:17.770047903 CEST	49749	443	192.168.2.4	64.233.180.99
May 1, 2024 15:47:17.770067930 CEST	443	49749	64.233.180.99	192.168.2.4
May 1, 2024 15:47:40.427052021 CEST	49732	80	192.168.2.4	23.53.35.105
May 1, 2024 15:47:40.427107096 CEST	49727	80	192.168.2.4	23.53.35.103
May 1, 2024 15:47:40.427148104 CEST	49726	80	192.168.2.4	23.53.35.111
May 1, 2024 15:47:40.427187920 CEST	49725	80	192.168.2.4	23.53.35.104
May 1, 2024 15:47:40.521204948 CEST	80	49726	23.53.35.111	192.168.2.4
May 1, 2024 15:47:40.521218061 CEST	80	49727	23.53.35.103	192.168.2.4
May 1, 2024 15:47:40.521279097 CEST	49726	80	192.168.2.4	23.53.35.111
May 1, 2024 15:47:40.521296024 CEST	49727	80	192.168.2.4	23.53.35.103
May 1, 2024 15:47:40.521528006 CEST	80	49725	23.53.35.104	192.168.2.4
May 1, 2024 15:47:40.521572113 CEST	49725	80	192.168.2.4	23.53.35.104
May 1, 2024 15:47:40.521769047 CEST	80	49732	23.53.35.105	192.168.2.4
May 1, 2024 15:47:40.521810055 CEST	49732	80	192.168.2.4	23.53.35.105
May 1, 2024 15:47:55.461898088 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:55.461925983 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:55.461977959 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:55.462344885 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:55.462357044 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:55.768177032 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:55.768292904 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:55.775103092 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:55.775108099 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:55.775348902 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:55.787718058 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:55.832117081 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065115929 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065135956 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065154076 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065205097 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:56.065242052 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065270901 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065294981 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:56.065325022 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.065342903 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:56.065373898 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:56.072117090 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:56.072132111 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:47:56.072173119 CEST	49758	443	192.168.2.4	20.12.23.50
May 1, 2024 15:47:56.072177887 CEST	443	49758	20.12.23.50	192.168.2.4
May 1, 2024 15:48:06.287913084 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:06.287940979 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:06.288033009 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:06.288229942 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:06.288242102 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:06.799230099 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:06.799506903 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:06.799541950 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:06.799864054 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:06.800157070 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:06.800225973 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:06.849004984 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:09.896316051 CEST	49723	80	192.168.2.4	23.199.71.185
May 1, 2024 15:48:09.896400928 CEST	49724	80	192.168.2.4	72.21.81.240
May 1, 2024 15:48:09.990397930 CEST	80	49724	72.21.81.240	192.168.2.4
May 1, 2024 15:48:09.990510941 CEST	49724	80	192.168.2.4	72.21.81.240
May 1, 2024 15:48:09.990557909 CEST	80	49723	23.199.71.185	192.168.2.4
May 1, 2024 15:48:09.990616083 CEST	49723	80	192.168.2.4	23.199.71.185
May 1, 2024 15:48:16.797683001 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:16.797746897 CEST	443	49760	64.233.180.99	192.168.2.4
May 1, 2024 15:48:16.797792912 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:18.734056950 CEST	49760	443	192.168.2.4	64.233.180.99
May 1, 2024 15:48:18.734082937 CEST	443	49760	64.233.180.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 15:47:01.694837093 CEST	53	63187	1.1.1.1	192.168.2.4
May 1, 2024 15:47:01.897485018 CEST	54288	53	192.168.2.4	1.1.1.1
May 1, 2024 15:47:01.897897005 CEST	61870	53	192.168.2.4	1.1.1.1
May 1, 2024 15:47:01.905474901 CEST	53	52654	1.1.1.1	192.168.2.4
May 1, 2024 15:47:01.994194031 CEST	53	61870	1.1.1.1	192.168.2.4
May 1, 2024 15:47:01.995353937 CEST	53	54288	1.1.1.1	192.168.2.4
May 1, 2024 15:47:02.617317915 CEST	53	65109	1.1.1.1	192.168.2.4
May 1, 2024 15:47:04.772463083 CEST	53	56971	1.1.1.1	192.168.2.4
May 1, 2024 15:47:05.512001991 CEST	55291	53	192.168.2.4	1.1.1.1
May 1, 2024 15:47:05.512125015 CEST	49698	53	192.168.2.4	1.1.1.1
May 1, 2024 15:47:05.607254982 CEST	53	49698	1.1.1.1	192.168.2.4
May 1, 2024 15:47:05.607537031 CEST	53	55291	1.1.1.1	192.168.2.4
May 1, 2024 15:47:21.583406925 CEST	138	138	192.168.2.4	192.168.2.255
May 1, 2024 15:47:24.540198088 CEST	53	60900	1.1.1.1	192.168.2.4
May 1, 2024 15:47:43.696841955 CEST	53	60224	1.1.1.1	192.168.2.4
May 1, 2024 15:48:01.590617895 CEST	53	60476	1.1.1.1	192.168.2.4
May 1, 2024 15:48:07.241719961 CEST	53	58458	1.1.1.1	192.168.2.4
May 1, 2024 15:48:29.211852074 CEST	53	59592	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 15:47:01.897485018 CEST	192.168.2.4	1.1.1.1	0xe605	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:01.897897005 CEST	192.168.2.4	1.1.1.1	0xc272	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 1, 2024 15:47:05.512001991 CEST	192.168.2.4	1.1.1.1	0xc80d	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.512125015 CEST	192.168.2.4	1.1.1.1	0x47b6	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 1, 2024 15:47:01.994194031 CEST	1.1.1.1	192.168.2.4	0xc272	No error (0)	www.google.com			65	IN (0x0001)	false
May 1, 2024 15:47:01.995353937 CEST	1.1.1.1	192.168.2.4	0xe605	No error (0)	www.google.com		64.233.180.99	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:01.995353937 CEST	1.1.1.1	192.168.2.4	0xe605	No error (0)	www.google.com		64.233.180.106	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:01.995353937 CEST	1.1.1.1	192.168.2.4	0xe605	No error (0)	www.google.com		64.233.180.103	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:01.995353937 CEST	1.1.1.1	192.168.2.4	0xe605	No error (0)	www.google.com		64.233.180.147	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:01.995353937 CEST	1.1.1.1	192.168.2.4	0xe605	No error (0)	www.google.com		64.233.180.104	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:01.995353937 CEST	1.1.1.1	192.168.2.4	0xe605	No error (0)	www.google.com		64.233.180.105	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.607254982 CEST	1.1.1.1	192.168.2.4	0x47b6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	plus.l.google.com		142.251.16.100	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	plus.l.google.com		142.251.16.138	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	plus.l.google.com		142.251.16.113	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	plus.l.google.com		142.251.16.139	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	plus.l.google.com		142.251.16.101	A (IP address)	IN (0x0001)	false
May 1, 2024 15:47:05.607537031 CEST	1.1.1.1	192.168.2.4	0xc80d	No error (0)	plus.l.google.com		142.251.16.102	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	64.233.180.99	443	7588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:02 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 13:47:02 UTC	1703	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 13:47:02 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-i46__TY9HyyZSarKxDw87A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 13:47:02 UTC	798	IN	Data Raw: 33 31 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 6f 6c 6f 72 61 64 6f 20 61 76 61 6c 61 6e 63 68 65 20 77 69 6e 6e 69 70 65 67 20 6a 65 74 73 22 2c 22 61 66 66 6f 72 64 61 62 6c 65 20 69 6e 74 65 72 6e 65 74 22 2c 22 74 6f 64 61 79 20 77 6f 72 64 6c 65 20 61 6e 73 77 65 72 22 2c 22 64 61 76 65 20 61 6e 64 20 62 75 73 74 65 72 73 20 62 65 74 74 69 6e 67 20 61 72 63 61 64 65 20 67 61 6d 65 73 22 2c 22 67 72 61 79 20 7a 6f 6e 65 20 77 61 72 66 61 72 65 20 74 61 72 6b 6f 76 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 61 6e 73 77 65 72 73 22 2c 22 62 6f 6c 69 6e 67 62 72 6f 6f 6b 20 67 6f 6c 66 20 63 6c 75 62 20 6c 69 76 20 67 6f 6c 66 22 2c 22 79 6f 75 74 68 66 6f 72 69 61 20 66 6f 75 6e 64 61 74 69 6f 6e 20 73 68 61 64 65 73 22 5d 2c 5b 22 22 2c 22 22 2c Data Ascii: 317)]}'["",["colorado avalanche winnipeg jets","affordable internet","today wordle answer","dave and busters betting arcade games","gray zone warfare tarkov","nyt strands answers","bolingbrook golf club liv golf","youthforia foundation shades"],["","",
2024-05-01 13:47:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	64.233.180.99	443	7588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:02 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	64.233.180.99	443	7588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:02 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 13:47:02 UTC	1479	IN	HTTP/1.1 200 OK Version: 628208705 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Wed, 01 May 2024 13:47:02 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 13:47:02 UTC	1479	IN	Data Raw: 31 61 34 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 52 61 20 67 62 5f 69 62 20 67 62 5f 55 64 20 67 62 5f 6f 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1a49)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ra gb_ib gb_Ud gb_od\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-05-01 13:47:02 UTC	1479	IN	Data Raw: 30 33 64 5c 22 67 62 5f 4a 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 39 64 20 67 62 5f 4b 63 20 67 62 5f 37 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03d\"gb_Jc\"\u003e\u003ca class\u003d\"gb_9d gb_Kc gb_7d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Oc gb_6d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\
2024-05-01 13:47:02 UTC	1479	IN	Data Raw: 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 4c 61 62 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 67 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 Data Ascii: aria-label\u003d\"Search Labs\" href\u003d\"https://labs.google.com/search?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_g\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0
2024-05-01 13:47:02 UTC	1479	IN	Data Raw: 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 Data Ascii: 9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2
2024-05-01 13:47:02 UTC	821	IN	Data Raw: 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 31 33 30 30 31 30 32 2c 33 37 30 30 32 36 31 2c 33 37 30 31 33 31 30 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 Data Ascii: u-content","metadata":{"bar_height":60,"experiment_id":[1300102,3700261,3701310],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u00
2024-05-01 13:47:02 UTC	413	IN	Data Raw: 31 39 36 0d 0a 7b 7d 3b 5f 2e 71 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 3b 5f 2e 71 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 7d 63 61 74 63 68 28 63 29 7b 7d 72 65 74 75 72 6e 20 61 7d 28 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 6d 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 6b 20 2e 67 62 5f 64 5c 22 29 2c 6e 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 5a 63 5c 22 29 3b 6d 64 5c 75 30 30 32 36 5c 75 30 30 32 36 Data Ascii: 196{};_.q.addEventListener(\"test\",c,b);_.q.removeEventListener(\"test\",c,b)}catch(c){}return a}();\n}catch(e){_._DumpException(e)}\ntry{\nvar md\u003ddocument.querySelector(\".gb_k .gb_d\"),nd\u003ddocument.querySelector(\"#gb.gb_Zc\");md\u0026\u0026
2024-05-01 13:47:02 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 6e 75 6c 6c 21 5c 75 30 30 33 64 61 7c 7c 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 5c 75 30 30 33 64 5c 75 30 30 33 64 62 7d 3b 5f 2e 70 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 76 6f 69 64 20 30 21 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2e 69 7c 7c 76 6f 69 64 20 30 21 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2e 6a 29 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 41 5c 22 29 3b 61 2e 6a 5c 75 30 30 33 64 62 3b 5f 2e 4c 63 28 61 29 7d 3b 5f 2e 71 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 51 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 73 75 70 65 72 28 61 29 7d 7d 3b 72 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 5a 63 7b 7d Data Ascii: 8000b\u0026\u0026null!\u003da\|\|\"function\"\u003d\u003db};_.pd\u003dfunction(a,b){if(void 0!\u003d\u003da.i\|\|void 0!\u003d\u003da.j)throw Error(\"A\");a.j\u003db;_.Lc(a)};_.qd\u003dclass extends _.Q{constructor(a){super(a)}};rd\u003dclass extends _.Zc{}
2024-05-01 13:47:02 UTC	1255	IN	Data Raw: 6e 63 65 6f 66 20 5f 2e 77 64 3f 5f 2e 78 64 28 61 29 3a 5f 2e 44 64 28 61 29 7d 3b 5f 2e 46 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 5c 75 30 30 33 64 63 2e 73 6c 69 63 65 28 29 3b 64 2e 70 75 73 68 2e 61 70 70 6c 79 28 64 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 64 29 7d 7d 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 5c 75 30 30 33 64 5c 75 30 30 33 64 5f 2e 69 62 28 61 2c 62 2c 63 Data Ascii: nceof _.wd?_.xd(a):_.Dd(a)};_.Fd\u003dfunction(a,b){var c\u003dArray.prototype.slice.call(arguments,1);return function(){var d\u003dc.slice();d.push.apply(d,arguments);return a.apply(this,d)}};_.Gd\u003dfunction(a,b,c){return void 0!\u003d\u003d_.ib(a,b,c
2024-05-01 13:47:02 UTC	1255	IN	Data Raw: 2b 5c 22 5c 22 7d 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 51 64 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5f 2e 51 64 3f 61 2e 69 3a 5c 22 74 79 70 65 5f 65 72 72 6f 72 3a 54 72 75 73 74 65 64 52 65 73 6f 75 72 63 65 55 72 6c 5c 22 7d 3b 53 64 5c 75 30 30 33 64 7b 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 50 64 28 29 3b 61 5c 75 30 30 33 64 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 51 64 28 61 2c 53 64 29 7d 3b 5f 2e 77 64 5c 75 Data Ascii: +\"\"}};_.Rd\u003dfunction(a){return a instanceof _.Qd\u0026\u0026a.constructor\u003d\u003d\u003d_.Qd?a.i:\"type_error:TrustedResourceUrl\"};Sd\u003d{};_.Td\u003dfunction(a){const b\u003d_.Pd();a\u003db?b.createScriptURL(a):a;return new _.Qd(a,Sd)};_.wd\u
2024-05-01 13:47:02 UTC	1255	IN	Data Raw: 6f 66 20 5f 2e 62 65 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5f 2e 62 65 3f 61 2e 69 3a 5c 22 74 79 70 65 5f 65 72 72 6f 72 3a 53 61 66 65 48 74 6d 6c 5c 22 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 50 64 28 29 3b 61 5c 75 30 30 33 64 62 3f 62 2e 63 72 65 61 74 65 48 54 4d 4c 28 61 29 3a 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 62 65 28 61 2c 61 65 29 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2e 74 6f 53 74 72 69 6e 67 28 Data Ascii: of _.be\u0026\u0026a.constructor\u003d\u003d\u003d_.be?a.i:\"type_error:SafeHtml\"};_.de\u003dfunction(a){const b\u003d_.Pd();a\u003db?b.createHTML(a):a;return new _.be(a,ae)};_.be\u003dclass{constructor(a){this.i\u003da}toString(){return this.i.toString(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	64.233.180.99	443	7588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:02 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 13:47:02 UTC	1434	IN	HTTP/1.1 200 OK Version: 628208705 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Wed, 01 May 2024 13:47:02 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 13:47:02 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-05-01 13:47:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	23.209.58.93	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:08 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-01 13:47:08 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=148640 Date: Wed, 01 May 2024 13:47:08 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	23.209.58.93	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:09 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-01 13:47:09 UTC	774	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=148562 Date: Wed, 01 May 2024 13:47:09 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-01 13:47:09 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49752	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zC4Eb3mDpgwO3dy&MD=LPFEY77X HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-01 13:47:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6dd340ee-3e0b-4357-a233-356ac3f9c8e3 MS-RequestId: 9ab0134c-d7b2-4749-801f-ca42844bf0dd MS-CV: s3eIeg9jikeekaRb.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 May 2024 13:47:14 GMT Connection: close Content-Length: 24490
2024-05-01 13:47:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-01 13:47:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49758	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 13:47:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zC4Eb3mDpgwO3dy&MD=LPFEY77X HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-01 13:47:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: f8ee8e6e-8525-4385-8768-91c72c2a2fd4 MS-RequestId: ccf01076-7023-4e90-ad3f-11d81d6dd069 MS-CV: LeV/zaV9m0mMvAPN.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 May 2024 13:47:55 GMT Connection: close Content-Length: 25457
2024-05-01 13:47:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-01 13:47:56 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	15:46:55
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\BCb8yQ0fg8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BCb8yQ0fg8.exe"
Imagebase:	0x6d0000
File size:	944'280 bytes
MD5 hash:	807675A50EE7545E02DAEAC9822842B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:46:55
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000002.1896600750.00000000038E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:46:55
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:47:00
Start date:	01/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://473750571567004317064230583514468350804565684324378075159610742091604698238217701484029465762430135913242023857750034401559054060945654540273638867228794983640833862748912121851334807031249099092790952130035074227943842970399582505875/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:47:00
Start date:	01/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1800,i,5224496107934403145,5816890975472559302,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:47:17
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x180000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000007.00000002.1896414307.0000000000791000.00000080.00000001.01000000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1308
Total number of Limit Nodes:	18

Executed Functions

Function 006DAB99 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(006D336F,00005000,00000040,?,?,?,?,00000007,?,?,?,?), ref: 006DACAE
VirtualProtect.KERNELBASE(006D336F,00005000,?,?,?,?,?,00000007,?,?,?,?), ref: 006DACF8

Strings

o3m, xrefs: 006DAC94

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ProtectVirtual
String ID: o3m
API String ID: 544645111-2074226138
Opcode ID: 1e830b8f7c64ceb3b0189d83f49a0e5242289fec9246af1008cf21fc4b845581
Instruction ID: 5527cf62a30a9332c4b25583477fbcb7bd34b3b15024f81b839e47e4e4298c2f
Opcode Fuzzy Hash: 1e830b8f7c64ceb3b0189d83f49a0e5242289fec9246af1008cf21fc4b845581
Instruction Fuzzy Hash: F9418971A043419FCB14DFA8EC90B76B3E7FB49310F48956AE4458B361D735E850CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 006D4A13 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D49B3: GlobalAlloc.KERNELBASE(?,00000000,?), ref: 006D49E3

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 006D4A77

Strings

JVm, xrefs: 006D4B2C, 006D4B3F, 006D4B52, 006D4B2F
JVm, xrefs: 006D4AC9, 006D4B1C, 006D4B20, 006D4B30, 006D4B09, 006D4ACC, 006D4B1F, 006D4B23, 006D4B33

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID: JVm$JVm
API String ID: 3737350999-1272805911
Opcode ID: 7ca443ba4ff18fd1a0dd82d3c5802fab018ac8a71c66cc2ce2756389a81c11f4
Instruction ID: 108fbb4f8cf57644172ff34c5020e454534c43798a0378fb180e4fb54a6a665a
Opcode Fuzzy Hash: 7ca443ba4ff18fd1a0dd82d3c5802fab018ac8a71c66cc2ce2756389a81c11f4
Instruction Fuzzy Hash: 7351EA75D04209EBCB44CF98C890BEEB7B6FF58300F14855AE915AB344DB75AE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006D42F3 Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000), ref: 006D4315

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction ID: da998bd71e1f90bc34c57fa0e21a8ed7cdf330532e4c5294aa954fe8f29246d4
Opcode Fuzzy Hash: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction Fuzzy Hash: 7B31B175A00108FFCB14DF99C891F9EB7B5EF48310F208199E919AB391DA71AE41DB54

Uniqueness

Uniqueness Score: -1.00%

Function 006D5CA0 Relevance: 3.1, APIs: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D49B3: GlobalAlloc.KERNELBASE(?,00000000,?), ref: 006D49E3

VirtualProtect.KERNELBASE(?,00000000,?,00000000), ref: 006D5D08
VirtualProtect.KERNELBASE(?,00000000,00000000,00000000), ref: 006D5D3B

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ProtectVirtual$AllocGlobal
String ID:
API String ID: 3893020805-0
Opcode ID: 9f469a8fc07bab29a0d25244140180354860aa8e4d3ec3e01d86e5f0fa3499b1
Instruction ID: bff81771313aefb145e4ca1ed321ecbe73417ec42fd7b1f7db4ecbfaf1f57f08
Opcode Fuzzy Hash: 9f469a8fc07bab29a0d25244140180354860aa8e4d3ec3e01d86e5f0fa3499b1
Instruction Fuzzy Hash: 6D3175B5D01118AFDB64DBA8D981FDEB7BAAF8C300F108599E51DA3305E631AE45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 006D49B3 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(?,00000000,?), ref: 006D49E3

Strings

`Tm, xrefs: 006D49B7

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: AllocGlobal
String ID: `Tm
API String ID: 3761449716-1514313607
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: 62e278ab91fa34bf7da32c5c3100477a39def7f25a532ea974948ee0e4601564
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: 0CF0A578A04208EFCB44DF58D480999B7B5FB4C320F10C299FC188B345C630EE81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006D3F23 Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D49B3: GlobalAlloc.KERNELBASE(?,00000000,?), ref: 006D49E3

LoadLibraryW.KERNELBASE(?), ref: 006D3F54

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction ID: daef65feb8b98604609bbf20b2ae562af5bf3073d2da9483e4ee589b7e1e6152
Opcode Fuzzy Hash: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction Fuzzy Hash: 4CE0E575E00108BBCB40DFA8DD9195D7BB9AF48201F108199F90897345E531AE518791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006DE8C0 Relevance: 51.4, APIs: 6, Strings: 23, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006DB980: GetModuleFileNameW.KERNEL32(00000000,E1E504E9,?,00000082,00000000,E1E504E9,?), ref: 006DBA1C
Part of subcall function 006DB980: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000), ref: 006DBAAA

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 006DF307

Part of subcall function 006DCB60: GetFileAttributesExW.KERNEL32(?,00000000,?,E1E504E9), ref: 006DCBD2

Part of subcall function 006DE500: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,CheckIP.dll,CheckIP.dll,00000000,00000000,E1E504E9,?,?,?,?,?,?,?,?,00000000), ref: 006DE575
Part of subcall function 006DE500: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,CheckIP.dll,CheckIP.dll,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 006DE5C6

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(E1E504E9,?), ref: 006DEA8C

Strings

https://go.microsoft.com/fwlink/?linkid=798306, xrefs: 006DECF5
Probed for and did not resolve library symbol %S, xrefs: 006DED4E, 006DEED8, 006DEF44
%s, xrefs: 006DECFA
The required library %s does not support relative app dll paths., xrefs: 006DEEF6
The required library %s does not support single-file apps., xrefs: 006DED64
Bundle Header Offset: [%lld], xrefs: 006DEE52
The library %s was found, but loading it from %s failed, xrefs: 006DECDB
hostfxr.dll, xrefs: 006DECD6
hostfxr_main_startupinfo, xrefs: 006DEEB4, 006DEED3
A fatal error was encountered. This executable was not bound to load a managed DLL., xrefs: 006DE9B9
- Installing .NET prerequisites might help resolve this problem., xrefs: 006DECE8
Invoking fx resolver [%s] hostfxr_main_startupinfo, xrefs: 006DEFDE
Invoking fx resolver [%s] hostfxr_main_bundle_startupinfo, xrefs: 006DEDFE
The application to execute does not exist: '%s'., xrefs: 006DEBC5
Host path: [%s], xrefs: 006DEE14, 006DEFF4
hostfxr_main, xrefs: 006DEF28, 006DEF3F
App path: [%s], xrefs: 006DEE46, 006DF026
Dotnet path: [%s], xrefs: 006DEE30, 006DF010
Invoking fx resolver [%s] v1, xrefs: 006DEF16
Detected Single-File app bundle, xrefs: 006DEB48
The required library %s does not contain the expected entry point., xrefs: 006DEF5A
Failed to resolve full path of the current executable [%s], xrefs: 006DF2C9
hostfxr_main_bundle_startupinfo, xrefs: 006DED2E, 006DED49

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharFileMultiWide$AttributesModuleName
String ID: %s$ - Installing .NET prerequisites might help resolve this problem.$A fatal error was encountered. This executable was not bound to load a managed DLL.$App path: [%s]$Bundle Header Offset: [%lld]$Detected Single-File app bundle$Dotnet path: [%s]$Failed to resolve full path of the current executable [%s]$Host path: [%s]$Invoking fx resolver [%s] hostfxr_main_bundle_startupinfo$Invoking fx resolver [%s] hostfxr_main_startupinfo$Invoking fx resolver [%s] v1$Probed for and did not resolve library symbol %S$The application to execute does not exist: '%s'.$The library %s was found, but loading it from %s failed$The required library %s does not contain the expected entry point.$The required library %s does not support relative app dll paths.$The required library %s does not support single-file apps.$hostfxr.dll$hostfxr_main$hostfxr_main_bundle_startupinfo$hostfxr_main_startupinfo$https://go.microsoft.com/fwlink/?linkid=798306
API String ID: 2393550857-2715600819
Opcode ID: 4610ff1ebb9bf8cd355a9d6d612c4749700d0b16983983d7144691d7f71d186b
Instruction ID: 5e50f02fe9ad1228569e97a8ecaf3ee07e46855efd9a2a83f6ff2226f4762a3c
Opcode Fuzzy Hash: 4610ff1ebb9bf8cd355a9d6d612c4749700d0b16983983d7144691d7f71d186b
Instruction Fuzzy Hash: 67528B31D00259CBDF10DFA4CC95BEDB7B2BF54304F2081AAE459AB291EB70AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 006D28B0 Relevance: 39.2, APIs: 5, Strings: 17, Instructions: 705windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006DCA70: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 006DCA94
Part of subcall function 006DCA70: GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAA0
Part of subcall function 006DCA70: GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAAD

_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,E1E504E9), ref: 006D294C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,Bundle header version compatibility check failed.,00000031), ref: 006D2A76
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006D2B61
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,E1E504E9), ref: 006D2F81
MessageBoxW.USER32(00000000,?,?,00000014), ref: 006D3349

Strings

Framework: ', xrefs: 006D2C90
framework resolution:, xrefs: 006D3299, 006D32BF, 006D32C0
7.0.2, xrefs: 006D31E7
Bundle header version compatibility check failed., xrefs: 006D3010
Learn about , xrefs: 006D3283
_ , xrefs: 006D2CF0
&gui=true, xrefs: 006D32E0
was not found., xrefs: 006D2CDA
The framework ', xrefs: 006D2CC4
open, xrefs: 006D336F
https://aka.ms/dotnet/app-launch-failedWould you like to download it now?, xrefs: 006D32CE
DOTNET_DISABLE_GUI_ERRORS, xrefs: 006D2929
runtime installation:, xrefs: 006D329E
Showing error dialog for application: '%s' - error code: 0x%x - url: '%s' - dialog message: %s, xrefs: 006D3322
&apphost_version=, xrefs: 006D31D5
T[m, xrefs: 006D33A0
You must install or update .NET to run this application., xrefs: 006D2B75

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLast$EnvironmentMessageVariable_wtoi
String ID: https://aka.ms/dotnet/app-launch-failedWould you like to download it now?$ _ $ was not found.$&apphost_version=$&gui=true$7.0.2$Bundle header version compatibility check failed.$DOTNET_DISABLE_GUI_ERRORS$Framework: '$Learn about $Showing error dialog for application: '%s' - error code: 0x%x - url: '%s' - dialog message: %s$T[m$The framework '$You must install or update .NET to run this application.$framework resolution:$open$runtime installation:
API String ID: 4017193638-783867641
Opcode ID: 0bca69f4156bb5dba0005f7c1e7eebed32c1998f6c6dd672899c3d755a60310b
Instruction ID: db08ab530b67fee6387102bae52aadd1b2662d42e3ea97c350d6bea30b5f7bda
Opcode Fuzzy Hash: 0bca69f4156bb5dba0005f7c1e7eebed32c1998f6c6dd672899c3d755a60310b
Instruction Fuzzy Hash: 6C627D30D10269CBEB24CB24CD95BEDB7B2AF55304F1082DAE549A7392EB746AC4CF51

Uniqueness

Uniqueness Score: -1.00%

Function 006DBDF0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 006DCA70: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 006DCA94
Part of subcall function 006DCA70: GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAA0
Part of subcall function 006DCA70: GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAAD

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000000,\Setup\InstalledVersions\,00000019,SOFTWARE\dotnet,0000000F,E1E504E9,?,?), ref: 006DC361
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000000,\Setup\InstalledVersions\,00000019,SOFTWARE\dotnet,0000000F,E1E504E9,?,?), ref: 006DC3DC

Strings

\Setup\InstalledVersions\, xrefs: 006DC1C4
_DOTNET_TEST_GLOBALLY_REGISTERED_PATH, xrefs: 006DC699
_DOTNET_TEST_REGISTRY_PATH, xrefs: 006DBEB1
SOFTWARE\dotnet, xrefs: 006DBE59
HKEY_CURRENT_USER\, xrefs: 006DBECF

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$EnvironmentVariable
String ID: HKEY_CURRENT_USER\$SOFTWARE\dotnet$\Setup\InstalledVersions\$_DOTNET_TEST_GLOBALLY_REGISTERED_PATH$_DOTNET_TEST_REGISTRY_PATH
API String ID: 1857851154-750039677
Opcode ID: f5169cecfd98d1220f3505edb8ca8c51ac140366357b05b387b1f4bf2aef109c
Instruction ID: bce15b832a53405b2babf070f7d78fb5930fae7b0c703dafe8deaff92da2184c
Opcode Fuzzy Hash: f5169cecfd98d1220f3505edb8ca8c51ac140366357b05b387b1f4bf2aef109c
Instruction Fuzzy Hash: 5302BD31D10259CFDB14CF68DC85BEDB7B2AF85314F20829EE415A7391DB70AA85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 006DD060 Relevance: 6.3, APIs: 4, Instructions: 334fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,E1E504E9,?,00000007), ref: 006DD1E0
FindNextFileW.KERNEL32(00000000,00000010,?,?,?,E1E504E9,?,00000007), ref: 006DD421
FindClose.KERNEL32(?,?,?,?,E1E504E9,?,00000007), ref: 006DD43C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,E1E504E9,?,00000007), ref: 006DD4B8

Part of subcall function 006D1490: ___std_exception_copy.LIBVCRUNTIME ref: 006D14BE

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: Find$File$CloseFirstNext___std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1375165025-0
Opcode ID: d085aa438e1202c418b6ee330705d4cf0bf33354306995109ffa87aa1a1df18d
Instruction ID: 7a9dfa99f22ca3eeb78339788b61c1a6a1734834f30d3019a74861b86538df71
Opcode Fuzzy Hash: d085aa438e1202c418b6ee330705d4cf0bf33354306995109ffa87aa1a1df18d
Instruction Fuzzy Hash: C4D1C531D012088BDB24EF64CC99BEEB7B6EF45314F20429AE415A7390DB70AE85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 006E0937 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006E0943
IsDebuggerPresent.KERNEL32 ref: 006E0A0F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006E0A2F
UnhandledExceptionFilter.KERNEL32(?), ref: 006E0A39

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 854922b3e6eb3201f4fb4922b6b5390a20188f239d572c7a293b4909dfcea964
Instruction ID: 070f65ed18d6cafa0b399128610d507e5ca4c57b17a7fb585c7965600056c38f
Opcode Fuzzy Hash: 854922b3e6eb3201f4fb4922b6b5390a20188f239d572c7a293b4909dfcea964
Instruction Fuzzy Hash: A4313A75D0635CDBDB50DFA5D9897CDBBB9BF08304F1040AAE40DAB250EB715A848F45

Uniqueness

Uniqueness Score: -1.00%

Function 006DD4F0 Relevance: 1.8, APIs: 1, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,00000008,00000000), ref: 006DD63B

Part of subcall function 006D1490: ___std_exception_copy.LIBVCRUNTIME ref: 006D14BE

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ___std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3819911158-0
Opcode ID: 3586dc243d89d5544dd812c4367fe4cc31c072efaac0240c87d490fb1051b022
Instruction ID: 18666085148a8d6b5ad864e8e428644205415ac0b35f0a25b8c183635762495c
Opcode Fuzzy Hash: 3586dc243d89d5544dd812c4367fe4cc31c072efaac0240c87d490fb1051b022
Instruction Fuzzy Hash: FF91D371F012189BCB28DF6CD8805AEB7E6FF88314B24466FE91ADB741E671D9148790

Uniqueness

Uniqueness Score: -1.00%

Function 006E0620 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006E0636

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 50f266ab47bb525db0d707dd433e556f9a5b221fb29b5be843dba7bed0531f41
Instruction ID: 615f4e1ad4c6f9237196df6a719b3c87ecc77dc29ca1ef2a92e811e92499b9a8
Opcode Fuzzy Hash: 50f266ab47bb525db0d707dd433e556f9a5b221fb29b5be843dba7bed0531f41
Instruction Fuzzy Hash: 2C514B719023858BEB24CF5AD8C57AAB7F2FB88314F24902AD405EB351D7B4AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 006D8AC0 Relevance: 1.6, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

9{M=, xrefs: 006D8BCF

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID:
String ID: 9{M=
API String ID: 0-3917255391
Opcode ID: f2333ff33bb0851a9b5b409057b533b25faad3ce4935ca472aeafe83e83af7c0
Instruction ID: ab1178dd79bed8f37b53bb81b358b0229c0fe5efea6b66b60458ee65ad158748
Opcode Fuzzy Hash: f2333ff33bb0851a9b5b409057b533b25faad3ce4935ca472aeafe83e83af7c0
Instruction Fuzzy Hash: D2B1BB32C066959FD7168B3888997E2BBE3EF573603A4059BD4D14B796CB604883CBC9

Uniqueness

Uniqueness Score: -1.00%

Function 006E0A99 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010AB0,006E03F5), ref: 006E0A9E

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bee9b58566e8d5172568eed064e42c9214a0be08643b35aa78e011309c9c5245
Instruction ID: 4cf70d97828d2fe1d429462be6893ac8c4b0295e34558ea091ba41d707034726
Opcode Fuzzy Hash: bee9b58566e8d5172568eed064e42c9214a0be08643b35aa78e011309c9c5245
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 006D85D0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ede80693f8d441d9074d83d885c3b89783c40a96f5e451abede4d619b14707b
Instruction ID: f5f02a59596d414520bcdd898e898f28c06416d56befa0d9472c6ed8fb06e998
Opcode Fuzzy Hash: 7ede80693f8d441d9074d83d885c3b89783c40a96f5e451abede4d619b14707b
Instruction Fuzzy Hash: AE91CE329042919FDB168F388C996E6FBA2FF8B3603A4459EC0D18FB56D7205853C788

Uniqueness

Uniqueness Score: -1.00%

Function 006DAB19 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99a479058c070eb2fc54f99013099ebdda857195a2ba3993201935e4c99ddf9
Instruction ID: 029bee33414c73069cdcfb46e4e72cb9f1555cc621b6e627f7abdfc772d88e6d
Opcode Fuzzy Hash: c99a479058c070eb2fc54f99013099ebdda857195a2ba3993201935e4c99ddf9
Instruction Fuzzy Hash: F201A7366052698BCB20CF85D890AB6B3F3FF94752B48406BF9858B340DB34DC42D791

Uniqueness

Uniqueness Score: -1.00%

Function 006D50E3 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Uniqueness

Uniqueness Score: -1.00%

Function 006DC740 Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 316registryCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?), ref: 006DC81D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020219,?,?,?,E1E504E9,?,?), ref: 006DC84E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006DCA35

Strings

The registry key ['%s'] does not exist., xrefs: 006DC864, 006DC86E
Looking for architecture-specific registry value in '%s'., xrefs: 006DC7E4
Failed to get the value of the install location registry value. Error code: 0x%X, xrefs: 006DC958
Found registered install location '%s'., xrefs: 006DC9AE
Failed to open the registry key. Error code: 0x%X, xrefs: 006DC87C, 006DC882
Failed to read environment variable [%s], HRESULT: 0x%X, xrefs: 006DCAC1
Failed to get the size of the install location registry value or it's empty. Error code: 0x%X, xrefs: 006DC9EF

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Open
String ID: Failed to get the size of the install location registry value or it's empty. Error code: 0x%X$Failed to get the value of the install location registry value. Error code: 0x%X$Failed to open the registry key. Error code: 0x%X$Failed to read environment variable [%s], HRESULT: 0x%X$Found registered install location '%s'.$Looking for architecture-specific registry value in '%s'.$The registry key ['%s'] does not exist.
API String ID: 1987152144-1831965068
Opcode ID: 2134b28c4e1a9c0edaa36f8b051153230cbdf7b657170fabefe05d0780ae0098
Instruction ID: b78045af9199732b472534eb816556ba584b3a110aaff02ee78bc3ebaca97cfc
Opcode Fuzzy Hash: 2134b28c4e1a9c0edaa36f8b051153230cbdf7b657170fabefe05d0780ae0098
Instruction Fuzzy Hash: ACB1E271D012499BDB10DFA8DC85BAEB7BBEF44314F14422AF801EB391E7709945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006DDEB0 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 006DC630: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(E1E504E9), ref: 006DC702

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000000,?,00000000,?), ref: 006DE2AA

Part of subcall function 006DBCB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006DBDBB

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?), ref: 006DE3D7

Strings

Resolved fxr [%s]..., xrefs: 006DDFCC
A fatal error occurred, the default install location cannot be obtained., xrefs: 006DE080
fxr, xrefs: 006DE0EC
7.0.2, xrefs: 006DE250, 006DE25A
Using environment variable %s=[%s] as runtime location., xrefs: 006DE059
host, xrefs: 006DE0D8
hostfxr.dll, xrefs: 006DDF1B, 006DE1F4
You must install .NET to run this application.App: %sArchitecture: %sApp host version: %s.NET location: Not foundLearn abou, xrefs: 006DE266
Using global installation location [%s] as runtime location., xrefs: 006DE0A5
The required library %s could not be found. Searched with root path [%s], environment variable [%s], default install location [%s], xrefs: 006DE1F9

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 7.0.2$A fatal error occurred, the default install location cannot be obtained.$Resolved fxr [%s]...$The required library %s could not be found. Searched with root path [%s], environment variable [%s], default install location [%s]$Using environment variable %s=[%s] as runtime location.$Using global installation location [%s] as runtime location.$You must install .NET to run this application.App: %sArchitecture: %sApp host version: %s.NET location: Not foundLearn abou$fxr$host$hostfxr.dll
API String ID: 3668304517-3859945431
Opcode ID: 3965c3ed2649fdb805fee515d4045abae700ec0a9923a2f4a61c32e2de2145bf
Instruction ID: 7b1dbf8231e4b7942eb6dbfc906b0a3769bb13af97d01cc20a78b2e1152f8847
Opcode Fuzzy Hash: 3965c3ed2649fdb805fee515d4045abae700ec0a9923a2f4a61c32e2de2145bf
Instruction Fuzzy Hash: 8AF1A130D10248CBDF14DFA4DC95BEDB7B2AF55304F10829EE405AB391EB716A85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 006DE500 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 339COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,CheckIP.dll,CheckIP.dll,00000000,00000000,E1E504E9,?,?,?,?,?,?,?,?,00000000), ref: 006DE575
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,CheckIP.dll,CheckIP.dll,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 006DE5C6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(CheckIP.dll), ref: 006DE79A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,E1E504E9), ref: 006DE892

Strings

The managed DLL bound to this executable could not be retrieved from the executable image., xrefs: 006DE7AF
7.0.2, xrefs: 006DE846, 006DE84D
The managed DLL bound to this executable is: '%s', xrefs: 006DE761
CheckIP.dll, xrefs: 006DE540, 006DE566, 006DE567, 006DE5B9, 006DE5BA, 006DE5D4, 006DE5FA, 006DE5FB
c3ab8ff13720e8ad9047dd39466b3c89, xrefs: 006DE63C
You must install or update .NET to run this application.App: %sArchitecture: %sApp host version: %s.NET location: %sLearn a, xrefs: 006DE859
This executable is not bound to a managed DLL to execute. The binding value is: '%s', xrefs: 006DE748
74e592c2fa383d4a3960714caef0c4f2, xrefs: 006DE6DA

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ByteCharMultiWide_invalid_parameter_noinfo_noreturn
String ID: 7.0.2$74e592c2fa383d4a3960714caef0c4f2$CheckIP.dll$The managed DLL bound to this executable could not be retrieved from the executable image.$The managed DLL bound to this executable is: '%s'$This executable is not bound to a managed DLL to execute. The binding value is: '%s'$You must install or update .NET to run this application.App: %sArchitecture: %sApp host version: %s.NET location: %sLearn a$c3ab8ff13720e8ad9047dd39466b3c89
API String ID: 3834199983-11481455
Opcode ID: bb54fafb7390bf241275d0ec938c70557a84aee9ace404d1d530fcf96de859aa
Instruction ID: b1731959ad9b25fddee6b8d5fda2dea763173252ca5fb79502384653b341aa22
Opcode Fuzzy Hash: bb54fafb7390bf241275d0ec938c70557a84aee9ace404d1d530fcf96de859aa
Instruction Fuzzy Hash: A4B10531E002809FDB28AF28CC94BBEBBB3AB45314F14466EE4569F391D732A945C761

Uniqueness

Uniqueness Score: -1.00%

Function 006DF340 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006EDE44), ref: 006DF3D1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 006DF3DD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 006DF3E8
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 006DF3F2
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 006DF3FD
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 006DF407
LeaveCriticalSection.KERNEL32(006EDE44), ref: 006DF415

Strings

Redirecting errors to custom writer., xrefs: 006DF3A2
7.0.2, xrefs: 006DF363
apphost, xrefs: 006DF368
d037e070ebe5c83838443f869d5800752b0fcb13, xrefs: 006DF35E
--- Invoked %s [version: %s, commit hash: %s] main = {, xrefs: 006DF36D

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: fflush$CriticalSection__acrt_iob_func$EnterLeave
String ID: --- Invoked %s [version: %s, commit hash: %s] main = {$7.0.2$Redirecting errors to custom writer.$apphost$d037e070ebe5c83838443f869d5800752b0fcb13
API String ID: 2658921962-160682431
Opcode ID: 3f82da0c49cfa1e42a59e43b0dd48bd25a0d151277d328841aed5cca77f68dad
Instruction ID: c0abf8a354c5680915675d6cecf42c0036b6c784524861e7756de9f239489648
Opcode Fuzzy Hash: 3f82da0c49cfa1e42a59e43b0dd48bd25a0d151277d328841aed5cca77f68dad
Instruction Fuzzy Hash: 7A11ECB1E407806FD7007769AC4FA4976579F4071DF060135F90B9E3D2DAB25A1485EB

Uniqueness

Uniqueness Score: -1.00%

Function 006E2008 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006E2127
___TypeMatch.LIBVCRUNTIME ref: 006E2235
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006E2346
_UnwindNestedFrames.LIBCMT ref: 006E2387
CallUnexpected.LIBVCRUNTIME ref: 006E23A2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 006E23A7

Strings

csm, xrefs: 006E215E
Dcn, xrefs: 006E211E
csm, xrefs: 006E20B2
csm, xrefs: 006E2045

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindabortterminatetype_info::operator==
String ID: Dcn$csm$csm$csm
API String ID: 3594080642-2300697852
Opcode ID: 971394e4ece48eb3983de69def35603f7507e8b5cbcb1dd1768320803b6bfc56
Instruction ID: 7dda1ba0419d4937fa8c47ec1dbfbbc2ce0a7cb024161162bd4e4c5a1029ebdd
Opcode Fuzzy Hash: 971394e4ece48eb3983de69def35603f7507e8b5cbcb1dd1768320803b6bfc56
Instruction Fuzzy Hash: A2B19A7180238ADFCF25DFA6C8919EEB7BBBF04310B14415AE9106B212D335EA51CF95

Uniqueness

Uniqueness Score: -1.00%

Function 006D2340 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(00000000,.NET Runtime), ref: 006D238A
ReportEventW.ADVAPI32(?,00000001,00000000,000003FF,00000000,00000001,00000000,00000028,00000000), ref: 006D249E
DeregisterEventSource.ADVAPI32(?), ref: 006D24A5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,Application: ,0000000D,Description: A .NET application failed.,00000028), ref: 006D24D7

Strings

Description: A .NET application failed., xrefs: 006D23B0
Application: , xrefs: 006D23C2
.NET Runtime, xrefs: 006D2383
Message: , xrefs: 006D243B
Path: , xrefs: 006D23FC

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: Event$Source$DeregisterRegisterReport_invalid_parameter_noinfo_noreturn
String ID: .NET Runtime$Application: $Description: A .NET application failed.$Message: $Path:
API String ID: 3261796893-2224758532
Opcode ID: 747e75385a1135e426d0dae6049d5a53081e8ba4bd211f90450140f204d50554
Instruction ID: 4277f2440e687594ebe077954808a506a2c637d998e540dd3a7834f206dc319d
Opcode Fuzzy Hash: 747e75385a1135e426d0dae6049d5a53081e8ba4bd211f90450140f204d50554
Instruction Fuzzy Hash: F3518231E54344ABDB14DB65EC96BAEB7B7EB54700F10411AF911AB3C0DB70A9448B94

Uniqueness

Uniqueness Score: -1.00%

Function 006DBAE0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 146libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00001100,?,E1E504E9,?), ref: 006DBB5C
GetLastError.KERNEL32 ref: 006DBB68
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006DBC7D

Part of subcall function 006DCB60: GetFileAttributesExW.KERNEL32(?,00000000,?,E1E504E9), ref: 006DCBD2

GetModuleHandleExW.KERNEL32(00000001,?,?), ref: 006DBB93
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006DBC3D

Strings

Failed to pin library [%s] in [%s], xrefs: 006DBB9D
Failed to load the dll from [%s], HRESULT: 0x%X, xrefs: 006DBB7A, 006DBBB4
pal::load_library, xrefs: 006DBBA2, 006DBBAE
Loaded library from %s, xrefs: 006DBC04

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AttributesErrorFileHandleLastLibraryLoadModule
String ID: Failed to load the dll from [%s], HRESULT: 0x%X$Failed to pin library [%s] in [%s]$Loaded library from %s$pal::load_library
API String ID: 1159982014-4234151505
Opcode ID: 41ab241a5728cff44bc3f7419cf7953365d4656633d6fb321e3d95045b995126
Instruction ID: e061f21dfe9ee1bd923652dae12f588b042c24927010b3f7de62386cc1ffafe9
Opcode Fuzzy Hash: 41ab241a5728cff44bc3f7419cf7953365d4656633d6fb321e3d95045b995126
Instruction Fuzzy Hash: 0351B131D10248CFDB14DFA8DC95BEDB7B6EB58304F10822AE411A7395EB74AA45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 006DD920 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

APIs

Part of subcall function 006DD060: FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,E1E504E9,?,00000007), ref: 006DD1E0

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,hostfxr.dll,0000000B,?,?,?,00000001,?,00000007), ref: 006DDE7A

Strings

Resolved fxr [%s]..., xrefs: 006DDDB6
A fatal error occurred, the folder [%s] does not contain any version-numbered child folders, xrefs: 006DDC3E
Reading fx resolver directory=[%s], xrefs: 006DD97A
Considering fxr version=[%s]..., xrefs: 006DDA4D
hostfxr.dll, xrefs: 006DDD3F, 006DDDD8
A fatal error occurred, the required library %s could not be found in [%s], xrefs: 006DDDDD
Detected latest fxr version=[%s]..., xrefs: 006DDD18

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo_noreturn
String ID: A fatal error occurred, the folder [%s] does not contain any version-numbered child folders$A fatal error occurred, the required library %s could not be found in [%s]$Considering fxr version=[%s]...$Detected latest fxr version=[%s]...$Reading fx resolver directory=[%s]$Resolved fxr [%s]...$hostfxr.dll
API String ID: 3588950029-3818166005
Opcode ID: 0e2a540c7e12111fb55643cfd7011a9b6c7f88d1689969a368e6f1d4da12cd90
Instruction ID: 43494ab946bc837289ebc0f602f2ff682800f3fd0247b4c3259a4791c9353d85
Opcode Fuzzy Hash: 0e2a540c7e12111fb55643cfd7011a9b6c7f88d1689969a368e6f1d4da12cd90
Instruction Fuzzy Hash: 58F1B170D00248DBDF14DF64DC95BEDB776AF54304F14829EE409AB382DB34AA89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006DB4E0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?), ref: 006DB596
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000001), ref: 006DB5F9
Concurrency::cancel_current_task.LIBCPMT ref: 006DB6D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000), ref: 006DB6EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006DB6F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006DB6FC

Part of subcall function 006E006E: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,006DB545,00000018,E1E504E9,00000000,?), ref: 006E0083

Strings

true, xrefs: 006DB62C
false, xrefs: 006DB616

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: free$Concurrency::cancel_current_taskcalloclocaleconvmalloc
String ID: false$true
API String ID: 832963791-2658103896
Opcode ID: 57309d159fcf612c56b0a29dffa1992e16c9dd25e7c7f69620526a180a2f304c
Instruction ID: fb5ba43a49cda106d9c205614a0d26c3103260f1983c009ff34fcf065b2e1f15
Opcode Fuzzy Hash: 57309d159fcf612c56b0a29dffa1992e16c9dd25e7c7f69620526a180a2f304c
Instruction Fuzzy Hash: 246190B1D00348DBDB10DFA4DC45BDEB7B9FF04704F14426AE905AB251E7B1AA48CB95

Uniqueness

Uniqueness Score: -1.00%

Function 006DCB60 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 299COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,E1E504E9), ref: 006DCBD2
GetFullPathNameW.KERNEL32(?,00000104,?,00000000,E1E504E9), ref: 006DCBF9
GetFullPathNameW.KERNEL32(?,00000000,?,00000000,00000008,00000000), ref: 006DCCF9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,\\?\,?), ref: 006DCD6D
GetFileAttributesExW.KERNEL32(?,00000000,?,?,00000000,?,\\?\,?), ref: 006DCF70

Strings

\\?\, xrefs: 006DCD85, 006DCE3E
Error resolving full path [%s], xrefs: 006DCC16, 006DCD1A

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: AttributesFileFullNamePath$_invalid_parameter_noinfo_noreturn
String ID: Error resolving full path [%s]$\\?\
API String ID: 3575543699-155424227
Opcode ID: 8f32687cbeed029e13842b5709c863b1fe1fc9d75c37d5d216b7fa959c987703
Instruction ID: 60dd18f5f05f68eaee59c2e764ce43ad5133443ba83ce84dbdc5818c7fd9fbd8
Opcode Fuzzy Hash: 8f32687cbeed029e13842b5709c863b1fe1fc9d75c37d5d216b7fa959c987703
Instruction Fuzzy Hash: FAC17171E112199BCB64DF64DC99BE9B7B6AF48310F1002DAE40AAB350DB34AF85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 006DBCB0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 006DBD4E
IsWow64Process.KERNEL32(00000000), ref: 006DBD55
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006DBDBB

Part of subcall function 006DCA70: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 006DCA94
Part of subcall function 006DCA70: GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAA0
Part of subcall function 006DCA70: GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAAD

Strings

dotnet, xrefs: 006DBD7F
ProgramFiles(x86), xrefs: 006DBD63
ProgramFiles, xrefs: 006DBD6A
_DOTNET_TEST_DEFAULT_INSTALL_PATH, xrefs: 006DBD19

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ErrorLastProcess$CurrentEnvironmentVariableWow64_invalid_parameter_noinfo_noreturn
String ID: ProgramFiles$ProgramFiles(x86)$_DOTNET_TEST_DEFAULT_INSTALL_PATH$dotnet
API String ID: 4176612971-1903759158
Opcode ID: 7be9e215abeed68a81f28e858cbcb23eb0215a9bf3098225c39e8493bc2d69f2
Instruction ID: 8a3a61184508547ca457f39436292c0b748f6fb629b396808cfe0da315530ac7
Opcode Fuzzy Hash: 7be9e215abeed68a81f28e858cbcb23eb0215a9bf3098225c39e8493bc2d69f2
Instruction Fuzzy Hash: 8C31E771D04288DBCF14DFA8D8857EEBBB7EF48314F14911AE81167385DB349944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006DB250 Relevance: 12.2, APIs: 8, Instructions: 243COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006DB27D

Part of subcall function 006DF5F9: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,006D1B30,00000000,E1E504E9,?,?,?,006E333F,000000FF), ref: 006DF608

std::_Lockit::_Lockit.LIBCPMT ref: 006DB2A0
std::_Lockit::~_Lockit.LIBCPMT ref: 006DB2C0
std::_Facet_Register.LIBCPMT ref: 006DB331
std::_Lockit::~_Lockit.LIBCPMT ref: 006DB353
Concurrency::cancel_current_task.LIBCPMT ref: 006DB36C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00000000), ref: 006DB4A3

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register_invalid_parameter_noinfo_noreturn_lock_locales
String ID:
API String ID: 4082917780-0
Opcode ID: 7a7b820d5a64c1c224371f1e1d3f89304c6aae95a0565efb67fcf8e63de2fc06
Instruction ID: d3bdf3c071ccd742148af8957d1dec4d1d9747c59f6955f68229aaca7595d51f
Opcode Fuzzy Hash: 7a7b820d5a64c1c224371f1e1d3f89304c6aae95a0565efb67fcf8e63de2fc06
Instruction Fuzzy Hash: 7D81E472D00259DFCB15DF68D880AAEB7B6FF44310F1602AAE815AB356D770AE01CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 006D1BB0 Relevance: 12.1, APIs: 8, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 006D1BD6

Part of subcall function 006DFB1F: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,?,006D1BDB,?,E1E504E9,?,00000000,006E3360,000000FF,?,bad locale name,00000000,E1E504E9), ref: 006DFB30

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006D1BE6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006D1BFE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006D1C16
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006D1C2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 006D1C46
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000006), ref: 006D1C5E
std::_Lockit::~_Lockit.LIBCPMT ref: 006D1C70

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: free$std::_$Locinfo::_Locinfo_dtorLockitLockit::~_setlocale
String ID:
API String ID: 1033100201-0
Opcode ID: 397e7663c72c279f7b48f01c7e7845bbe145a94f8d3789d29d0ac7be62cf1add
Instruction ID: 8b641ae0ba0f684612495650c909c45dedd4d1e76dcb02c8261ab5e1eb943f39
Opcode Fuzzy Hash: 397e7663c72c279f7b48f01c7e7845bbe145a94f8d3789d29d0ac7be62cf1add
Instruction Fuzzy Hash: A7213EB0A04B409BD720CF29D949B5777E9EF05704F044929E84BCB740E779E518CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006E0330 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

_set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 006E0333
_set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 006E033E
__p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 006E034A
__RTC_Initialize.LIBCMT ref: 006E0362
_configure_wide_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,006E0C90), ref: 006E0377

Part of subcall function 006E0BF3: InitializeSListHead.KERNEL32(006EDD70,006E0387), ref: 006E0BF8

__setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(Function_00003EE0), ref: 006E0395
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 006E03B0
_initialize_wide_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006E03BF

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: Initialize$HeadList__p__commode__setusermatherr_configthreadlocale_configure_wide_argv_initialize_wide_environment_set_app_type_set_fmode
String ID:
API String ID: 1947472503-0
Opcode ID: a9a5ad65ddeee8aae7fe4688af5fe333151a4668a01698960743a87c5da99922
Instruction ID: 9bd362c1e7b305adbd79699e3b3f710be062f92ef312612bcad4aa633bfaa6e7
Opcode Fuzzy Hash: a9a5ad65ddeee8aae7fe4688af5fe333151a4668a01698960743a87c5da99922
Instruction Fuzzy Hash: D5014B649033E256F9E033F3190BA9E024B1E50B94F20085EB844BB387DEE68AC1407F

Uniqueness

Uniqueness Score: -1.00%

Function 006E1C9A Relevance: 12.1, APIs: 8, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006E1C91,006E122C,006E0AF4), ref: 006E1CA8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006E1CB6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006E1CCF
SetLastError.KERNEL32(00000000,006E1C91,006E122C,006E0AF4), ref: 006E1D21

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 760f3fb396c3866752b8ae666d07b2aaef79b9d2db263b3842e0fd87ce5a6c91
Instruction ID: b20ea0d63929a9fb0de90254627b8811a68d1a2cd36fcb8e0f62fe2f77132f35
Opcode Fuzzy Hash: 760f3fb396c3866752b8ae666d07b2aaef79b9d2db263b3842e0fd87ce5a6c91
Instruction Fuzzy Hash: 2D01B53220A3A65EE7642B767C85A5F279BEF53775730022DF1209E2E1EF254D03A184

Uniqueness

Uniqueness Score: -1.00%

Function 006E1AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006E1B07
___except_validate_context_record.LIBVCRUNTIME ref: 006E1B0F
_ValidateLocalCookies.LIBCMT ref: 006E1B98
__IsNonwritableInCurrentImage.LIBCMT ref: 006E1BC3
_ValidateLocalCookies.LIBCMT ref: 006E1C18

Strings

csm, xrefs: 006E1BAD

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 89dba60d0b7995b2ccac1687b93c7c8206874279ab5b31bf3741c96d6bc3f5d5
Instruction ID: 9a509c268ab4b0f99fead101252870c8f51d8d00823afd7bff324eea87cd9daa
Opcode Fuzzy Hash: 89dba60d0b7995b2ccac1687b93c7c8206874279ab5b31bf3741c96d6bc3f5d5
Instruction Fuzzy Hash: C741E730E023899BCF10DF6AC894AEE7BB7AF06354F148159E8155F392E771DA05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 006DCA70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 006DCA94
GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAA0
GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAAD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 006DCAF5
GetLastError.KERNEL32(?,00000000,00000000), ref: 006DCAFF

Strings

Failed to read environment variable [%s], HRESULT: 0x%X, xrefs: 006DCAC1, 006DCB13

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: Failed to read environment variable [%s], HRESULT: 0x%X
API String ID: 2691138088-3628523914
Opcode ID: 33d0b6ea0bd7ceaf3711cf3bcbfb6418d162554739032542bcb2b94bd5f5bfd7
Instruction ID: cefbe614be842fbdbffb362109e083f7d5772b24b47b38809cdf6f45133b1685
Opcode Fuzzy Hash: 33d0b6ea0bd7ceaf3711cf3bcbfb6418d162554739032542bcb2b94bd5f5bfd7
Instruction Fuzzy Hash: A4216B71B0030527E7242B79BC8BBB7739EDB85365B04017FF80ACB310EA559C0581B5

Uniqueness

Uniqueness Score: -1.00%

Function 006DE410 Relevance: 10.5, APIs: 7, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006EDE44), ref: 006DE41C
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 006DE428
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 006DE430
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 006DE437
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 006DE43F
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 006DE446
LeaveCriticalSection.KERNEL32(006EDE44), ref: 006DE454

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: fflush$CriticalSection__acrt_iob_func$EnterLeave
String ID:
API String ID: 2658921962-0
Opcode ID: 407677bc234fecae2d685f36e05be57adc246c5aade1eaa6259b4c416b0867d0
Instruction ID: 49021a823da732c4c3c3d861f10881449ca19692b4907ad913f995364a80d73f
Opcode Fuzzy Hash: 407677bc234fecae2d685f36e05be57adc246c5aade1eaa6259b4c416b0867d0
Instruction Fuzzy Hash: C001DB31200780DFC7106B68EC8DB8ABBAA9F5470AF044065F607CF361CBB29400CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006E2DF7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,006E2DA8,00000000,?,006EDDB0,?,?,?,006E2F4B,00000004,InitializeCriticalSectionEx,006E6E10,InitializeCriticalSectionEx), ref: 006E2E04
GetLastError.KERNEL32(?,006E2DA8,00000000,?,006EDDB0,?,?,?,006E2F4B,00000004,InitializeCriticalSectionEx,006E6E10,InitializeCriticalSectionEx,00000000,?,006E2B92), ref: 006E2E0E
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,api-ms-,00000007,?,006E2DA8,00000000,?,006EDDB0,?,?,?,006E2F4B,00000004,InitializeCriticalSectionEx,006E6E10,InitializeCriticalSectionEx), ref: 006E2E23
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 006E2E36

Strings

api-ms-, xrefs: 006E2E1B

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: LibraryLoad$ErrorLastwcsncmp
String ID: api-ms-
API String ID: 3100911417-2084034818
Opcode ID: e33e27061cc2b1667717f8d25a43fd6f460b16c8a6a3520b4bf43a6d72f905e9
Instruction ID: e9e87aaefaffe6f9a9e9591e59db17338c29278b079f7aac493b575ea208ea45
Opcode Fuzzy Hash: e33e27061cc2b1667717f8d25a43fd6f460b16c8a6a3520b4bf43a6d72f905e9
Instruction Fuzzy Hash: C4E04830680349B7EB201B62EC4AB593B5BBF20B45F544030F90DBC1F5D76199118594

Uniqueness

Uniqueness Score: -1.00%

Function 006E1DB1 Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006E1E78
___AdjustPointer.LIBCMT ref: 006E1E9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(006EB268,00000010,006E1F23,?,?,?,?,006EB288,00000008,006E1FA7,?,?,?,00000000), ref: 006E1EE9
___AdjustPointer.LIBCMT ref: 006E1F37

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: AdjustPointer$abort
String ID:
API String ID: 4118245873-0
Opcode ID: ff1de38e0d3479da2fc13ce4b0a57cb9ba213462054a6211774fcf54d7c5f286
Instruction ID: e35f5ded66099bb7c4c7bdcf4d2e096164a7528195c6d84f2dafe84168d46086
Opcode Fuzzy Hash: ff1de38e0d3479da2fc13ce4b0a57cb9ba213462054a6211774fcf54d7c5f286
Instruction Fuzzy Hash: 9151C072A023869FDB29CF56D841BBA77A6EF46300F14452DFD024F291E731AD81EB90

Uniqueness

Uniqueness Score: -1.00%

Function 006E23AD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 006E23D2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 006E24DD

Strings

MOC, xrefs: 006E23E4
RCC, xrefs: 006E23EC

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: EncodePointerabort
String ID: MOC$RCC
API String ID: 1188231555-2084237596
Opcode ID: ec9872b9b30d01845649c5f5f9da4712a7f785831bc0c515089e4704efcab03d
Instruction ID: 84fe97afc13c8d6fbb2120dc0c9f0246be551677f8022427d2722b77a0e18ffe
Opcode Fuzzy Hash: ec9872b9b30d01845649c5f5f9da4712a7f785831bc0c515089e4704efcab03d
Instruction Fuzzy Hash: E2416C3190124AEFDF15DF99CD81AEE7BBABF48300F148099F9046B291D33599A0DB60

Uniqueness

Uniqueness Score: -1.00%

Function 006D21B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006D223F

Part of subcall function 006E12EC: RaiseException.KERNEL32(E06D7363,00000001,00000003,006D140C,?,?,?,?,006D140C,?,006EB3A8), ref: 006E134C

Strings

ios_base::eofbit set, xrefs: 006D21F4
ios_base::badbit set, xrefs: 006D21E5
ios_base::failbit set, xrefs: 006D21EF

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: cc7e493324e09821c14f7fc7308253874d56d0093a7b6f14b2aa706d45aa8d52
Instruction ID: 5744c963fca04566fa733cd676e7d503b599ea385775857caf487d97f1086ee1
Opcode Fuzzy Hash: cc7e493324e09821c14f7fc7308253874d56d0093a7b6f14b2aa706d45aa8d52
Instruction Fuzzy Hash: 9F1106B1900345ABC310DF69CC02B96B7EAAF55310F14C62BFA55CB781E770AA55CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006E11D1 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006E1221

Strings

MOC, xrefs: 006E11E3
RCC, xrefs: 006E11DB
csm, xrefs: 006E11EB

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: c0772eb6ad4f1d782c23262ffcfadc9ac3f3b41d6ab54c09a00469886180550c
Instruction ID: b92667cb2e0f46c3c793a5947a33fa1d86480a1995455502c6e77417a9454764
Opcode Fuzzy Hash: c0772eb6ad4f1d782c23262ffcfadc9ac3f3b41d6ab54c09a00469886180550c
Instruction Fuzzy Hash: 63F0E235002384CFC3146F5AC4015C9B366FF46711B25015AD520CF222C3BCEA80EBCA

Uniqueness

Uniqueness Score: -1.00%

Function 006DFE0C Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,006DB5A8,?), ref: 006DFE22
___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,006DB5A8,?), ref: 006DFE29
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,006DB5A8,?), ref: 006DFE31
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000000,?,006DB5A8,?), ref: 006DFE48

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_func
String ID:
API String ID: 3203701943-0
Opcode ID: c69d3606f7c137579b5cce27356b03c5ddd67cd8b0da7d033abab4573a368a43
Instruction ID: 863a9e2402456579e41b498a926167a6f1ed8cb169b2e13631484abe060e2d6d
Opcode Fuzzy Hash: c69d3606f7c137579b5cce27356b03c5ddd67cd8b0da7d033abab4573a368a43
Instruction Fuzzy Hash: E1F0F4A2B027A626C7046B7B884991BFBD6DF48724701843EE40ACB703E635C94187D0

Uniqueness

Uniqueness Score: -1.00%

Function 006D22E0 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,006E7190,00000001,?,?), ref: 006D231B
fputws.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 006D2323
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 006D232B
fputwc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 006D2334

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: __acrt_iob_func$fputwcfputws
String ID:
API String ID: 4117002349-0
Opcode ID: 7dd70094157fa09c2d94938799b1c0bfbf31f63ff9fcaeb8745dc41f1fc4a2d6
Instruction ID: baccbaffd82af95f452967347e72004a70657db4bec61617fb81eee384de71b2
Opcode Fuzzy Hash: 7dd70094157fa09c2d94938799b1c0bfbf31f63ff9fcaeb8745dc41f1fc4a2d6
Instruction Fuzzy Hash: 9AF0E231600714BFD7403BA4AC1AFEA765EDF05704F044005FA0ACF392DAA0AA008795

Uniqueness

Uniqueness Score: -1.00%

Function 006DC420 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,-00000002,006E7E04,00000001,00000000,HKCU\,E1E504E9,HKCU\,?,?,E1E504E9,00000000,?), ref: 006DC5EC

Strings

HKLM\, xrefs: 006DC466
HKCU\, xrefs: 006DC47A, 006DC4BB, 006DC4BF

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: HKCU\$HKLM\
API String ID: 3668304517-2581276437
Opcode ID: 06faf4fbc2a882ed04b5288cb238af8d310906c0235e8eddc3ce0238d7df057e
Instruction ID: 4bbc06eb7241959543518c2661edca3a16af1e8c7f0b2459c3f7cb80304a7ee8
Opcode Fuzzy Hash: 06faf4fbc2a882ed04b5288cb238af8d310906c0235e8eddc3ce0238d7df057e
Instruction Fuzzy Hash: 8E51D270D103498BDB08CF68D955BAEB7B2FF88314F14825EE415A7391EB70AA81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006D2510 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,-00000004,?,?,00000029), ref: 006D26BF

Strings

- https://aka.ms/dotnet-core-applaunch?, xrefs: 006D25C8
https://aka.ms/dotnet-core-applaunch?, xrefs: 006D2523

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: - https://aka.ms/dotnet-core-applaunch?$https://aka.ms/dotnet-core-applaunch?
API String ID: 3668304517-187807833
Opcode ID: 6faa6cfd376c52b3afa1c4a0843f477c6366e9b3856b79dc9cebd06fad03b656
Instruction ID: 92be38b903c01f0f0d028827887fbbf1c39b8c51c253d2044889d387b02bf9b7
Opcode Fuzzy Hash: 6faa6cfd376c52b3afa1c4a0843f477c6366e9b3856b79dc9cebd06fad03b656
Instruction Fuzzy Hash: F251A431D047998BDB10DF64ED91BEDB372FF69314F00939AE94966221EB306BC48B50

Uniqueness

Uniqueness Score: -1.00%

Function 006DE7F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,E1E504E9), ref: 006DE892

Strings

7.0.2, xrefs: 006DE846, 006DE84D
You must install or update .NET to run this application.App: %sArchitecture: %sApp host version: %s.NET location: %sLearn a, xrefs: 006DE859

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 7.0.2$You must install or update .NET to run this application.App: %sArchitecture: %sApp host version: %s.NET location: %sLearn a
API String ID: 3668304517-2201498465
Opcode ID: d5cc6a57f9acff3631f62de73b4491ac881e423e2b724648299ccf7d063007ef
Instruction ID: f3f9fa50d31300d6b99d04c8a5496faf01e59412fafa94f75ac4257f1a431962
Opcode Fuzzy Hash: d5cc6a57f9acff3631f62de73b4491ac881e423e2b724648299ccf7d063007ef
Instruction Fuzzy Hash: E321D431D002449BCB28DF59DC89BAEBB77FB85710F44025EE4165B790DB706A40C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 006D1B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006D1B2B

Part of subcall function 006DF5F9: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,006D1B30,00000000,E1E504E9,?,?,?,006E333F,000000FF), ref: 006DF608

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006D1B7A

Part of subcall function 006DFAD4: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,?,006D1B7F,?,00000000,00000000,E1E504E9,?,?,?,006E333F,000000FF), ref: 006DFADB
Part of subcall function 006DFAD4: _Yarn.LIBCPMT ref: 006DFAF3
Part of subcall function 006DFAD4: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,00000000,?,?,006D1B7F,?,00000000,00000000,E1E504E9,?,?,?,006E333F,000000FF), ref: 006DFB03
Part of subcall function 006DFAD4: _Yarn.LIBCPMT ref: 006DFB17

Strings

bad locale name, xrefs: 006D1B96

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: Yarnsetlocalestd::_$Locinfo::_Locinfo_ctorLockitLockit::__lock_locales
String ID: bad locale name
API String ID: 2174947689-1405518554
Opcode ID: 45afabbc6ef6ca83b3c48d32f596855f449223f39bd37022d3d79e374b92de7c
Instruction ID: e9eb2fe9d4dfd29a692d33138dac61eb8d7753f7d7eb219079c211eb394a6e36
Opcode Fuzzy Hash: 45afabbc6ef6ca83b3c48d32f596855f449223f39bd37022d3d79e374b92de7c
Instruction Fuzzy Hash: 21119171904B849FD320CF69C805B47BBE4EF19714F004A5EE49AC7B40D775A604CB95

Uniqueness

Uniqueness Score: -1.00%

Function 006D1140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,hostfxr_set_error_writer), ref: 006D1148

Strings

Probed for and did not resolve library symbol %S, xrefs: 006D1159
hostfxr_set_error_writer, xrefs: 006D1141, 006D1154

Memory Dump Source

Source File: 00000000.00000002.1695302153.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1695082184.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695332963.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695347990.00000000006ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000006EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695362229.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_BCb8yQ0fg8.jbxd

Similarity

API ID: AddressProc
String ID: Probed for and did not resolve library symbol %S$hostfxr_set_error_writer
API String ID: 190572456-3442913825
Opcode ID: 9dd9a5cb4c662c802e2662387a3b8447a4a6120132a2a9edc514604c54cfffa2
Instruction ID: 23a3171552212a018283c8572cb48bdc6d2ac5afb388dfcfb6f8440f7ba903de
Opcode Fuzzy Hash: 9dd9a5cb4c662c802e2662387a3b8447a4a6120132a2a9edc514604c54cfffa2
Instruction Fuzzy Hash: FCC01271F86760678B611316BC0684939435B62BD93030051F90069352D5514C0442F1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BCb8yQ0fg8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\8028f380

C:\Users\user\AppData\Local\Temp\cgfmw

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
BCb8yQ0fg8.exe

Function 006DAB99 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
memoryCOMMON

Function 006D4A13 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
nativeCOMMON

Function 006D42F3 Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Function 006D5CA0 Relevance: 3.1, APIs: 2, Instructions: 74
memoryCOMMON

Function 006D49B3 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Function 006D3F23 Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Function 006DE8C0 Relevance: 51.4, APIs: 6, Strings: 23, Instructions: 669
COMMON