Windows Analysis Report
c4RAHq3BNl.exe

AV Detection

Source: https://shaffatta.com/d32e011d2eaa85a0/mozglue.dll	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/nss3.dll	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll/$oT	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/sqlite3.dll	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://shaffatta.com/d32e011d2eaa85a0/softokn3.dll	Avira URL Cloud: Label: malware

Source: https://shaffatta.com/L	Virustotal: Detection: 8%			Perma Link
Source: https://shaffatta.com/d32e011d2eaa85a0/msvcp140.dll	Virustotal: Detection: 11%			Perma Link
Source: https://shaffatta.com/fdca69ae739b4897.php	Virustotal: Detection: 10%			Perma Link

Source: c4RAHq3BNl.exe	ReversingLabs: Detection: 42%
Source: c4RAHq3BNl.exe	Virustotal: Detection: 45%			Perma Link

Source: c4RAHq3BNl.exe

Joe Sandbox ML: detected

Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: lstrcatA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: OpenEventA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateEventA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CloseHandle
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Sleep
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: VirtualFree
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: lstrlenA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ExitProcess
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: user32.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateDCA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sscanf
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HAL9TH
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: JohnDoe
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DISPLAY
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: https://shaffatta.com
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: /fdca69ae739b4897.php
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: /d32e011d2eaa85a0/
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Install_2
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GlobalLock
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HeapFree
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetFileSize
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GlobalSize
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Process32Next
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Process32First
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: LocalFree
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: FindClose
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ReadFile
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: WriteFile
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateFileA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CopyFileA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetLastError
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GlobalFree
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: OpenProcess
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ole32.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: wininet.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: shell32.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: psapi.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SelectObject
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BitBlt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DeleteObject
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GdipFree
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CoInitialize
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetDC
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CloseWindow
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: wsprintfA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CharToOemW
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: wsprintfW
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: StrStrA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RmStartSession
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RmGetList
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: RmEndSession
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: encrypted_key
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: PATH
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: NSS_Init
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: browser:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: profile:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: url:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: login:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: password:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Opera
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: OperaGX
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Network
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: cookies
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: .txt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: TRUE
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: FALSE
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: autofill
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: history
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: name:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: month:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: year:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: card:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Cookies
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Login Data
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Web Data
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: History
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: logins.json
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: usernameField
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: guid
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: places.sqlite
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: plugins
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: IndexedDB
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Opera Stable
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: CURRENT
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Local State
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: profiles.ini
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: chrome
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: opera
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: firefox
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: wallets
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ProductName
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DisplayName
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Network Info:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - IP: IP?
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Country: ISO?
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: System Summary:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - HWID:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - OS:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Architecture:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - UserName:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Computer Name:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Local Time:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - UTC:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Language:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Keyboards:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Laptop:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Running Path:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - CPU:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Threads:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Cores:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - RAM:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - Display Resolution:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: - GPU:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: User Agents:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Installed Apps:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: All Users:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Current User:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Process List:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: system_info.txt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: nss3.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Temp\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: .exe
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: runas
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: open
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: /c start
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: %RECENT%
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: *.lnk
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: files
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \discord\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: key_datas
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: map*
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Telegram
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: *.tox
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: *.ini
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Password
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: 00000001
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: 00000002
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: 00000003
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: 00000004
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Pidgin
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \.purple\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: accounts.xml
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: token:
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: SteamPath
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \config\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ssfn*
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: config.vdf
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Steam\
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: browsers
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: done
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: soft
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: https
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: POST
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: hwid
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: build
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: token
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: file_name
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: file
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: message
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack	String decryptor: screenshot.jpg

Cryptography

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,		0_2_00409540
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,		0_2_00406C10
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,		0_2_004094A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004155A0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,		0_2_004155A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,		0_2_0040BF90
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,		0_2_6C6D6C80
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C82A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,		0_2_6C82A9A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8244C0 PK11_PubEncrypt,		0_2_6C8244C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7F4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,		0_2_6C7F4420
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C824440 PK11_PrivDecrypt,		0_2_6C824440
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8725B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,		0_2_6C8725B0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C80E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,		0_2_6C80E6E0

Compliance

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Unpacked PE file: 0.2.c4RAHq3BNl.exe.400000.0.unpack

Source: c4RAHq3BNl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.248.46:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.248.46:443 -> 192.168.2.5:49763 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: c4RAHq3BNl.exe, 00000000.00000002.3276907744.000000006C73D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: c4RAHq3BNl.exe, 00000000.00000002.3276907744.000000006C73D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Spreading

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,		0_2_0040D1C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_004015C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,		0_2_00411650
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,		0_2_0040B610
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,		0_2_0040DB60
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_0040D540
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00412570
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,		0_2_004121F0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,		0_2_00411B80

Networking

Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAFHost: shaffatta.comContent-Length: 216Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: shaffatta.comContent-Length: 268Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJEHost: shaffatta.comContent-Length: 267Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIHost: shaffatta.comContent-Length: 5823Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/sqlite3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJEGIIEGIDGIDHJDAKFHost: shaffatta.comContent-Length: 751Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJHost: shaffatta.comContent-Length: 359Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: shaffatta.comContent-Length: 359Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/freebl3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/mozglue.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/msvcp140.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/nss3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/softokn3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/vcruntime140.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: shaffatta.comContent-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHCHost: shaffatta.comContent-Length: 267Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: shaffatta.comContent-Length: 265Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKFHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHCHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFIHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAKFBGCBFHIJKECGIIJHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJEHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAKFIJJKJJJKEBKJEHHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHCFBGIIJKFHJDHDHHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKFHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBAKKKFBFHIDGIIEHHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: shaffatta.comContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /fdca69ae739b4897.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: shaffatta.comContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YOPbGKrV0LEGIjBS7GnGmqaZ9EWfyRGfksWN7UDK3EXq_-bjwYmJEf0C5nRkSFOpXYOxhCcsjI-KqzoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-03-00; NID=513=WCt0m2IY6-XwivBAmcSfqLq9ED-NKpUBmsK_eqjaiJ4U0I64v8yMvtJhBFx3-k8CDGXp6aJr1OuMvuf-TGgQ7NDfE9JAMUgh0kmH9V0PntfGpQ0AioP_qVIxiA_qn-BFOwJVLhWrkm1ZR8rK9Dg1rDT2lDgW-86owYUYlk_lfjc
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YOPbGKrV0LEGIjCEBr3ti8UCkjxZ8z1bhLV56wHmRrKhu4Vx7PJg1CB49b8tfAh4AUocopkgP0IK5pYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-03-00; NID=513=WCt0m2IY6-XwivBAmcSfqLq9ED-NKpUBmsK_eqjaiJ4U0I64v8yMvtJhBFx3-k8CDGXp6aJr1OuMvuf-TGgQ7NDfE9JAMUgh0kmH9V0PntfGpQ0AioP_qVIxiA_qn-BFOwJVLhWrkm1ZR8rK9Dg1rDT2lDgW-86owYUYlk_lfjc
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=H8C+XZOAWfMGxBS&MD=hxA+7znt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=H8C+XZOAWfMGxBS&MD=hxA+7znt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/sqlite3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/freebl3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/mozglue.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/msvcp140.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/nss3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/softokn3.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d32e011d2eaa85a0/vcruntime140.dll HTTP/1.1Host: shaffatta.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: shaffatta.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714694808007&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: c4RAHq3BNl.exe, c4RAHq3BNl.exe, 00000000.00000002.3276907744.000000006C73D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: c4RAHq3BNl.exe, 00000000.00000002.3276790097.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.co
Source: c4RAHq3BNl.exe, 00000000.00000002.3253214471.0000000002D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com
Source: c4RAHq3BNl.exe, 00000000.00000003.2899780366.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/
Source: c4RAHq3BNl.exe, 00000000.00000003.2864517080.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2855764603.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899867172.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899830215.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899780366.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/(
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/32e011d2eaa85a0/nss3.dll
Source: c4RAHq3BNl.exe, 00000000.00000003.2864517080.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899867172.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899830215.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899780366.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/:
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/AKJDHJKFHIEBFCGHCGHDGC
Source: c4RAHq3BNl.exe, 00000000.00000003.2864517080.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2855764603.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899867172.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899830215.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2899780366.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/L
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/M%
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/amData
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D410000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll)
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll/$oT
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/mozglue.dll
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/mozglue.dllG#
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/msvcp140.dll
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/nss3.dll
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/nss3.dll3
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/softokn3.dll
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/sqlite3.dllg$
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/sqlite3.dllu#
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D410000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/vcruntime140.dll
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d32e011d2eaa85a0/vcruntime140.dll8
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/d3e
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/fatta.com/
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/fatta.com/DGIDAKEBAAKFCGHCBAKJDA
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/fatta.com/X
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/fdca69ae739b4897.php
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://shaffatta.com/fdca69ae739b4897.php8ec24d29b45ae0b00693c3ad9a656
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://shaffatta.com/fdca69ae739b4897.phpiYW4qLCpjYXJkcyosKmJhbmtzKiwqY3Z2KiwqY3ZjKiwqYWNjb3VudCosK
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/fdca69ae739b4897.phpindows
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/fdca69ae739b4897.phpnts
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://shaffatta.com/fdca69ae739b4897.phption:
Source: c4RAHq3BNl.exe, 00000000.00000002.3266404639.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/ktop
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shaffatta.com/t%
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: c4RAHq3BNl.exe, 00000000.00000003.2920893249.000000001D48A000.00000004.00000020.00020000.00000000.sdmp, ECFCBFBG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: c4RAHq3BNl.exe, 00000000.00000003.3053946634.000000002F8E3000.00000004.00000020.00020000.00000000.sdmp, IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: c4RAHq3BNl.exe, 00000000.00000003.3053946634.000000002F8E3000.00000004.00000020.00020000.00000000.sdmp, IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: c4RAHq3BNl.exe, 00000000.00000003.3053946634.000000002F8E3000.00000004.00000020.00020000.00000000.sdmp, IIIDAKJDHJKFHIEBFCGHCGHDGC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.248.46:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.248.46:443 -> 192.168.2.5:49763 version: TLS 1.2

System Summary

Source: 00000000.00000002.3252549703.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.3253194154.0000000002D37000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3253231068.0000000002D60000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3252916519.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C72B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,		0_2_6C72B700
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C72B8C0 rand_s,NtQueryVirtualMemory,		0_2_6C72B8C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C72B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,		0_2_6C72B910
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,		0_2_6C6CF280

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6D5440		0_2_6C6D5440
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C73545C		0_2_6C73545C
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C73542B		0_2_6C73542B
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C705C10		0_2_6C705C10
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C712C10		0_2_6C712C10
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C73AC00		0_2_6C73AC00
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C706CF0		0_2_6C706CF0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CD4E0		0_2_6C6CD4E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6D64C0		0_2_6C6D64C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6ED4D0		0_2_6C6ED4D0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7234A0		0_2_6C7234A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C72C4A0		0_2_6C72C4A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6D6C80		0_2_6C6D6C80
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6DFD00		0_2_6C6DFD00
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6F0512		0_2_6C6F0512
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6EED10		0_2_6C6EED10
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7285F0		0_2_6C7285F0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C700DD0		0_2_6C700DD0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6C35A0		0_2_6C6C35A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C736E63		0_2_6C736E63
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CC670		0_2_6C6CC670
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C703E50		0_2_6C703E50
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6E4640		0_2_6C6E4640
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6E9E50		0_2_6C6E9E50
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C712E4E		0_2_6C712E4E
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C729E30		0_2_6C729E30
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C707E10		0_2_6C707E10
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C715600		0_2_6C715600
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7376E3		0_2_6C7376E3
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CBEF0		0_2_6C6CBEF0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6DFEF0		0_2_6C6DFEF0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C724EA0		0_2_6C724EA0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C72E680		0_2_6C72E680
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6E5E90		0_2_6C6E5E90
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C707710		0_2_6C707710
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6D9F00		0_2_6C6D9F00
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CDFE0		0_2_6C6CDFE0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6F6FF0		0_2_6C6F6FF0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7177A0		0_2_6C7177A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C70F070		0_2_6C70F070
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6E8850		0_2_6C6E8850
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6ED850		0_2_6C6ED850
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C70B820		0_2_6C70B820
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C714820		0_2_6C714820
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6D7810		0_2_6C6D7810
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6EC0E0		0_2_6C6EC0E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7058E0		0_2_6C7058E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7350C7		0_2_6C7350C7
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6F60A0		0_2_6C6F60A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C71B970		0_2_6C71B970
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C73B170		0_2_6C73B170
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6DD960		0_2_6C6DD960
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6EA940		0_2_6C6EA940
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CC9A0		0_2_6C6CC9A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6FD9B0		0_2_6C6FD9B0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C705190		0_2_6C705190
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C722990		0_2_6C722990
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C709A60		0_2_6C709A60
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C70E2F0		0_2_6C70E2F0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6E1AF0		0_2_6C6E1AF0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C708AC0		0_2_6C708AC0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C732AB0		0_2_6C732AB0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6C22A0		0_2_6C6C22A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6F4AA0		0_2_6C6F4AA0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6DCAB0		0_2_6C6DCAB0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C73BA90		0_2_6C73BA90
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6DC370		0_2_6C6DC370
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6C5340		0_2_6C6C5340
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C70D320		0_2_6C70D320
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7353C8		0_2_6C7353C8
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6CF380		0_2_6C6CF380
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C77AC60		0_2_6C77AC60
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C836C00		0_2_6C836C00
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7CECD0		0_2_6C7CECD0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C84AC30		0_2_6C84AC30
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C76ECC0		0_2_6C76ECC0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C806D90		0_2_6C806D90
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8FCDC0		0_2_6C8FCDC0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8F8D20		0_2_6C8F8D20
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C774DB0		0_2_6C774DB0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C89AD50		0_2_6C89AD50
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C83ED70		0_2_6C83ED70
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C810EC0		0_2_6C810EC0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C850E20		0_2_6C850E20
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C77AEC0		0_2_6C77AEC0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7F6E90		0_2_6C7F6E90
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C80EE70		0_2_6C80EE70
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8B8FB0		0_2_6C8B8FB0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7DEF40		0_2_6C7DEF40
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C776F10		0_2_6C776F10
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C84EFF0		0_2_6C84EFF0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C770FE0		0_2_6C770FE0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8B0F20		0_2_6C8B0F20
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C77EFB0		0_2_6C77EFB0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C832F70		0_2_6C832F70
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7C0820		0_2_6C7C0820
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7FA820		0_2_6C7FA820
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8768E0		0_2_6C8768E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C844840		0_2_6C844840
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7A8960		0_2_6C7A8960
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8009A0		0_2_6C8009A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C82A9A0		0_2_6C82A9A0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8309B0		0_2_6C8309B0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C88C9E0		0_2_6C88C9E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7C6900		0_2_6C7C6900
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7A49F0		0_2_6C7A49F0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7ECA70		0_2_6C7ECA70
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C81EA00		0_2_6C81EA00
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C828A30		0_2_6C828A30
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7EEA80		0_2_6C7EEA80
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C810BA0		0_2_6C810BA0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C876BE0		0_2_6C876BE0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C89A480		0_2_6C89A480
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C788460		0_2_6C788460
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7FA430		0_2_6C7FA430
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C80A4D0		0_2_6C80A4D0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7D4420		0_2_6C7D4420
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7B64D0		0_2_6C7B64D0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7D2560		0_2_6C7D2560
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7C8540		0_2_6C7C8540
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C83A5E0		0_2_6C83A5E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7FE5F0		0_2_6C7FE5F0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7645B0		0_2_6C7645B0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C874540		0_2_6C874540
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8B8550		0_2_6C8B8550
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C810570		0_2_6C810570
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7CC650		0_2_6C7CC650
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C80E6E0		0_2_6C80E6E0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7CE6E0		0_2_6C7CE6E0

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 6C793620 appears 35 times
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 6C8F09D0 appears 146 times
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 6C799B10 appears 34 times
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 6C7094D0 appears 90 times
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 6C8FDAE0 appears 35 times
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: String function: 6C6FCBE8 appears 134 times

Source: c4RAHq3BNl.exe, 00000000.00000002.3276942673.000000006C752000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs c4RAHq3BNl.exe
Source: c4RAHq3BNl.exe, 00000000.00000002.3277175524.000000006C945000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs c4RAHq3BNl.exe

Source: c4RAHq3BNl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3252549703.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.3253194154.0000000002D37000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3253231068.0000000002D60000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3252916519.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/36@4/5

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_6C727030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C727030

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00414DE0 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00414DE0

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Jump to behavior

Source: c4RAHq3BNl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: c4RAHq3BNl.exe, c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: c4RAHq3BNl.exe, 00000000.00000003.2932449117.0000000023788000.00000004.00000020.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000003.2920614131.0000000023794000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr, CAAAAFBKFIECAAKECGCA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: c4RAHq3BNl.exe, 00000000.00000002.3276741812.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, c4RAHq3BNl.exe, 00000000.00000002.3266507871.000000001D51A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: c4RAHq3BNl.exe	ReversingLabs: Detection: 42%
Source: c4RAHq3BNl.exe	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Users\user\Desktop\c4RAHq3BNl.exe "C:\Users\user\Desktop\c4RAHq3BNl.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: rstrtmgr.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: mozglue.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: wsock32.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: vcruntime140.dll			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Section loaded: msvcp140.dll			Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: c4RAHq3BNl.exe, 00000000.00000002.3276907744.000000006C73D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: c4RAHq3BNl.exe, 00000000.00000002.3277093860.000000006C8FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: c4RAHq3BNl.exe, 00000000.00000002.3276907744.000000006C73D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Unpacked PE file: 0.2.c4RAHq3BNl.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Unpacked PE file: 0.2.c4RAHq3BNl.exe.400000.0.unpack

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004176C5 push ecx; ret		0_2_004176D8
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6FB536 push ecx; ret		0_2_6C6FB549

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\mozglue.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\nss3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\msvcp140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\freebl3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\vcruntime140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\softokn3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\mozglue.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\nss3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\msvcp140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\freebl3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\vcruntime140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File created: C:\ProgramData\softokn3.dll			Jump to dropped file

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

API coverage: 4.3 %

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,		0_2_0040D1C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_004015C0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,		0_2_00411650
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,		0_2_0040B610
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,		0_2_0040DB60
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_0040D540
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,		0_2_00412570
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,		0_2_004121F0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,		0_2_00411B80

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: JDGCFBAF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: JDGCFBAF.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JDGCFBAF.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JDGCFBAF.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JDGCFBAF.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: JDGCFBAF.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JDGCFBAF.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JDGCFBAF.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JDGCFBAF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JDGCFBAF.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JDGCFBAF.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JDGCFBAF.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JDGCFBAF.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JDGCFBAF.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JDGCFBAF.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: c4RAHq3BNl.exe, 00000000.00000002.3253231068.0000000002D60000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JDGCFBAF.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JDGCFBAF.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002D76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: JDGCFBAF.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JDGCFBAF.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	API call chain: ExitProcess graph end node

Anti Debugging

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00417B4E

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00415DC0 mov eax, dword ptr fs:[00000030h]

0_2_00415DC0

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00419DC7 SetUnhandledExceptionFilter,		0_2_00419DC7
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00417B4E
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004173DD
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C6FB66C
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C6FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C6FB1F7
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C8AAC62

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_6C6FB341 cpuid

0_2_6C6FB341

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00414570

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00414450

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143C0

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Code function: 0_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144B0

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3252916519.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3251060961.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2826944612.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 00000000.00000002.3253248628.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c4RAHq3BNl.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3252916519.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3251060961.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2826944612.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c4RAHq3BNl.exe PID: 6488, type: MEMORYSTR

Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3251060961.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: c4RAHq3BNl.exe, 00000000.00000002.3253248628.0000000002DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\*.*9$yT

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies			Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Binance\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\			Jump to behavior
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\			Jump to behavior

Source: Yara match

File source: Process Memory Space: c4RAHq3BNl.exe PID: 6488, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3252916519.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3251060961.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2826944612.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 00000000.00000002.3253248628.0000000002D76000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c4RAHq3BNl.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.c4RAHq3BNl.exe.2cb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.c4RAHq3BNl.exe.2c80e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3252916519.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3251060961.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2826944612.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c4RAHq3BNl.exe PID: 6488, type: MEMORYSTR

Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8B0C40 sqlite3_bind_zeroblob,		0_2_6C8B0C40
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8B0D60 sqlite3_bind_parameter_name,		0_2_6C8B0D60
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7D8EA0 sqlite3_clear_bindings,		0_2_6C7D8EA0
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C8B0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,		0_2_6C8B0B40
Source: C:\Users\user\Desktop\c4RAHq3BNl.exe	Code function: 0_2_6C7D6410 bind,WSAGetLastError,		0_2_6C7D6410