Windows Analysis Report
92s4OjHVFf.exe

Overview

General Information

Sample name: 92s4OjHVFf.exe
renamed because original name is a hash value
Original sample name: bd2eac64cbded877608468d86786594a.exe
Analysis ID: 1465047
MD5: bd2eac64cbded877608468d86786594a
SHA1: 778ad44afd5629f0a5b3b7df9d6f02522ae94d91
SHA256: cae992788853230af91501546f6ead07cfd767cb8429c98a273093a90bbcb5ad
Tags: 32exe
Infos:

Detection

LummaC
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
LummaC encrypted strings found
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Detected potential crypto function
Entry point lies outside standard sections
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 92s4OjHVFf.exe Avira: detected
Antivirus detection for URL or domain
Source: https://foodypannyjsud.shop/api2 Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/w Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/s Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/api: Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/jh4 Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/raw Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/a Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/F9r Avira URL Cloud: Label: malware
Source: towerxxuytwi.xyz Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/api Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/pir Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/piw Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop:443/apiBrowser Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/s~ Avira URL Cloud: Label: malware
Source: contintnetksows.shop Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/pie Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/pi Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/he Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/bm Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/obZ Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/ob Avira URL Cloud: Label: malware
Source: penetratedpoopp.xyz Avira URL Cloud: Label: malware
Source: ellaboratepwsz.xyz Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apili Avira URL Cloud: Label: malware
Source: swellfrrgwwos.xyz Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apie Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/ Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apih Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apiT Avira URL Cloud: Label: malware
Source: foodypannyjsud.shop Avira URL Cloud: Label: malware
Source: pedestriankodwu.xyz Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/bu: Avira URL Cloud: Label: malware
Source: potterryisiw.shop Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apiF Avira URL Cloud: Label: malware
Found malware configuration
Source: 0.2.92s4OjHVFf.exe.c70000.0.unpack Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "foodypannyjsud.shop"], "Build id": "bOKHNM--"}
Multi AV Scanner detection for domain / URL
Source: https://foodypannyjsud.shop/api Virustotal: Detection: 13% Perma Link
Source: https://foodypannyjsud.shop/pi Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for submitted file
Source: 92s4OjHVFf.exe ReversingLabs: Detection: 50%
Source: 92s4OjHVFf.exe Virustotal: Detection: 22% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.7% probability
Machine Learning detection for sample
Source: 92s4OjHVFf.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: pedestriankodwu.xyz
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: towerxxuytwi.xyz
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: ellaboratepwsz.xyz
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: penetratedpoopp.xyz
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: swellfrrgwwos.xyz
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: contintnetksows.shop
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: foodypannyjsud.shop
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: potterryisiw.shop
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: foodypannyjsud.shop
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: Workgroup: -
Source: 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String decryptor: bOKHNM--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C86FD2 CryptUnprotectData, 0_2_00C86FD2
Uses 32bit PE files
Source: 92s4OjHVFf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: 92s4OjHVFf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov edi, dword ptr [esi] 0_2_00CA8085
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_00C861E0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov ecx, dword ptr [esp+5Ch] 0_2_00C864F3
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp dword ptr [eax+edi*8], 11081610h 0_2_00C90991
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_00C86A85
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov word ptr [ecx], ax 0_2_00C86A85
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 0_2_00C80FCA
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov byte ptr [eax], dl 0_2_00C80FCA
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_00CAAFE0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [00CB2490h] 0_2_00C8308E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_00CAB1A0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov byte ptr [ebx], al 0_2_00C7F9F6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov ecx, dword ptr [esp+60h] 0_2_00C8DEB0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov ecx, dword ptr [esp+04h] 0_2_00C85E60
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then jmp ecx 0_2_00CA5F22
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then push 00000400h 0_2_00CA403F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then push 00000400h 0_2_00CA403F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then jmp esi 0_2_00CAA130
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 0_2_00C8437F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov byte ptr [edi], dl 0_2_00C96449
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov byte ptr [edi], dl 0_2_00C96446
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [00CB2490h] 0_2_00C8277E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 0_2_00C8480A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then jmp eax 0_2_00C92BE3
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [00CB2490h] 0_2_00C8277E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_00C86B5C
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 0_2_00C94C30
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov dword ptr [esp+38h], 00000000h 0_2_00C82DAD
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then lea eax, dword ptr [eax+eax*4] 0_2_00C78D20
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 0_2_00C94EE0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 0_2_00CA0F40
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esi] 0_2_00CA7465
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 0_2_00C81590
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then dec ebx 0_2_00CA9546
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov edx, dword ptr [esp] 0_2_00C79550
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 0_2_00C73680
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov byte ptr [edx], cl 0_2_00C797F0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then add edx, 03h 0_2_00C939C8
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp eax, 03h 0_2_00C739D0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov dword ptr [esi+000001D0h], 64425032h 0_2_00C979E9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esi] 0_2_00CA7940
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then jmp ecx 0_2_00C8F974
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp byte ptr [ebp+00h], 00000000h 0_2_00C85BB0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov dword ptr [esi+10h], ebx 0_2_00C95B60
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov byte ptr [edi], al 0_2_00C95B60
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then cmp byte ptr [edx+eax], 00000000h 0_2_00C81CA5
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 0_2_00C8FEA3
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 4x nop then jmp esi 0_2_00CA9F00

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: pedestriankodwu.xyz
Source: Malware configuration extractor URLs: towerxxuytwi.xyz
Source: Malware configuration extractor URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor URLs: penetratedpoopp.xyz
Source: Malware configuration extractor URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor URLs: contintnetksows.shop
Source: Malware configuration extractor URLs: foodypannyjsud.shop
Source: Malware configuration extractor URLs: potterryisiw.shop
Source: Malware configuration extractor URLs: foodypannyjsud.shop
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1282Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 590044Host: foodypannyjsud.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: foodypannyjsud.shop
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: foodypannyjsud.shop
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: foodypannyjsud.shop
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 92s4OjHVFf.exe, 00000000.00000003.1716462205.000000000419E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738171796.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1776166890.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000002.1806211073.0000000001AF0000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1686993771.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738410105.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1781198203.0000000001B6A000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1805038317.0000000001AED000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1682258195.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739417270.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739308703.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688458725.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1804991521.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/
Source: 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B66000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/A
Source: 92s4OjHVFf.exe, 00000000.00000003.1776166890.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1781198203.0000000001B6A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/F9r
Source: 92s4OjHVFf.exe, 00000000.00000003.1758756624.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1759633957.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758282808.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758190444.0000000001B57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/a
Source: 92s4OjHVFf.exe, 00000000.00000003.1686993771.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740941093.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739308703.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1718403928.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758934891.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738787868.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1715474160.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741338157.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B51000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738171796.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740088391.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1805038317.0000000001AED000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740413834.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739417270.0000000001B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/api
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758216225.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758934891.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/api2
Source: 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B66000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/api:
Source: 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/apiF
Source: 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/apiT
Source: 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/apie
Source: 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/apih
Source: 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741452050.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739417270.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739844543.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740413834.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740525755.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738171796.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739966621.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740941093.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741338157.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738410105.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739308703.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740639294.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001AED000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738787868.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740088391.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/apili
Source: 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738171796.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740088391.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738410105.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739844543.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739417270.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739308703.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739966621.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B64000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738787868.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/bm
Source: 92s4OjHVFf.exe, 00000000.00000003.1776166890.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1781198203.0000000001B6A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/bu:
Source: 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B66000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/he
Source: 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/jh4
Source: 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/ob
Source: 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/obZ
Source: 92s4OjHVFf.exe, 00000000.00000003.1776166890.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1804991521.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000002.1806300153.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/pi
Source: 92s4OjHVFf.exe, 00000000.00000003.1776166890.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1781198203.0000000001B6A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/pie
Source: 92s4OjHVFf.exe, 00000000.00000003.1804991521.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000002.1806300153.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/pir
Source: 92s4OjHVFf.exe, 00000000.00000003.1758756624.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1759633957.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758282808.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758190444.0000000001B57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/piw
Source: 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700404613.0000000001B66000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/raw
Source: 92s4OjHVFf.exe, 00000000.00000003.1758756624.0000000001B6D000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1759633957.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758282808.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758190444.0000000001B57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/s
Source: 92s4OjHVFf.exe, 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758282808.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758190444.0000000001B57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/s~
Source: 92s4OjHVFf.exe, 00000000.00000003.1739844543.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740639294.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739966621.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740941093.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739308703.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1718403928.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738787868.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1715474160.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741338157.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738171796.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740088391.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740413834.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739417270.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738410105.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740525755.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741452050.0000000001B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop/w
Source: 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740639294.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739308703.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740941093.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739844543.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740525755.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740088391.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741338157.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738171796.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739966621.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739417270.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1741452050.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1736612289.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740413834.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738787868.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738410105.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://foodypannyjsud.shop:443/apiBrowser
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 92s4OjHVFf.exe, 00000000.00000003.1687471349.00000000041DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 92s4OjHVFf.exe, 00000000.00000003.1687471349.00000000041DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 92s4OjHVFf.exe, 00000000.00000003.1687471349.00000000041DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: 92s4OjHVFf.exe, 00000000.00000003.1723391483.0000000001B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 92s4OjHVFf.exe, 00000000.00000003.1688322228.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1688569561.0000000004198000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 92s4OjHVFf.exe, 00000000.00000003.1722802490.00000000042A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C9E780 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 0_2_00C9E780
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C9E780 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 0_2_00C9E780
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C9E9A0 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 0_2_00C9E9A0
Detected potential crypto function
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C866C6 0_2_00C866C6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C90991 0_2_00C90991
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C74D30 0_2_00C74D30
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C91020 0_2_00C91020
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C71F40 0_2_00C71F40
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C780F0 0_2_00C780F0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CEA08B 0_2_00CEA08B
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D2009A 0_2_00D2009A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F5C090 0_2_00F5C090
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F5C03A 0_2_00F5C03A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DCC1F3 0_2_00DCC1F3
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D06142 0_2_00D06142
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC8167 0_2_00CC8167
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_014DC0FD 0_2_014DC0FD
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CF812D 0_2_00CF812D
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CAA130 0_2_00CAA130
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_010BE36A 0_2_010BE36A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DAC273 0_2_00DAC273
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CAA270 0_2_00CAA270
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C94272 0_2_00C94272
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC6213 0_2_00CC6213
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D803CC 0_2_00D803CC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CAA3D0 0_2_00CAA3D0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C74340 0_2_00C74340
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00FC2370 0_2_00FC2370
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F3C321 0_2_00F3C321
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EDA4FF 0_2_00EDA4FF
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D2A495 0_2_00D2A495
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D78459 0_2_00D78459
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F76435 0_2_00F76435
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E0A5B7 0_2_00E0A5B7
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0120647A 0_2_0120647A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E16580 0_2_00E16580
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D565AC 0_2_00D565AC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00FE8579 0_2_00FE8579
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C76570 0_2_00C76570
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00FC2530 0_2_00FC2530
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EB4534 0_2_00EB4534
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CD06F5 0_2_00CD06F5
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0122471D 0_2_0122471D
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_010AE7ED 0_2_010AE7ED
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F0260E 0_2_00F0260E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_010BE613 0_2_010BE613
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F8C7C1 0_2_00F8C7C1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DF8794 0_2_00DF8794
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EE07B2 0_2_00EE07B2
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CE07BA 0_2_00CE07BA
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D2271D 0_2_00D2271D
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_011FA6F9 0_2_011FA6F9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_011D491E 0_2_011D491E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_01014932 0_2_01014932
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D628EB 0_2_00D628EB
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D9A8A6 0_2_00D9A8A6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EB6868 0_2_00EB6868
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DA8868 0_2_00DA8868
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E1C808 0_2_00E1C808
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CA6820 0_2_00CA6820
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CFE9F5 0_2_00CFE9F5
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC89AC 0_2_00CC89AC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D34974 0_2_00D34974
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_010A68BC 0_2_010A68BC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F46931 0_2_00F46931
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D7AA83 0_2_00D7AA83
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C76A90 0_2_00C76A90
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EE2A3E 0_2_00EE2A3E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0110CA01 0_2_0110CA01
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F4EBAC 0_2_00F4EBAC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC6B09 0_2_00CC6B09
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EF2B06 0_2_00EF2B06
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F88CF2 0_2_00F88CF2
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D8ACC1 0_2_00D8ACC1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC6CE7 0_2_00CC6CE7
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E9ACD9 0_2_00E9ACD9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_010C8D57 0_2_010C8D57
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EE4C8F 0_2_00EE4C8F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E24C99 0_2_00E24C99
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E5AD92 0_2_00E5AD92
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0150EC87 0_2_0150EC87
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C78D20 0_2_00C78D20
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DB2EC1 0_2_00DB2EC1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CDEED6 0_2_00CDEED6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0112AF0F 0_2_0112AF0F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C94EE0 0_2_00C94EE0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D6CEF8 0_2_00D6CEF8
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EB6EC4 0_2_00EB6EC4
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F3AEB1 0_2_00F3AEB1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CFCFD4 0_2_00CFCFD4
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E3EFB9 0_2_00E3EFB9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D28FBF 0_2_00D28FBF
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D98FA9 0_2_00D98FA9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0154EE2A 0_2_0154EE2A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F72F3C 0_2_00F72F3C
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D6CF05 0_2_00D6CF05
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DFCF06 0_2_00DFCF06
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D1CF31 0_2_00D1CF31
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DC2F25 0_2_00DC2F25
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DDB0DD 0_2_00DDB0DD
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00FBD0C1 0_2_00FBD0C1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC9044 0_2_00CC9044
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CA7070 0_2_00CA7070
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F1B031 0_2_00F1B031
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C71000 0_2_00C71000
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F47021 0_2_00F47021
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC3038 0_2_00CC3038
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DF9021 0_2_00DF9021
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F6D1F0 0_2_00F6D1F0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C711E2 0_2_00C711E2
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC91F8 0_2_00CC91F8
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CDD1F6 0_2_00CDD1F6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F3F1B1 0_2_00F3F1B1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CD5187 0_2_00CD5187
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E5F163 0_2_00E5F163
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D5D11E 0_2_00D5D11E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D1F3CC 0_2_00D1F3CC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E693C4 0_2_00E693C4
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C933A0 0_2_00C933A0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C8D35C 0_2_00C8D35C
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CF335B 0_2_00CF335B
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DB537E 0_2_00DB537E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC936A 0_2_00CC936A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DD5375 0_2_00DD5375
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_011AB2D1 0_2_011AB2D1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DAF334 0_2_00DAF334
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC94CA 0_2_00CC94CA
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0110355C 0_2_0110355C
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F4142D 0_2_00F4142D
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E495E5 0_2_00E495E5
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CA35E0 0_2_00CA35E0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_01553418 0_2_01553418
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DB3572 0_2_00DB3572
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F4555D 0_2_00F4555D
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0114B4B8 0_2_0114B4B8
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D7B516 0_2_00D7B516
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C71535 0_2_00C71535
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E9B64B 0_2_00E9B64B
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0110D7CF 0_2_0110D7CF
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_011AD69D 0_2_011AD69D
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_014DF6E9 0_2_014DF6E9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_01571690 0_2_01571690
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00ECB723 0_2_00ECB723
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C91730 0_2_00C91730
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EB58EC 0_2_00EB58EC
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0103990A 0_2_0103990A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E6D8F1 0_2_00E6D8F1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0101D926 0_2_0101D926
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F1589F 0_2_00F1589F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C75840 0_2_00C75840
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C7F840 0_2_00C7F840
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D0F875 0_2_00D0F875
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_012079D1 0_2_012079D1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D2B820 0_2_00D2B820
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D259DA 0_2_00D259DA
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C739D0 0_2_00C739D0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C979E9 0_2_00C979E9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_01051832 0_2_01051832
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC599C 0_2_00CC599C
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C8F974 0_2_00C8F974
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_011C78D6 0_2_011C78D6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DAB901 0_2_00DAB901
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DAB901 0_2_00DAB901
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_011BD8E3 0_2_011BD8E3
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E03919 0_2_00E03919
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E09A8E 0_2_00E09A8E
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D53AA3 0_2_00D53AA3
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E23A34 0_2_00E23A34
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CF5A21 0_2_00CF5A21
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DA5BD1 0_2_00DA5BD1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00ED3B80 0_2_00ED3B80
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EE1B3F 0_2_00EE1B3F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D81B37 0_2_00D81B37
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E25CFF 0_2_00E25CFF
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00FD9CB6 0_2_00FD9CB6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D73C8F 0_2_00D73C8F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F11C4A 0_2_00F11C4A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D87C1B 0_2_00D87C1B
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D19C35 0_2_00D19C35
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CABC20 0_2_00CABC20
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00EE9D96 0_2_00EE9D96
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D89EE2 0_2_00D89EE2
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00DEBEB6 0_2_00DEBEB6
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00FEBE43 0_2_00FEBE43
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00F6BE00 0_2_00F6BE00
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC5E34 0_2_00CC5E34
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E03E1A 0_2_00E03E1A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00D6DF98 0_2_00D6DF98
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E8DFB7 0_2_00E8DFB7
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_01145E66 0_2_01145E66
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CABF40 0_2_00CABF40
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_01579EE9 0_2_01579EE9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CA9F00 0_2_00CA9F00
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: String function: 00C7F9C0 appears 162 times
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: String function: 00C78B20 appears 50 times
Sample file is different than original file name gathered from version info
Source: 92s4OjHVFf.exe, 00000000.00000002.1805949609.0000000001584000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameecmangen.exej% vs 92s4OjHVFf.exe
Source: 92s4OjHVFf.exe, 00000000.00000000.1655612904.0000000001584000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameecmangen.exej% vs 92s4OjHVFf.exe
Source: 92s4OjHVFf.exe Binary or memory string: OriginalFilenameecmangen.exej% vs 92s4OjHVFf.exe
Uses 32bit PE files
Source: 92s4OjHVFf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00C9D1E0 CoCreateInstance, 0_2_00C9D1E0
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 92s4OjHVFf.exe, 00000000.00000003.1687773238.00000000041B4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 92s4OjHVFf.exe ReversingLabs: Detection: 50%
Source: 92s4OjHVFf.exe Virustotal: Detection: 22%
Source: 92s4OjHVFf.exe String found in binary or memory: mso-level-tab-stop:.5in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:1.0in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:1.5in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:2.0in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:2.5in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:3.0in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:3.5in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:4.0in;
Source: 92s4OjHVFf.exe String found in binary or memory: {mso-level-tab-stop:4.5in;
Source: 92s4OjHVFf.exe String found in binary or memory: tab-stops:list .5in'><![if !supportLists]><span style=3D'font-size:10.0pt;
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File read: C:\Users\user\Desktop\92s4OjHVFf.exe Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: 92s4OjHVFf.exe Static file information: File size 6642176 > 1048576
Source: 92s4OjHVFf.exe Static PE information: Raw size of .vmpLp is bigger than: 0x100000 < 0x5de400
Source: 92s4OjHVFf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .vmpLp
PE file contains sections with non-standard names
Source: 92s4OjHVFf.exe Static PE information: section name: .vmpLp
Source: 92s4OjHVFf.exe Static PE information: section name: .vmpLp
Source: 92s4OjHVFf.exe Static PE information: section name: .vmpLp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CE07BA pushad ; iretd 0_2_00CF70E1
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_0150CA54 pushfd ; iretd 0_2_011AE026
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC8BF1 push dword ptr [edx]; ret 0_2_00CC8BF9
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC4B59 push esi; ret 0_2_00CC4B5A
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC8B0C push dword ptr [ebx]; retf 0_2_00CC8B13
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC755F push esi; iretd 0_2_00CC7561
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CC7E5A push ebx; ret 0_2_00CC7E5B
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\92s4OjHVFf.exe System information queried: FirmwareTableInformation Jump to behavior
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: 11C8181
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: FEAA71
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: 1205B80
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: 10C6310
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: 111522F
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: 14B20B2
Source: C:\Users\user\Desktop\92s4OjHVFf.exe API/Special instruction interceptor: Address: 1199E6B
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E22397 rdtsc 0_2_00E22397
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\92s4OjHVFf.exe TID: 6664 Thread sleep time: -150000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe TID: 6664 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: 92s4OjHVFf.exe, 00000000.00000003.1739844543.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758216225.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000002.1806211073.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740639294.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739966621.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1686993771.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWw
Source: 92s4OjHVFf.exe, 00000000.00000002.1806108628.0000000001AAE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: 92s4OjHVFf.exe, 00000000.00000003.1739844543.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1758216225.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739529170.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000002.1806211073.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1740639294.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739009530.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1739966621.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1686993771.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1700214231.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00E22397 rdtsc 0_2_00E22397
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Code function: 0_2_00CA8120 LdrInitializeThunk, 0_2_00CA8120

HIPS / PFW / Operating System Protection Evasion
barindex
LummaC encrypted strings found
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: pedestriankodwu.xyz
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: towerxxuytwi.xyz
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: ellaboratepwsz.xyz
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: penetratedpoopp.xyz
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: swellfrrgwwos.xyz
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: contintnetksows.shop
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: foodypannyjsud.shop
Source: 92s4OjHVFf.exe, 00000000.00000002.1805365430.0000000000CAD000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: potterryisiw.shop
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: 92s4OjHVFf.exe, 00000000.00000002.1806211073.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, 92s4OjHVFf.exe, 00000000.00000003.1805038317.0000000001B02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\92s4OjHVFf.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 92s4OjHVFf.exe PID: 6596, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Jaxx Liberty
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Exodus
Source: 92s4OjHVFf.exe, 00000000.00000003.1686993771.0000000001B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: 92s4OjHVFf.exe, 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: 92s4OjHVFf.exe, 00000000.00000003.1738052371.0000000001B4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 92s4OjHVFf.exe, 00000000.00000003.1738897923.0000000001B64000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\UOOJJOZIRH Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\UOOJJOZIRH Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\92s4OjHVFf.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000000.00000003.1762509039.0000000001B14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1758216225.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1739529170.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1739844543.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1739009530.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1739966621.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1738897923.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1740941093.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1736612289.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1718403928.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1754060015.0000000001B4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1738787868.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1715474160.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1739308703.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1741338157.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1738171796.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1754060015.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1758934891.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1738052371.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1758190444.0000000001B57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1740413834.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1740639294.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1740088391.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1739417270.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1738410105.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1741452050.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1740525755.0000000001B02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 92s4OjHVFf.exe PID: 6596, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 92s4OjHVFf.exe PID: 6596, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465047 Sample: 92s4OjHVFf.exe Startdate: 01/07/2024 Architecture: WINDOWS Score: 100 10 foodypannyjsud.shop 2->10 14 Multi AV Scanner detection for domain / URL 2->14 16 Found malware configuration 2->16 18 Antivirus detection for URL or domain 2->18 20 7 other signatures 2->20 6 92s4OjHVFf.exe 2->6         started        signatures3 process4 dnsIp5 12 foodypannyjsud.shop 188.114.97.3, 443, 49731, 49732 CLOUDFLARENETUS European Union 6->12 22 Query firmware table information (likely to detect VMs) 6->22 24 Found many strings related to Crypto-Wallets (likely being stolen) 6->24 26 Tries to harvest and steal ftp login credentials 6->26 28 4 other signatures 6->28 signatures6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 foodypannyjsud.shop European Union
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
foodypannyjsud.shop 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
towerxxuytwi.xyz true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://foodypannyjsud.shop/api false
  • 14%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
contintnetksows.shop true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
penetratedpoopp.xyz true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
ellaboratepwsz.xyz true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
swellfrrgwwos.xyz true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
foodypannyjsud.shop true
  • Avira URL Cloud: malware
 unknown
pedestriankodwu.xyz true
  • Avira URL Cloud: malware
 unknown
potterryisiw.shop true
  • Avira URL Cloud: malware
 unknown